Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​​​What’s Your Brand?

Winning internal audit brands are those that are designed proactively instead of happening by default.

Comments Views

​Whether intended or not, every internal audit department has a brand. After all, a brand is simply the image, emotions, or perceptions that people experience when they think of a product. Although there is not a single correct internal audit brand, there are certain desirable core characteristics that apply across organizations. And it turns out that a strong, winning internal audit brand helps to drive the effectiveness and influence of an audit department (see "Branding and Department Effectiveness" below).​

To strengthen its brand, an audit department should follow a brand management approach, including the determination of brand positioning and the development of a marketing plan. In the end, an internal audit department that consciously chooses its brand is in a superior position to one that allows its brand to develop by default.

Branding 101

​​A brand is, in effect, an identity. BMW is "the ultimate driving machine," Disney is "family entertainment," and IKEA offers "well-designed, functional home furnishings at low prices." All of these brands capture the distinctive characteristics of the products and services.​

Although branding addresses the functional benefits of a product, it is so much more than that. "A brand is the intangible sum of a product's attributes," according to advertising agency founder David Ogilvy. "Branding is the art of becoming knowable, likeable, and trustable," according to Jon Jantsch of Duct Tape Marketing. "The brand is a promise of the value you will receive," says business author Tom Peters.

Branding Pitfalls​

There are many examples of unfortunate internal audit department brands, often the result of an audit department brand occurring by default rather than by design. Undesirable brands include: police, arrogant, secretive, cynical, don't know the business, "gotcha," risk averse, narrow scope, insensitive to the ease and efficiency of business, and compliance focused.

Some tension between internal auditors and their stakeholders is appropriate and even can be constructive. But it is problematic for audit departments to be branded in these negative ways. The consequences can vary, from how open people are with internal audit, to who wants to work in audit, to the committee and project opportunities provided to internal audit, and audit's ability to promulgate self-assessment tools and controls education.

"Winning" Internal Audit Branding​

Internal audit can be one of the most misunderstood and underappreciated departments in an organization. A winning internal audit brand not only conveys the audit department's role, but also addresses its branding goals, which are to engender trust, address the promise to stakeholders, and foster desirable stakeholder emotions and perceptions. Branding is more than being descriptive.

To an extent, an audit department's role and brand need to fit within the organization and its needs. But there are certain core branding characteristics that are desirable across organizations (see "Characteristics of a Winning Internal Audit Brand" at right).

Characteristics of a Winning Internal Audit Brand

Internal audit staffs should collectively be viewed as having core characteristics that contribute to the brand of the department. Those characteristics can include:


  • Knowledgeable about the business
  • Talented
  • Honest
  • Good listeners


  • Independent
  • Unpretentious
  • Open
  • Fair/balanced


  • High impact
  • Thoughtful risk-takers
  • Practical
  • Helps business achieve objectives

​​​For example, honesty is a fundamental, required trait for internal auditors. Independence also is a basic trait; auditors must not be seen as politically motivated. Lack of pretense is important because there is a risk that any auditor, due to the inherent power of the role, will come across as arrogant.

Being open and transparent are qualities that should be the norm for audit and consulting work, except in the cases of fraud and misconduct investigations, due to their sensitive nature. Being practical means having sensitivity toward the ease of conducting business, rather than imposing unnecessary burdens. Controls, after all, should be fit-for-purpose and are inefficient if they are excessive relative to the risks they are addressing.​

Develop a Winning Brand

To develop a winning, positive brand, an audit department needs to use a brand management approach, just like any other product or service. This approach encompasses four steps.

Step 1: Assess current brand awareness and positioning 

How do stakeholders perceive the internal audit department? There are quantitative and qualitative assessment approaches, which are both useful and complementary. The quantitative approach involves sampling a population and extrapolating the results. This typically is accomplished using an employee questionnaire that is electronic, confidential, and nonintrusive. The most typical qualitative approach is to conduct focus groups with employees. This approach does not produce statistically significant results, but provides useful insights into stakeholder perceptions. If needed, the audit department should enlist the help of the organization's marketing department to implement these methodologies. The key areas these assessment approaches should address are: 

  • Brand awareness levels by stakeholder group.
  • Brand preference (i.e., satisfaction with internal audit's performance, desire to use its services).
  • Brand knowledge (i.e., awareness of the capabilities and expertise of the audit department).
  • Perceived positioning within the organization (i.e., perceptions of an organization's internal audit function, its image).
  • Level of trust (i.e., perception of internal audit as "gotcha" vs. fair and balanced).

Step 2: Determine desired brand awareness and positioning 

Target awareness levels — the percentage of the organization's population that is aware of the internal audit department — should be developed according to stakeholder segments (e.g., executive management, middle management, etc.). The audit department also should determine the key tangible components that it wants to feature (e.g., the department's activities and expertise). Most critically, the audit department must determine the key intangible elements that it wants to highlight as its defining features. These qualities are selected from the characteristics of a winning brand.

As an audit department conveys the elements of capabilities, style, and value comprising a winning brand, the potential develops to increase stakeholder trust in internal audit dramatically. Trust is a critical part of the equation for department effectiveness — it helps ensure clients understand that internal audit is not out to get them, listens to their concerns, and doesn't have a hidden agenda.

Step 3: Develop and implement a marketing plan to close the branding gap 

The difference between desired branding (step 2) and actual/current branding (step 1) is the branding gap. To close that gap, an audit department needs to implement a marketing plan. The main components of that plan are promotional tactics and adjustments to the department's work product.

Successful audit promotion tactics start with developing a succinct, compelling department message, or "pitch." It should incorporate elements of the capabilities, style, and value on which the department has decided to focus. A potential key message point within a department pitch, for example, could be:

Internal audit is an independent function that uses its knowledgeable team to work openly with business units to help them better manage risks and achieve objectives.

Once the department pitch is created, the audit department needs a promotional campaign that reaches its key stakeholders with sufficient frequency. Useful promotional tactics include:

  1. Developing an engaging internal audit intranet site with extensive links from the company's intranet.
  2. Ensuring that corporate communications (e.g., articles on corporate performance) regularly feature internal audit accomplishments.
  3. Distributing regular internal audit communications via newsletter or email to all employees providing highly summarized results of audits, control themes, best practices arising out of audit work, and a description of the department's role and positioning.
  4. Designing a one-page department brochure that can be left behind after meetings.
  5. Taking advantage of in-person marketing opportunities (e.g., risk update meetings and client meetings during projects) to convey the department's pitch and leaving behind appropriate items, such as self-assessment tools and risk and control models.

Another key element of the marketing plan involves adjusting the audit department's actual work product to reinforce its desired branding. This adjustment falls into three categories.

  • Develop additional types of audit projects to demonstrate desired branding. Conduct consulting projects, including pre-implementation reviews, in which risk management and controls input are provided up front rather than after the fact. These projects reinforce the breadth of audit's work and its impact. Also, deploy within the organization an internal controls checklist, which is a list of key controls expected of management along with reference documents and functional contacts. The controls covered should be wide-ranging, from the control environment to human resources, finance, and IT. The checklist serves as a self-assessment and self-reporting tool and reinforces that audit is helping the business and creating an open environment.
  • Broaden the scope of traditional audits to reflect department branding goals. Use a dynamic risk assessment process in which the audit plan is regularly updated, thus underscoring that the audit department is current, relevant, and knowledgeable about the business. In addition, ensure that the audit plan addresses the company's strategic priorities as well as its top risks (as identified by the enterprise risk management process or by executive management). This audit coverage underlines the impact and relevance of the internal audit department.
  • Improve the handling of audit findings to reinforce desired branding. Develop a formal escalation process for disagreements with management. Though it rarely will be used, its existence reinforces the department's desire to listen and be fair. Keep clients informed of findings throughout the audit process, which will underscore the open communication style of the department. Lastly, use positives in audit reports when appropriate. To promote audit's branding as fair and balanced, note improvements or areas where management is excelling. In addition, the rating system should have the potential for positive ratings when warranted (e.g., a rating above "satisfactory").

Step 4: Ensure a feedback loop and continuous improvement through brand metrics

The final step of the branding initiative is to ensure a feedback loop through metrics so that branding weaknesses can be identified and corrected. Examples of relevant metrics include tracking: 

  • Requests for audit assistance.
  • Awareness levels of the internal audit function.
  • Satisfaction with internal audit's performance.
  • New and returning visitors to audit's intranet site.
  • Auditors hired into other important roles in the organization.​

Transform Your Brand

Using a brand management approach and determining audit's featured capabilities, style, and value can transform an internal audit brand. The purpose, similar to any other brand, is to become more recognized, likeable, and trustable. The end result of this brand management exercise is to improve substantially the internal audit department's effectiveness and influence within the organization.​

Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.​



Comment on this article

comments powered by Disqus
  • IIA GRC_July 2020_Premium 1
  • AuditBoard_July 2020_Premium 2
  • IDEA_July 2020_Premium 3