Beware of Auditing up the Wrong Tree​​

One of the most important things internal auditors can do to meet stakeholder expectations is to ensure internal audit priorities align with those of the board and executive management. Risks that “keep our stakeholders up at night” should be keeping internal auditors busy during the day.

If that sounds like common sense, consider that while the National Association of Corporate Directors (NACD) 2017-18 Public Company Governance survey lists significant industry change, business model disruption, and technology disruption as the mostly likely trends over the next year, the 2018 North American Pulse of Internal Audit found only 45 percent of chief audit executives consider their internal audit functions to be very or extremely agile — that is, able to quickly and efficiently handle whatever disruptions come their way.

If your internal audit function is limited by its ability to only audit traditional risks, you risk becoming irrelevant or missing the new or emerging risks facing your organization. Where I come from we call that “barking up the wrong tree.” If this sounds familiar, I addressed the topic in a 2013 blog post.

Misalignment is natural during times of rapid change, and technological advances are making rapid change the norm today. As the environment around us changes at lightning speeds, internal audit functions continue to work through one of the most dramatic periods of change in the history of the profession. Internal auditors are being asked to address more complex risks with fewer resources and under more intense scrutiny. This is at the heart of my admonition in recent years that internal audit functions must learn to audit at the speed of risk.

To survive and thrive in this environment, we need to step out of our comfort zones and into complex technology risks and the more qualitative world of culture and governance. A robust and continuous dialogue with your stakeholders will not only allow you to zero in on their priorities, but it will also solidify stakeholder relations and help you avoid some of the pitfalls I discussed in my recent blog post, “Five Red Flags Your Internal Audit Department Is Losing Stakeholder Support.”

So, are you aligned? Ask yourself:

• How often do I ask the stakeholders about their priorities? Two-way communication with the chief executive and audit committee is critical.
• Do we have the right skill set in internal audit to meet those needs? Developing and deploying a robust talent management strategy is critical.
• Do we have sufficient resources? Once you know what you need to focus on and are sure you have the skills to provide assurance, you still need to have the resources to make sure you aren’t being pulled in too many directions.

​Assurance on the effectiveness of internal controls will always be at the core of the internal audit mission. But we need to expand our horizons and make sure our goals, skills, and resources are aligned with the growing demands on executive management and audit committees.

This year’s Pulse of Internal Audit survey provided strong support and direction for preparing your audit function to meet growing stakeholder demands through agility, innovation, talent management, and board engagement. I provided an in-depth look at these topics in my blog post, “Four Urgent Keys to Transforming Internal Audit,” earlier this year.

These resources should go a long way toward helping you with the “how” of aligning internal audit priorities. For the “what,” I’d say the best source is going to be your audit committee and executive management — they know what keeps them awake at night.

Are you auditing up the wrong tree? There’s no way to know without asking.

That’s my perspective. I’m sure most of you are dealing with this challenge right now. I’d love to hear from you about ways you’ve achieved alignment.​