Effective Communications: An Enduring Challenge for Internal Auditors

As internal audit professionals, we​​ are often recognized for many outstanding characteristics and skills that we bring to bear in executing our important role. We are lauded for independent organizatio​nal structures, personal objectivity, risk management and business acumen, and analytical skills. However, there is one attribute for which we are rarely praised: our ability to communicate effectively.

As with most professional characteristics, the gap in an ability to communicate effectively often starts at the top — in our case with chief audit executives (CAEs). I recently delivered a presentation on the attributes of highly success​​​ful CAEs in which I identified “dynamic communication skills” as one of the seven attributes. To drive home my point, I outlined common complaints I hear from internal audit stakeholders of the topic on internal audit communication. Specifically, I hear the following observations far too often from audit committee members, management officials, and others:

• Internal audit reports are too voluminous or not well written.
• Too many reports or too much content is provided to the audit committee.
• Internal audit results are “not synthesized” in a way that would permit users to “connect the dots.”
• Internal auditors are “introverts by nature” and reluctant to communicate informally.
• The CAE and senior internal audit staff are not very effective at delivering presentations.
• The CAE is reluctant to offer/issue opinions.

The list could go on, but I suspect that you get the point. We seem to be very effective at developing information and formulating insights. Where we sometimes struggle is in effectively communicating what we know.  

As with overcoming any deficit, the first step is in recognizing the problem. I would encourage CAEs and internal audit staffs to undertake a candid assessment of their own communication skills. Then they need to benchmark stakeholder needs and expectations against their communications style and content. In the end, we need to be open to new approaches. Depending on the appetite for change of your stakeholders, we should be open to ideas such as:

• Flexible and customized reporting formats — including electronic reports or summary reports with hyperlinks to more in-depth discussion of key findings.
• Synthesized reports to audit committees with ratings or indicators of reports to which audit committee members should pay particular attention.
• Capstone or summary reports that “connect the dots” in terms of the overall effectiveness of internal controls or risk management.
• Regular informal meetings with executive management and business unit leaders to build relationships and continuously identify emerging risks (see the May issue of Tone at the Top, “We Ne​ed to Talk” (PDF)).
• Striving to develop succinct and visually impactful presentations for management and audit committee presentations.
• Annual opinions on the effectiveness of internal controls. However, care should be taken to ensure that users of such reports clearly understand pertinent limitations (see the IIA Practice Guide on Formulating and Expressing Audit Opinions).

Regardless of whether you are open to the ideas outlined above, it is critical to recognize the importance of effective communications, and it is never too late to implement new strategies.

I invite your ideas as well.