Five Dilemmas Every Internal Auditor Will Face

As I have commented on numerous occasions, internal auditing can be a rewarding profession for those who enjoy making a difference in their organization. However, as with any profession, it is not without its challenges. New internal auditors often become frustrated when they are unable to generate an impact as quickly as they would like, or when things don’t go their way. During my career I have experienced the profession from numerous vantage points. As a young internal auditor directly out of college, I experienced the awe, excitement, and occasional frustrations that come with any new career. As I became more seasoned, the wide-eyed enthusiasm waned, but my passion for the work did not. Later, as a chief audit executive (CAE), I experienced new challenges, opportunities, and — yes — occasional frustrations.

Throughout my career I have mentored scores of new internal auditors as they sought to make their way in an unfamiliar profession. As I look back on my own experiences and those of the auditors I have coached, I have identified five dilemmas that often serve as an early source of frustration. I feel confident in saying that every internal auditor will experience them at some point. My advice following each dilemma is directed at new internal auditors or those experiencing the dilemma for the first time:

1. How much to audit. This is an enduring challenge for internal auditors. There is always a temptation to audit more rather than less. Should you evaluate three years worth of data? Should you add two more objectives to the audit plan that you believe are really important? These would be easy questions to answer if it weren’t for two very important constraints: time and resources. In the end, my advice is to audit on the basis of risk. The preliminary risk assessment at the outset of an audit engagement will reveal the most significant risks. As an internal auditor, you must then exercise professional judgment when reconciling the risks with resource limitations and the amount of time an expansion of audit objectives will mandate. 
2. How much to communicate. Abraham Lincoln once apologized for writing a long letter, because (he observed) he didn’t have time to write a short one. This is equally true for internal auditors. The IIA’s International Standards for the Professional Practice of Internal Auditing(Standards) are very flexible when providing direction on communicating results. Standard 2410simply requires that communication of engagement results include “the engagement’s objectives and scope as well as applicable conclusions, recommendations, and action plans.” The temptation is always present to add a lot more than the minimum requirement. My advice to new auditors is to tell your story as crisply and succinctly as possible. Remember, the longer your report is, the less likely that it will be read in its entirety by those in senior management who are in the best position to implement the very corrective actions you are seeking to influence. 
3. How to respond when your report is edited. Report writing and editing are enduring sources of frustration for everyone in internal auditing. The first time one of your choice phrases or report narratives is eliminated or edited extensively by your supervisor or CAE may be frustrating or even disheartening. Don’t overreact. Seek to understand why the edits were made, and learn from the experience of those more seasoned than you. If you really feel strongly, then make your case rationally and without emotion. In the end, though, you will have to accept the decisions made by those who are ultimately accountable for the quality of the internal audit engagement. 
4. How to deliver a balanced message. As internal auditors, it is easy to fall into the trap of reporting only negative results. After all, that is what they pay us for — right? It is important to remember that we actually add value by providing assurance on the overall effectiveness of risk management, control, and governance processes. A balanced report that also indicates “satisfactory performance” where warranted is an important component in any internal audit report. We shouldn’t limit assurance to what isn’t working well. We should deliver a balanced and objective view. 
5. How to respond when management “pushes back.” As a new internal auditor, the first time management (or other operating officials) takes strong exception to your draft report or audit results is apt to be a significant emotional event. The temptation is always present to lash back or become intransigent. Neither of these will serve your long-term purpose well. I learned early in my career that these were the times when I most appreciated the calm and assistance of the more seasoned members of the internal audit team. In all likelihood, your supervisor or the CAE will have plenty of experience with contentious audit results and is likely to have the relationships with the audited officials — both of which are key ingredients to resolving any standoffs.

I am sure there are many other dilemmas that we face in the course of our careers as internal auditors. However, these are the ones I have found to be the most commonly encountered. I welcome your thoughts as well.