Five Red Flags That Your Internal Audit Department May Be Losing Stakeholder Support

Stakeholder support is vital to internal auditing’s ability to add value and contribute to the organizations we serve. When chief audit executives and their staff are not meeting stakeholder expectations, there are typically signs or early indications that the support we might have enjoyed in the past is starting to slip.

I saw this scenario play out many times during my years leading internal audit for the U.S. Army. I have likewise seen it occur in the corporate sector. Like many of my colleagues, I’ve also taken over internal audit functions where my predecessor had lost that connection with stakeholders. So I’ve seen the signs. I know what they look like, and I thought I’d share some with you:

1. Lackluster response. If you’re having trouble getting stakeholders to complete your annual risk assessment, that’s a problem. Executives and board members all have things that keep them up at night. If they won’t share their concerns with you, it could mean that they believe that you will not act on them, or that you don’t have the ability within your team to address them.

2. The phone never rings. Delivering value is key to the long-term success of any internal audit function. If executives and business unit leaders do not feel internal audit adds value, they will rarely seek you out whenever a problem arises, or whenever they believe internal audit input or insight is needed. If your phone isn’t ringing, there may be a disconnect.

3. Breakaway republics. Internal audit is increasingly being referred to as the third line of defense, not a dotted line of defense. A strong internal audit function speaks with one voice. When business units start creating their own audit teams (or their own elements that duplicate the capabilities of internal audit), chances are that they’re not getting what they want from you.

4. Resource reduction. Companies invest in what they value. If an organization is cutting back across the board, that’s one thing. But if your budget is slashed disproportionate to other departments, that’s a pretty clear indicator that you do not enjoy the level of stakeholder support that you need.

5. The external quality assessment isn’t your idea. Standard 1312 of The IIA’s International Professional Practices Framework requires external quality assessments of internal audit departments at least once every five years. Internal audit should never be in a position in which they’re not the ones proactively pushing for that assessment. If your stakeholders independently initiate a quality assessment, it is likely they’ve got concerns and are looking for validation.

So those are some of the signs I watch for. The question now becomes: What can you do to get back on track? Anyone who knows me won’t be surprised by my answer. I think the best way to start is to acknowledge the elephant in the room; to say, “I understand that we may not be meeting your needs and expectations, and we are re-committing ourselves to doing a better job.”

Seek clarity. Get honest feedback on your strengths and weaknesses and enlist help from stakeholders in making the internal audit function more effective. Vest them in your positive outcome. It’s not enough to simply declare that you are going to do better. You need to engage your stakeholders in the process.

The rehabilitation process can be difficult. But recognizing that you’ve got a problem is half the battle.

​What do you think? I’m sure some of you have had to deal with a crisis of confidence, or observed one at another organization. How did it play out? I’d love to hear your ideas on how an internal audit team that has fallen out of favor can reconnect with its stakeholders.