Five Red Flags Your Internal Audit Department Is Losing Stakeholder Support

Early in my career, I took for granted that internal auditing existed simply because it was necessary. Very rarely did anyone use terms like customers or stakeholders. I don’t remember ever hearing those terms during my first decade in the business.

I knew that regulations of the U.S. Army, where I worked at the time, required that every activity have an internal audit function, so I assumed we were there simply because we had to be. Resources were plentiful, and no one was really scrutinizing the value that we delivered, which isn’t surprising. People generally don’t begin to question the value of something until it becomes difficult to pay for it. However, all that changed when Army budgets started being reduced. Stakeholders who weren’t happy with internal audit were not reluctant to signal their displeasure.

Stakeholder support is vital to internal auditing’s ability to add value and contribute to the organizations we serve. When chief audit executives and their staff are not meeting stakeholder expectations, there are typically signs or early indications that the support we might have enjoyed in the past is starting to slip.

I saw this scenario play out many times during my years of working with and advising internal audit functions. I have likewise seen it occur in the corporate sector. Like many of my colleagues, I’ve also taken over internal audit functions where my predecessor had lost that connection with stakeholders.

Several years ago, I shared my insights on this topic, and they largely hold true today. I’ve seen the signs. I know what they look like, and I thought I’d share my updated perspectives on these signs with you.

1. Lackluster response. If you’re having trouble getting stakeholders to respond during the annual risk assessment, that’s a problem. Virtually all executives and board members have things that keep them “awake at night.” So if they aren’t sharing their concerns with you, it could mean they don’t trust you to act on them or don’t think your team has the ability to address them.

As an internal auditor, you go through this process at least annually, though I hope you have designed a continuous component to enable you to audit at the speed of risk. If your stakeholders don’t appear interested in the risk assessment, offering you little or no food for thought, that’s not a good sign. It may mean they view your risk assessment as irrelevant. Perhaps they have gone through the process with you before but concluded that nothing had come of it.

2. The phone never rings. Yes, this is a throwback to an earlier time, not that long ago, when we used phones a lot more than we do now. Email or text messaging may be your main form of business communication these days. Regardless of method used, if no one is reaching out to internal audit to ask that you address an emerging risk or evaluate a developing situation, it’s likely your stakeholders don’t see you as responsive or a resource. Delivering value is the key to long-term success for any internal audit operation. If top executives and business unit leaders don’t think internal audit adds value to the organization, they won’t seek you out when a problem arises.

3. Breakaway republics. When business units start creating their own audit teams — or elements within a unit that duplicate the capabilities of internal audit — chances are you’re not living up to their expectations. When different business groups within an organization come to the conclusion that internal audit isn’t serving their needs, they may start to set up review functions of their own. They may not call them internal audit, but they do the same kind of work. That’s a sign those stakeholders don’t see the value of internal audit or don’t think it can be trusted.

4. Resource reduction. Companies invest in what they value. If an organization is cutting back across the board, that’s one thing. But if your budget is slashed disproportionate to other departments, that’s a pretty clear indicator that you do not enjoy the level of stakeholder support that you need. After all, a strong internal audit function focused on cost reduction and containment can be worth its weight in gold when organizations are facing inordinate pressure on the bottom line.

5. The external quality assessment isn’t your idea. IIA Standard 1312: External Assessments requires external quality assessments of internal audit departments at least once every five years. The internal audit department should always be the one proactively pushing for that assessment.

If your stakeholders independently initiate a quality assessment, it is likely they have concerns about your department and are looking for validation. If you haven’t had an external quality assessment for a few years, and you get a call from the CEO, the chief financial officer, or even the audit committee, and they say, “We’d like you to get a quality assessment,” you need to be concerned. Worse yet, if they take the lead in identifying who is going to perform the assessment, that is the clearest sign possible that something is seriously wrong between your function and its stakeholders.

So after identifying some telltale signs of trouble, the question becomes: What can you do to get back on track when one or more of these signs appear? Anyone who knows me won’t be surprised by my answer. I think the best way to start is to acknowledge the elephant in the room and say, “I understand that we may not be meeting your needs and expectations, and we are recommitting ourselves to doing a better job.”

Seek clarity. Get honest feedback on your strengths and weaknesses and enlist help from stakeholders in making the internal audit function more effective. Vest them in your positive outcome. It’s not enough to simply declare that you are going to do better. You need to engage your stakeholders in the process.

The rehabilitation process can be difficult. But recognizing that you’ve got a problem is half the battle.

What do you think? I’m sure some of you have had to deal with a crisis of confidence, or observed one at another organization. How did it play out? I’d love to hear your ideas on how an internal audit team that has fallen out of favor can reconnect with its stakeholders.