If Internal Audit Is Not Making an Impact, Roll Up Your Sleeves

If you occasionally have doubts about the impact of internal audit on your organization, you are not alone. According to Deloitte’s 2018 Global Chief Audit Executive Survey, a staggering 60 percent of chief audit executives (CAEs) believe the internal audit function does not have a strong impact and influence within their organization. And, while that’s obviously bad news for internal auditors, it was actually an improvement from 72 percent in Deloitte’s 2016 survey.

Internal audit’s impact and influence are strengthening at many organizations, but obviously there is still a lot of room for improvement. When I saw the survey results, I posted a question on LinkedIn asking whose fault was it if internal audit did not exert a strong influence on the organization. I assumed that most would say it was the CAE’s fault. To my surprise, many responses pointed to management or the board.

It’s not always easy to admit our faults, but I was dismayed to see how fast many CAEs blamed others for internal audit’s shortcomings. I recognize that, in some corporate cultures, management and the board suppress internal audit, and some have no interest in a strong and well-resourced internal audit function. However, I do not believe this represents the majority of organizations around the world.

In organizations where internal audit does not make a substantial impact or exert a strong influence, we need to acknowledge that some of our own actions contribute to the problem. I don’t want to play the blame game here, but as blogger Norman Marks has pointed out, the path to fixing a problem starts with acknowledging it. If most CAEs believe they don’t have a strong influence on their organizations, it is vital to understand why.

I have had the opportunity to visit quite a few internal audit functions during the past decade, often meeting with members of the audit committee and C-suite. I found that internal audit functions that are generally regarded as influential seem to share several characteristics.

1. Focusing on Critical Risks

If you aren’t focusing on the organization’s most critical risks, it shouldn’t come as a big surprise that you might not be influential. If an internal auditor on the Titanic had been inventorying chairs on the deck while the iceberg was tearing through the ship, he or she probably wouldn’t have been influential, either.

2. Enhancing Business Expertise

If you don’t understand the business, you will never be in a strong position to offer influential advice. Imagine, for example, receiving business advice from your teenager. A teen might occasionally have helpful ideas, but you probably wouldn’t turn to him or her for counsel the next time you need to make a critical business decision. For internal auditors, having audit expertise isn’t enough: We also must cultivate a deep understanding of the business, so that we can engage in credible conversations with management and the board on business and strategic risks facing the organization.

3. Sharing Insights and Advice

Influential internal audit departments don’t simply check other people’s work or try to catch errors; they offer advice for making improvements. If your advice results in substantial savings or eliminates unnecessary expenses, for example, then you most likely will be influential. But if your internal audit report simply points out routine paperwork errors from the past, your influence is probably limited.

4. Improving Internal Audit Innovation

The Deloitte study found that internal audit groups that adopted innovative approaches and methods tended to have greater impact and influence than those that had not. More than two-thirds of respondents with strong impact and influence said they expected to increase their investment in internal audit innovation over the next three to five years, citing developments such as data analytics, robotic process automation/cognitive technologies, predictive analytics, risk anticipation, and adopting agile approaches.

5. Identifying Emerging Risks and Sharing Foresight

I will never forget the first time I pointed out an emerging risk during the course of an internal audit. My client sat up straight, opened his eyes very wide, and said, “Oh, I hadn’t thought of that.” At that moment, I knew my work was having an impact. It’s a rewarding experience for an internal auditor.

In my role, I am always attuned to trends and developments in the internal audit profession. When new research is published, I am sometimes encouraged by the progress we are making. However, as with the Deloitte Global CAE survey, I am sometimes discouraged. It is an anathema that any CAE would be content to lead an internal audit function that is not seen as impactful or influential in its organization. When internal audit is not seen as impactful, it is not time to point fingers. It is time to roll up our sleeves.                                                  

There are a lot of factors that determine whether your internal audit function has a strong impact and influence. The vast majority are within your control. What are your thoughts on internal audit impact and influence? I welcome your ideas.