Internal Auditors Can’t be Change Agents if They’re Secret Agents

For almost two years, I have been encouraging internal auditors to become more assertive and adept in “telling their story.” Telling our story is simply another way of creating awareness among those of our stakeholders who may not appreciate the value we create, or our potential. As I noted in a January 2020 blog:

Successfully showing our value is more than what we say. Indeed, it is all about delivering on that promised value. I’ve written extensively on how internal audit adds value, including dedicating chapters in two of my books to the subject. In my first book, Lessons Learned on the Audit Trail, I included a “Life Lesson” that provides particular insight on this subject:

“Your key stakeholders have the last word on whether you are doing your job well. And they judge an internal audit function not by how well-run it is, but by the value it generates for them.”

As most of my readers know, in the past year, I have authored yet another book: Agents of Change: Internal Auditors in an Era of Disruption. In the book, I tackle head on the subject of communicating our value. In fact, I assert that if our value is not fully appreciated, and our potential is unknown – we risk being a well-kept secret in our organizations. As the title of chapter 7 of the book clearly communicates: “Agents of Change Aren’t Secret Agents.”

I have defined “agents of change” in the internal audit profession as those who are catalysts for transformation that creates value for the organizations they serve. The powerful change agents in our profession are those who:

• Deploy innovative solutions to transform the internal audit function itself
• Possess strong business acumen
• Bring a strategic mindset to their role
• Build and sustain strong relationships in their organizations, and
• Are inherently innovative

While change agents in our profession do possess all of the foregoing traits, they still face a major hurdle to success if their contributions to their organization and potential to create additional value are unknown. It is for that reason that the truly successful change agents in our profession are extraordinarily proficient in telling their stories.

So, how does internal audit communicate its value? There is no simple answer, but as I communicated in my 2020 blog, I believe there are five strategies that every internal audit department should be embracing:

1. Obsess about the value we deliver. This one may seem obvious, but we can’t promote what we are not doing! Too many internal audit departments simply “check the box” in executing their mission. Many of those internal audit departments are sitting ducks if their organization faces cost cutting or downsizing mandates. If we are not proactively identifying and following the risks, chances are that we are not creating value. 

2. Communicate incessantly about the value we deliver. As internal auditors, we are often averse to informal, unscripted communications. Management and audit committees can discern value in individual audit reports, but too often they fail to connect the dots. If the cumulative effect of our work has been to deliver savings or cost reductions, then it is incumbent upon us to shine the light on what we have done.

3. Don’t be afraid to market. One of the age-old debates surrounding our profession is whether we should market our services. The fact is, we have an obligation to create awareness about what we do, and the potential we have to deliver even greater value. Whether we call that marketing or creating awareness on the part of our stakeholders, I call it an essential strategy.

4. Understand what makes our stakeholders tick. As a newly minted chief audit executive (CAE) many decades ago, I found myself with a new CEO or chief financial officer about every 18 months. Audit committee chairs likewise rotated in and out of their roles. I soon discovered that each of them had their own priorities, and that each of them judged the value internal audit delivered based on their “value premise.” Some wanted us to simply focus on financial controls, while others wanted us to focus much more broadly on risks facing our organization. Each time a key stakeholder changes, we must make sure we have a conversation about the value internal audit does and should deliver. Never forget that, as consumers of internal audit services, these stakeholders make decisions on the perceived value they are receiving. When our budgets demand it, we stop buying products and services in which we don’t find ample value. I address relationship building and acumen in the second edition of Lessons Learned on the Audit Trail, titled The Speed of Risk. The chapter on relationship acumen addresses the need to devote the time and effort to care for those relationships:

Successful CAEs understand that, even in the best of circumstances, the process of building and sustaining relationships is a never-ending task. Senior executives come and go or change hats, and the audit committee roster changes. The CAE must reach out early and often when personnel change. Tending to long-standing relationships is also imperative. Picking up the phone or extending a lunch invitation to talk through a touchy issue pays enormous dividends to the CAE and the entire internal audit staff.

Building trust and understanding in others requires an investment of the CAE’s time and energy, in part because the needs and expectations of key stakeholders are constantly evolving. Successful CAEs recognize the signs of change and recalibrate as necessary.

5. Seek feedback and adjust. As I have observed many times, complacency is the enemy of good. I have watched as good internal audit departments continued to do what brought them success without adapting to new stakeholders, evolving risks, strategic risks facing their organizations, or macroeconomic circumstances. Internal audit delivered what was perceived to be of significant value in the mid-2000s when it focused on Sarbanes-Oxley controls in the U.S. Within three years, the global economy crashed. The way we delivered value in 2010 was vastly different from the value we delivered in 2007. As we emerge from the Covid-19 pandemic, I anticipate that stakeholder expectations will once again redefine what success looks like for our profession.

I recognize that telling your story may take you outside of your comfort zone. But, successful change agents never relent in pushing the boundaries of their comfort zones. As I convey at the end of Chapter 7:

“Agents of change…are the top performers, the trusted advisors, who recognize they can promote and foster change within their organizations. Agents of change understand that change begets change, and they are comfortable articulating how they can foster change. They build a culture of change by continually pushing to innovate. And they are never satisfied with the status quo.”

As always, I welcome your feedback on this important topic.