One Mistake Internal Audit Cannot Afford to Make in 2020

One of the 2020 resolutions I wrote about at the beginning of the month addressed the need for internal audit to communicate its value. This should always be front of mind for internal audit leaders, as failure to do so can prove disastrous during economic downturns.

Now in my fifth decade in the internal audit profession, I have experienced economic recessions in the 1970s, ’80s, ’90s, 2000s and the 2010s. While the cause and extent of each recession was fundamentally different, each had a similar impact on our profession: Internal audit bore a disproportionate reduction in its ranks, because it was often seen as only a convenient “bill payer.”  Our stakeholders, who were under pressure to reduce costs and shore up the bottom line, didn’t fully comprehend the value that internal audit delivered before the onset of the economic downturn. 

So, what does all of this have to do with 2020? The International Monetary Fund’s January 2020 World Economic Outlook forecasts global growth this year at 3.3%, up slightly from 2.9% in 2019, with advanced economies also expanding minimally, up 0.7% in Japan and 1.3% in euro areas of Europe to 2% in the United States.

I’m neither predicting nor inviting an economic downturn, but let’s face it: A downturn is inevitable. That’s why internal audit leaders must be prepared to communicate internal audit’s value now, not when a downturn is upon us. That is one mistake internal audit can never afford to make.

Successfully showing our value is more than what we say. Indeed, it is all about delivering on that promised value. I’ve written extensively on how internal audit adds value, including dedicating chapters in two of my books to the subject. In my first book, Lessons Learned on the Audit Trail, I included a “Life Lesson” that provides particular insight on this subject:

“Your key stakeholders have the last word on whether you are doing your job well. And they judge an internal audit function not by how well-run it is, but by the value it generates for them.”

So, how does internal audit communicate its value? There is no simple answer, but I have identified five strategies that every internal audit department should be embracing:

1. Obsess about the value we deliver. This one may seem obvious, but we can’t promote what we are not doing! I have seen countless internal audit departments that were simply “checking the box” in executing their mission. Those internal audit departments were sitting ducks when the economy soured. If we are not proactively identifying and following the risks, chances are that we are not creating value. 

2. Communicate incessantly about the value we deliver. As internal auditors, we are often averse to informal, unscripted communications. Management and audit committees can discern value in individual audit reports, but they often fail to connect the dots. If the cumulative effect of our work has been to deliver savings or cost reductions, then it is incumbent upon us to shine the light on what we have done.

3. Don’t be afraid to market.One of the age-old debates surrounding our profession is whether we should market our services. The fact is, we have an obligation to create awareness about what we do, and the potential we have to deliver even greater value. Whether we call that marketing or creating awareness on the part of our stakeholders, I call it an essential strategy.

4. Understand what makes our stakeholders tick. As a newly minted chief audit executive (CAE) many decades ago, I found myself with a new CEO or chief financial officer about every 18 months. Audit committee chairs likewise rotated in and out of their roles. I soon discovered that each of them had their own priorities, and that each of them judged the value internal audit delivered based on their “value premise.” Some wanted us to simply focus on financial controls, while others wanted us to focus much more broadly on risks facing our organization. Each time a key stakeholder changes, we must make sure we have a conversation about the value internal audit does and should deliver. Never forget that, as consumers of internal audit services, these stakeholders make decisions on the perceived value they are receiving. When our budgets demand it, we stop buying products and services in which we don’t find ample value. I address relationship building and acumen in the second edition of Lessons Learned on the Audit Trail, titled The Speed of Risk. The chapter on relationship acumen addresses the need to devote the time and effort to care for those relationships:

Successful CAEs understand that, even in the best of circumstances, the process of building and sustaining relationships is a never-ending task. Senior executives come and go or change hats, and the audit committee roster changes. The CAE must reach out early and often when personnel change. Tending to long-standing relationships is also imperative. Picking up the phone or extending a lunch invitation to talk through a touchy issue pays enormous dividends to the CAE and the entire internal audit staff.

Building trust and understanding in others requires an investment of the CAE’s time and energy, in part because the needs and expectations of key stakeholders are constantly evolving. Successful CAEs recognize the signs of change and recalibrate as necessary.

5. Seek feedback and adjust.As I have observed many times, complacency is the enemy of good. I have watched as good internal audit departments continued to do what brought them success without adapting to new stakeholders, evolving risks, strategic risks facing their organizations, or macroeconomic circumstances. Internal audit delivered what was perceived to be of significant value in the mid-2000s when it focused on Sarbanes-Oxley controls in the U.S. Within three years, the global economy crashed. The way we delivered value in 2010 was vastly different from the value we delivered in 2007.

I hope that I am wrong, that we won’t have to fight the downsizing battle again for years to come. But as I learned as a civilian student at the U.S. Army War College more than 25 years ago: If we don’t prepare, chances are that we won’t win the battle.

As always, I look forward to your comments.