I had a conversation recently with several attendees at The IIA’s International Conference about including positive commentary in internal audit reports. Some were in favor of identifying leading practices they observed related to strong risk management and internal controls in audit reports. Others were not so sure. They argued that we really aren’t there to be cheerleaders, and make management feel good about “just doing their job.” I was was of the opinion that a “balanced report” should acknowledge what went well. But, not everyone in the conversation was convinced. I wasn’t surprised by the lack of consensus, for this has long been a point of contention within the profession.

I met a behavioral psychologist several years ago who often worked with internal audit departments. He felt strongly internal auditors “get it all wrong” when it comes to changing our clients’ behavior. He said internal auditors, especially in their reports, concentrate on what went wrong in the past, and often fail to mention anything that went well or is operating efficiently in the present. The psychologist was adamant that positive reinforcement works best when you want to change behavior, and that this “rule” is especially important in a profession such as internal auditing because, as internal auditors, we have a reputation (whether deserved or not) for finding fault more often than we find reasons for praise.

Ouch! I explained that internal auditors almost always try to bring balance to their reports by mentioning the good as well as the bad. But I also conceded that, in general, our reports do tend to feature more information about what needs to be fixed than what works well or improvements that have been made.

While I strongly believe that internal auditors are much better at finding the positive in situations than the psychologist thought, I acknowledge that this is an area where there’s room for improvement. To be sure, to provide assurance on the effectiveness of controls, we cannot step away from presenting potentially negative findings in our reports. However, taking the time to accentuate the positive demonstrates a more balanced and objective approach, and often serves as greater motivation for internal audit clients.

Acknowledgement of accomplishments through individual reports is certainly beneficial to management, but it pales compared to the impact of enterprise- or business unit-wide “shoutouts” from internal auditors. Drawing attention to a business unit or practice that others should emulate will not only serve as a source of pride for management, but it will take some of the sting out of negative observations or findings.

So, what is the best approach to synthesizing and communicating leading practices in an organization? One approach is to issue quarterly or annual reports that summarize the best practices observed by internal auditors over the previous period. For example, if the audit plan includes a review of procurement practices during audits of retail outlets, or regional or global operating divisions, a summary report that identifies leading procurement practices observed will likely add value for all concerned.

According to the psychologist, positive reinforcement is an effective way to change behavior. And when we issue reports that specifically focus on successful practices, we are motivating those whose practices we highlighted, and we are encouraging those whose areas may not have been audited but who struggle with the same challenges. Periodic reports on leading practices should take very little time to prepare, if we routinely include management accomplishments throughout the year in individual audit reports.

Promoting the positive also can strengthen relationships. Too often we underestimate the power of an honest compliment, but a few words of appreciation and encouragement can help turn a rocky client relationship into an effective partnership.

Knowing that the most successful business practices will be reported, not just once but twice, by the internal auditors will visibly demonstrate that we appreciate the importance of our clients’ actions. You’ve probably heard the old communication axiom, “Tell them what you’re going to tell them, tell them, then tell them what you’ve told them.” I’m not sure who said it first, but they probably would have made a great internal auditor. Certainly, messages about risk management and internal controls bear repeating, but if the psychologists are right, messages about successful risk management and internal controls deserve particular attention.

At times, we have to repeat negative messages to ensure that management effectively addresses problem areas. But if we really want to bring about improvements in our organizations, maybe it’s time we start repeating some of the positive messages as well.

What are your thoughts on how best to balance the negatives with the positive? Share them with me on LinkedIn or Twitter, or drop me an email at blogs@richardchambers.com.