In my last blog entry, I explored the concept of internal auditing’s stakeholders and who I thought they were. I identified the primary stakeholders of a typical corporate internal audit function as:
Whether the list is the right one or not is subject to debate, and will clearly vary by organization. What is not subject to debate is the need to identify your own stakeholders and to appropriately align with their expectations.
In its recently published “Common Body of Knowledge (CBOK)” report, The IIA Research Foundation noted:
“It is also imperative for the CAE to determine the specific expectations of his or her chief stakeholders and to develop strategies and tactics to address these expectations. Moreover, it is critical to monitor stakeholder feedback in an ongoing, systematic manner and to update internal audit plans as needed to address changing expectations.” (CBOK 2010 Report V, Imperatives for Change: The IIA’s Global Internal Audit Survey in Action (PDF))
Stakeholder assessment is not a passive activity. From my experience, they will typically not come to the CAE to initiate a discussion unless an “expectations gap” has emerged. By then, the damage is already done. I strongly urge CAEs to actively engage in stakeholder expectation assessments as a part of ongoing operations. In a recent Audit Executive Center survey, respondents were asked which strategies they most frequently deployed to assess stakeholder expectations. The results were interesting:
If it is true that 30 percent of CAEs do not discuss expectations with the audit committee chairman informally, then I fear they are really missing a key opportunity. From my experience, the most meaningful feedback on expectations comes from informal conversations — not structured meetings or surveys.
While there are lots of ways CAEs can assess stakeholder expectations, one thing is certain: It needs to be undertaken continuously. The expectations of a typical U.S. corporate audit committee in 2005 are dramatically different than the expectations of that same audit committee in 2011. From my experience, an internal audit activity that is still performing against outdated expectations “is an accident waiting to happen.”
I welcome your thoughts on effective strategies for assessing internal auditing’s stakeholders’ expectations.