In my last blog entry, I explored the concept of internal auditing’s stakeholders and who I thought they were. I identified the primary stakeholders of a typical corporate internal audit function as:
The audit committee and the board.
The CEO (or head of the enterprise).
The chief financial officer or individual to whom the chief audit executive (CAE) reports administratively.
Potentially, the other chief officers of the enterprise.
Whether the list is the right one or not is subject to debate, and will clearly vary by organization. What is not subject to debate is the need to identify your own stakeholders and to appropriately align with their expectations.
In its recently published “Common Body of Knowledge (CBOK)” report, The IIA Research Foundation noted:
Stakeholder assessment is not a passive activity. From my experience, they will typically not come to the CAE to initiate a discussion unless an “expectations gap” has emerged. By then, the damage is already done. I strongly urge CAEs to actively engage in stakeholder expectation assessments as a part of ongoing operations. In a recent Audit Executive Center survey, respondents were asked which strategies they most frequently deployed to assess stakeholder expectations. The results were interesting:
Ongoing informal discussions with audit committee chair to assess expectations — 69 percent.
Regular formal meetings with key stakeholders to assess expectations — 59 percent.
Discussions with full audit committee to assess collective expectations — 57 percent.
Formal surveys of stakeholders to assess expectations/performance — 40 percent.
Discussions with the full executive leadership/management team in the same room to assess collective expectations/performance — 26 percent.
If it is true that 30 percent of CAEs do not discuss expectations with the audit committee chairman informally, then I fear they are really missing a key opportunity. From my experience, the most meaningful feedback on expectations comes from informal conversations — not structured meetings or surveys.
While there are lots of ways CAEs can assess stakeholder expectations, one thing is certain: It needs to be undertaken continuously. The expectations of a typical U.S. corporate audit committee in 2005 are dramatically different than the expectations of that same audit committee in 2011. From my experience, an internal audit activity that is still performing against outdated expectations “is an accident waiting to happen.”
I welcome your thoughts on effective strategies for assessing internal auditing’s stakeholders’ expectations.
Richard Chambers, CIA, CFE, CGFM, QIAL, CRMA, CGAP, is the founder and Chief Executive of Richard F. Chambers and Associates, LLC. From 2009-2021 he served as the president and CEO of The Institute of Internal Auditors (IIA), the global professional association and standard-setting body for internal auditors. Chambers has more than four decades of experience serving in and on behalf of the internal audit profession.