When Our Customers Speak — We Had Better Listen!

Many of us are old enough to remember the iconic commercials run by the renowned investment advisors, E.F. Hutton. The premise of the advertisements was that, “When E.F. Hutton talks, people listen.” The phrase is easily applicable to the marketplace. When one’s customers talk, those who serve them had better listen. This includes internal auditors.

In my first blog post of the 2017, I shared five resolutions that will help internal auditors prepare for the future. I believe the top resolution on the list — be responsive to stakeholders (customers) — is of utmost importance and deserves more in-depth discussion.

Understanding the needs and desires of management and the board of directors should be the highest priority not just for chief audit executives but for every member of the internal audit staff. We must be keenly aware of the pressures and goals that influence their decision-making and understand internal audit’s role in easing those pressures and facilitating achievement of those goals.

This requires internal audit to be intimately familiar with four factors that drive most organizations: mission, strategies, objectives, and risks. The latest issue of The IIA’s Global Perspectives and Insights provides an excellent analysis of the key steps internal audit can take to elevate its strategic impact on the organization, and one of the most important is being attuned to those four factors.

I’ll discuss these more in depth later, but I’d like to first address the clear mandate internal audit has from its customers to become more than just a function that provides assurance on financial reporting and compliance. Recent customer surveys reflect their desire for internal audit to become an integral part of the organization’s assessment and evaluation of strategic risks.

The Common Body of Knowledge (CBOK) Stakeholder Survey, a product of The IIA’s Internal Audit Foundation (IAF), presented an unprecedented peak at the expectations of internal audit’s customers. The survey results disclosed that 64 percent believe internal audit should assume a more active role in assessing and evaluating strategic risks. This mandate is not a call for wholesale changes to the way internal audit operates. Indeed, the same CBOK survey found our customers view assurance as essential and is assumed as foundational for internal audit functions.

The IAF’s Voice of the Customer, is the “must-read” whitepaper based on the CBOK stakeholder survey/interviews. The publication outlines important steps internal auditors should take not only to protect and build assurance but also to coordinate with the second line of defense to ensure alignment with customer expectations.

However, assurance gets us only part way to our desired goal of becoming trusted advisors to management and the board. As the scope of internal audit’s services expands to include advisory roles on risk assessment and evaluation, the need for a high-level understanding of organizational mission, strategies, objectives, and risks becomes more important than ever.

Gaining this high-level understanding should be approached systematically and rely heavily the CAE’s deep understanding of the organization’s operational plan. This plan provides insights into the organization’s strategic mission and intent. The organization’s strategic mission ultimately dictates organizational objectives and risks so a fundamental knowledge of it provides CAEs significant guidance in all four target areas.

It is important to keep in mind two additional aspects of the customer relationship. First, internal audit must be familiar with not only the strategic mission and the objectives designed to meet them, but also the metrics identified to measure success. Second, we must remain ever cognizant that all strategies and objectives involve risks, and that, ultimately, internal audit’s business is about assessing how well the organization manages risk.

All of this assumes, of course, a strong relationship between the CAE and management and the board. On numerous occasions in this blog and elsewhere I have urged internal auditors to invest in developing strong relationships with customers that are built on mutual trust and respect.

Successfully building such relationships not only enhances internal audit’s value to the organization, but ideally also helps protect its independence and objectivity. C-suite executives and board members who fully appreciate the value of internal audit’s assurance and advisory services are more likely to ensure it remains independent and well-resourced.

Building intimate knowledge of the organization within the audit function is critical to its success today and in the future. The steps I’ve outlined provide a strong foundation for building internal audit functions that are naturally responsive to stakeholders.

As always, I welcome your comments.