In my role as president and CEO of The IIA, I meet and converse with internal auditors around the world. It’s gratifying to hear abou​t their successes, and important to learn about their challenges. In this week’s blog post, I want to share with you some of the things I’ve heard when internal audits go bad. My hope is that, by talking about our mistakes, we can correct our course and prevent future problems. 

In general, most issues that arise when the wheels come off during internal audits stem from a single root cause: inadequate engagement planning. It can be tempting to cut engagement planning short, especially when we’re still trying to wrap up the last audit. But when we resort to shortcuts, the results can be disastrous. In the words of Benjamin Franklin, “By failing to prepare, you are preparing to fail.” 

Here are just a few examples of how things can go south when internal auditors fail to adequately plan:

• I recently heard about an internal audit that got off to a disastrous start simply because the auditors didn’t explain to the client during the planning phase why they were coming and what they hoped to accomplish. To be sure, they had intended to detail the audit objectives and process at the beginning of fieldwork, but before they could do so at the kickoff meeting, their nervous new client was already in a defensive meltdown mode.  
• Another internal audit department was proud that it gave clients plenty of notice about upcoming engagements – six full months ahead of time, in fact, when the annual plan was approved. But when the team flew in for fieldwork in Europe, the client wasn’t there. Once again, the problem turned out to be poor communications during the audit planning stage. The engagement supervisor failed to check back with the client in the weeks immediately before the audit, and the client simply forgot about the upcoming engagement.
• Last year, I heard about an internal auditor who reviewed the results of a previous internal audit during the planning phase, but did not consider the work of other assurance providers. Testing was well under way when the exasperated client pointed out that the compliance department and regulators had both reviewed the exact same things a month earlier — and that neither had noted any problems. Naturally, there were some red faces in the internal audit department.
• If you’ve stayed at a hotel two hours away from your client’s location because you postponed making reservations until nearby hotels had no vacancies, you’re not alone. If you’ve ever spent a weekend driving to a distant audit location because you waited a little too long to reserve a flight, you’re not alone in that, either. “Didn’t anybody arrange for a rental car?” “Wasn’t somebody supposed to reserve a conference room?” “When do you think we can get access to the system?” I often hear of logistics problems that could be avoided simply by starting planning a little earlier and by using a checklist to help ensure details are not overlooked.
• The most common “rookie” planning mistake is simply failing to ask for advice or help when it is needed. I have known several internal auditors who tried to go it alone when they did not have the knowledge or skills necessary to perform parts of an engagement. I have known others who tried to avoid the problem by eliminating audit procedures that should have been performed. Both approaches can lead to poor outcomes, yet a simple conversation with a supervisor might have solved the problem easily. For example, a new internal auditor might have been partnered with someone who knew more about the organization, an auditor reassigned to make better use of his or her individual knowledge and skills, or training might have been available. 
• Two internal auditors on one of my teams once found evidence of significant problems in a process under review. After weeks of testing, they shared their results with the client. The client told them that he was aware of the issue, which was why a decision had been made several months earlier to discontinue the process. New equipment was already on order. If, during the planning phase, the auditors had inquired about operations that might be changing in the future, they could have saved themselves weeks of work.
• Another team of internal auditors did not learn until the start of fieldwork that a new technology had already been implemented. Unfortunately, the assigned auditors were not qualified to review the new technology, so they canceled the engagement and rescheduled an audit for the following year. But the worst was yet to come: Due to a staffing change, nobody told the next year’s engagement supervisor about the canceled audit. Once again, audit planning was minimal; once again, the wrong auditors were assigned to the review; and once again, the audit had to be canceled ​after it had begun. I’m told that the client’s reaction was “memorable.” 

Each of these situations reflected poorly on internal audit, frustrated the internal auditors and the clients, and illustrated the type of inefficiency and ineffectiveness that internal auditors are supposed to prevent, not foster. But, in some cases, we may not be aware of the extent to which poor audit planning damages our reputation and our ability to add value.

One of the senior staff members in The IIA’s Quality Services department recalled an internal audit function that did not include a planning phase in its audit engagements. The internal auditors had used the same work programs for years, basically repeating the same audits over and over with little client interaction. The internal auditors were good at staying on schedule, but because their audit reports always read the same, they did not address specific client concerns. So, most of the findings involved relatively minor errors or oversights. The outcome? The clients had a very low opinion of the internal audit function and stated that they did not believe it added value. 

Audit planning is an investment, but it is an investment that can pay big dividends in terms of improved credibility and relationships with our stakeholders. It is also our best opportunity for improving audit effectiveness. That’s why world-class internal audit functions plan, plan – and then plan some more.

These are just a few of the things that can go wrong when internal audits are not properly planned. I’m sure you have other examples. Keeping in mind that The IIA’s motto is “Progress Through Sharing,” I’d welcome your comments.