Studying this technical article and answering the related questions can count towards your verifiable CPD if you are following the unit route to CPD and the content is relevant to your learning and development needs. One hour of learning equates to one unit of CPD. We'd suggest that you use this as a guide when allocating yourself CPD units.

Auditors and auditees often feel that they are in conflict with each other – the business does not feel that it gets what it needs from internal audit whilst internal auditors can feel that the business is resistant to the role that they need to carry out.

In this article, we get the view from both sides of the fence. First, Alan Lees (managing director, Kingston City Group) puts the case for business, then Maria Arpa (founder of the Centre for Peaceful Solutions) provides some tips for managing difficult auditees.

What should the CEO expect from their head of internal audit?

In discharging their responsibilities on behalf of the board, the CEO will often turn their attention to the level of assurance that is being provided to control the risks that their organisation is facing. Organisations will often adopt a three line defence model, with the first line being those functions that directly manage and mitigate specific risks, the second provided by functions that oversee risk, control and compliance, and the third provided by independent assurance providers, such as internal audit.  

An effective internal audit function needs the CEO to recognise that s/he should have an effective working relationship with the Head of Internal Audit (HIA). This is particularly important when identifying audit priorities to ensure audit plans are designed to deliver the level of assurance required not just by the audit committee but also the CEO.

The CEO should be readily accessible to the HIA, and should welcome the opportunity to discuss emerging issues from current audit assignments, whether significant risks are being mitigated and to obtain comfort about there being demonstrable management commitment to take action to implement control improvements.

Contact time between CEO and HIA also provides an opportunity for the CEO to find out what is really happening on the ‘shop floor’, particularly where managers are not responding well to audit examination, by refusing to engage in the process or failing to implement recommendations. The HIA isn’t quite the eyes and ears of the CEO but s/he can provide valuable insight.

Regular CEO/HIA meetings also provide for constructive challenge and debate about how well the organisation is responding to external pressures, potential future risks that could impact and what the audit should provide the level of assurances required.

The CEO has a right to expect the HIA to have sufficient knowledge of the business and its industry sector to effectively engage in discussions concerning the range of ‘what if’ scenarios that the CEO is looking to have controlled and ultimately at what cost. This should include working knowledge and consideration of a variety of factors including the regulatory and legislative environment, sector developments, the robustness of governance arrangements, the overall position of the business in the market and competitor threats, and the future level of investment in people, technology and equipment.   

The CEO expects the HIA to be pragmatic in these discussions and have the confidence to debate concisely the control problems that could occur if a particular course of action is taken. The HIA should however be seen as a critical friend, not the prophet of doom. There is a fine line here but establishing an effective dialogue will ensure the CEO values the views of the HIA without impairing his/her independence and objectivity.  

Internal audit is a precious resource and the role of the HIA as an independent assurance provider has never been more important in meeting the expectations of the CEO in supporting the business in meeting its strategic aims and objectives. The HIA is in a unique position in having a cross-organisational perspective on what is important to the CEO, a view on what is happening out in the external environment and how that impacts on corporate objectives and insight into what is happening internally.

With respect to the latter, this might be about the HIA raising concerns and issues about some corporate behaviours that might be below the CEO’s radar but which might have a significant impact on control effectiveness, or indeed might be an indication of more deep seated corporate malaise.    

Alan Lees - managing director, Kingston City Group

Conducting an audit with difficult participants

You’re carrying out an audit. Your auditees are indifferent, ambivalent or downright hostile. What do you do?

You could threaten people into compliance. Calling on a higher authority or using intimidation may get you a short term result. There might also be a longer term price to pay for using force. If you are expected to continue a working relationship with the person and your manner affected them adversely, the potential for grievances, complaints or damage to your reputation should not be underestimated.

There is a more skilful way to engage the auditee.

Here are some of the dynamics which can enhance cooperation set out as a four step process - R.O.P.E.

1 - relationship

Being task driven without paying attention to the human relationship is unlikely to foster cooperation. If a task requires that you engage with others remember to engage in the relationship so that there is mutual respect. If you need to complete a task with someone you have found difficult, it’s worth considering how you might mend fences. A simple acknowledgement might put things right – ‘Hey John, I know we haven’t always found dealing with each other easy but I’m wondering if we might set that aside and try to make this easy for each other?’ – or the problems may be so entrenched it could be worth considering mediation. Clearing the air is the first place to start. If there have been no prior difficulties, consider your approach so as not to create difficulties. Take a genuine interest in the other person’s workload or wellbeing. This means enquiring and being receptive and appreciative of their response.

2 - offer

Once the air is cleared, contract with the person in such a way that everyone is clear about what needs doing and the difference their contribution makes to the final outcome. Once that is established you can make an offer of how it should be done and any deadlines, whilst creating contingency. For example, an auditee might agree to deliver something but an unexpected family emergency takes them out of the office leaving them with a backlog. How likely is it that your requests would go to the bottom of the pile? As part of the contracting it’s good to create a back-up plan. At this stage it’s vital to elicit agreement. Explain that you would like to agree a plan for how to get the task complete which takes into account anything that might get in the way. Agreement is demonstrated by enabling the other person to contribute meaningfully to the plan so their views were heard, respected and included.

3 - patience

Remember that your deadline might not constitute an emergency for the other person and a rushed tone of voice may create pressure which the other person resents. Before you approach someone take an internal barometer reading and check you’re not going in like a hurricane on legs. If you have an urgent deadline and you want someone to help you meet the deadline, try inviting them to assist you and let them know how their assistance will benefit them, their department and the business.

4 - engagement

Now you’ve contracted properly and there is an agreed plan, something is bound to go wrong. Not everyone meets agreements on time, every time. This is where it becomes essential to meet the human being and not an auditee. Sometimes when we want to get a job done and we are under pressure, we fail to see the whole human being in front of us. If we only want a result at any cost, the other person will have even less reasons to be cooperative.

Taking a human approach to cooperation is more likely to get the job done in a spirit of goodwill. And, there are times when we need to call on that goodwill to get the job done.

Maria Arpa - founder of the Centre for Peaceful Solutions