Internal audit is a people business - to achieve our aims we must engage effectively with a wide range of stakeholders. Core relationships exist within the internal audit team, across the organisation at all levels of management, and up through the governance structure to the audit committee and the board. 

For a relationship to be effective, you need to build trust and demonstrate mutual respect. To achieve this, be open and honest and demonstrate integrity in all that you do.

Everyone is different so you should think about the most appropriate communication method and frequency for each relationship, ranging from informal to formal methods including:

• an informal ‘catch up over coffee’
• attendance at team meetings
• face-to-face meetings
• phone calls
• email updates
• progress reports
• formal reporting

Use your soft skills effectively:

• break the ice at the start of the meeting
• maintain good eye contact
• demonstrate active listening
• summarise to check understanding

Manage conflict effectively by being clear on the shared goal, sticking to the facts and removing any emotion. Understand their view. Be objective - not personal.

Internal audit teams

Typically a structured hierarchy exists within the internal audit team but everyone is working towards a common goal. Depending upon the audit plan and the assurance projects therein, team members may be working on their own or as part of a specific audit team to deliver all assignments and feed the chief audit executive (CAE) the annual internal audit opinion.

Management and co-ordination of assignment teams requires detailed planning, clear objectives and responsibilities, good communication, discipline, processes and monitoring. The level and frequency of monitoring progress against assignment plans and the overall audit plan will vary but needs to be sufficient to ensure work is on-track and being delivered in accordance with performance standards agreed with the audit committee and senior management. It must be documented within the internal audit charter.

A good leader inspires confidence and trust, motivates the team, communicates well, acts in a consistent way, listens and is appropriately flexible. Through open communication across the audit team they are knowledgeable of and use their influence to reduce or remove obstacles to delivery success and keep plans on track.

As with any team it is important to try and meet the needs of the individuals which will range from trainee auditors through to the audit management. Openly discuss what they need to improve and develop their service, be knowledgeable and mindful of personal circumstances, their personal aspirations, objectives and how you can support them to achieve these. Each organisation will have its own appraisal and performance management framework, however often the frequency of these is insufficient to solely rely upon and build the team you need.

The CAE needs to be knowledgeable of the skills and experience within their team and allocate audits which match individual strengths. Explaining the reasoning behind the allocation will contribute to a successful audit. Engage the team in planning, ensuring they understand the terms of reference, are briefed on the area of business and the key characters they are likely to be engaging with throughout the audit process. A process of both system and client induction can be beneficial and ensure that individuals feel confident in their role.

During the audit ensure regular updates are communicated both up and down through the audit team - particularly monitoring progress against the agreed scope and budgets. Maintain quality assurance processes throughout, with formal line manager review and sign off of the audit file at key stages of the process in accordance with your own quality assurance procedures. The formality of assignment appraisal is likely to be dependent upon the size of the audit team and audit assignments within the audit plan.

Management should reflect on the completion of assignments what went well, what could be improved and any feedback from the client to aid the team’s continuous improvement. Post-audit questionnaires are often used, however less formal processes may also exist.  

Invite the audit team to make their own observations regarding the assignment and any learning points. Similarly recognise good performance of both the team and individuals within, sharing and promoting good practice.

Management

Internal audit has traditionally not promoted its value or worked with management to ease the impact of the internal audit process upon the day to day operations and work load.  

Resistance to internal audit may be based upon previous poor experience and a lack of empathy towards auditees and management.  

Modern internal audit and professional auditors are working to reduce this resistance and build valued relationships which are key to influencing change within organisations as a result of the internal audit process.

Internal auditors should be seen out and about within their businesses – not secreted away in their offices. There is considerable benefit - both in respect of the relationship and the assurance product - if the internal auditor bases him or herself within the area subject to review. Likewise, reducing physical barriers to the internal audit office and engaging politely with staff at all levels across the business as you move around in the performance of your work will reap benefits.

The development of the relationship with management benefits the auditor by improving their knowledge of the business area, ensuring they are kept informed of business plans, changes and risks that will impact internal audit plans for assurance.  

The role of internal audit now extends beyond pure assurance and the Institute of Internal Auditors (IIA) definition recognises a consulting role for internal audit. Regular engagement can assist as internal audit becomes involved at the early stages of projects and provides upfront input to the development of internal controls, risks management and governance processes.  

This input is valued by management as it demonstrates a willingness to be supportive and proactive and not simply point out weaknesses within existing systems.

It benefits the business manager by improving their understanding of what represents good control, which leads to them managing their risks better. 

Good communication also provides management with the opportunity to influence the timing of audit work in order to maintain smooth operations and provide internal audit with the support it needs. Another guide in this series has discussed the planning of assignments - management’s input to the scope and objectives of the audit should be actively encouraged as this promotes buy-in to the audit process and ensures that the end product provides the assurance that both they and the audit committee require.

An audit is also an opportunity for a manager to apply the pressure necessary to get the resources, remit or funding to manage a risk which they are unable to manage effectively. However internal audit must be vigilant against being used as a tool to support management agendas unless founded upon solid evidence.

The implementation of a structured service level agreement within the guise of the internal audit charter will help both parties to understand their roles and responsibilities, document service standards and facilitate monitoring to ensure that internal audit delivers upon its promises.  

Audit committee

The role and responsibilities of the audit committee are established by the board and formalised within its terms of reference, with the results of its work reported to and considered by the board. A key responsibility will be the appointment of auditors, approval of audit plans, monitoring of assurances received and implementation of actions by management to ensure that the internal control environment operates within the risk appetite established by the board.

The relationship between the audit committee and the internal auditors is therefore crucial to the effective discharge of its responsibilities, and likewise for internal audit to be able to discharge its responsibilities under the professional standards.

The audit committee should be routinely attended by the most senior member of the internal audit team, the CAE. Attendance should not only cover internal audit agenda items but recognise the wider remit of internal audit to offer consultancy and advice to management and the audit committee. Therefore the CAE should be willing to and allowed to contribute to the wider discussions of the committee.

Formal communication will include:

• involvement in the audit needs assessment (ANA) process
• consideration and approval of the internal audit strategy (IAS) and annual plan
• CAE attendance at each committee meeting
• provision and presentation of final audit reports and progress reports
• provision of CAE annual internal audit opinion
• reporting upon any work directly commissioned by the audit committee
• formal reporting of any suspicions of fraud, misappropriation or management override.

Informal communication will include:

• invitations to events held by internal audit
• provision of newsletters and update publications
• attendance at stakeholder events or meetings
• direct access to the CAE