Internal Audit’s Relevance – Post-Pandemic
By Hal Garyn, Managing Director, Audit Executive Advisory Services, LLC
Throughout the careers of internal auditors, the topic needing a “seat at the table” often comes up. Just because internal auditors want a seat at the table, it does not mean you get it because you ask for it – it must be earned. And, when earned, you want to keep it. You earn, and keep, a seat at the table because you continuously demonstrate your relevance to the topic at hand – by contributing, adding value, providing insight, making commitments, and delivering on promises. Being relevant.
Let’s define relevance in this context. Picture a Venn diagram, with the level of intersection between the two circles representing the level of relevance. The left circle addresses “what you want to say” and the right circle addresses what the audience you are with “is interested in hearing”.
How much do those two circles overlap? Just because we think we have something important to say, does what we want to say matter to the people we are with … is it the right information, at the right time, to the right people … and is it insightful? Do we add value and, consequently, are we relevant?
Then the Pandemic Hit
Maybe you felt quite relevant going into 2020. However, as the pandemic unfolded and people in many parts of the world were asked to work from home, did you still feel relevant then? Were you happy with how internal audit participated in myriad activities associated with how the organization managed the crisis?
Throughout the crisis, your organization undoubtedly faced elevated and unprecedented risk. As well, certain risks that were high on the risk radar before the crisis began were not as important as the crisis unfolded. All your executives, the board, and key organizational leaders have faced significant pressure, at time where sage and valuable advice from a relevant internal audit function could have added great value as the organization navigated the changing risk profile. If internal audit in your organization was truly relevant pre-pandemic, then you should have been asked to participate in, and contribute to, many of the critical efforts that sprung up as the organization navigated the crisis. Hopefully, leveraging your seat at the table, you have been consulting on the things that matter most which emanated from the evolving risk dynamics facing your organization. Were you present, were you participating, were you contributing, were you heard, were you adding value, were you making a difference … in essence, when it mattered most, were you relevant during the crisis?
If the answer to that last question was “yes”, then congratulations. But, for many Chief Audit Executives (CAEs) and their staff, the answer might have been a disappointing realization. If so, do not feel bad or feel alone. However, it is time for some self-reflection and diagnosis as to why and a plan to do something about it. Just keep in mind, it is like to get harder with some of the challenges ahead.
Challenges, Now and Going Forward
Yes, it was hard before, but trends indicate it will be even harder going forward. Internal audit, with its reliance on technology, data analytics, electronic communication, and so on will still be most successful based on the interpersonal relationships it has now and will develop over time. For example, you can have the best and most insightful things to report, but if you do not have strong pre-existing relationships established people will not be interested in, or trusting of, what you have to say. Your audit clients will, as they say, not “give you the time of day.”
Consider, for instance, the newer challenges brought on through working remotely. While you can e-mail, text, chat, and video conference to communicate, those means of interacting are not ideal for developing or sustaining interpersonal relationships. Many of the informal ways, all those hallway chats, watercooler interactions, drop-by impromptu meetings, let’s go to lunch suggestions … these opportunities have all become much less available. Yet these are all things that are more apt to help develop and sustain relationships over time. Add to that not being physically at client locations, and it gets much harder to get a read on, and diagnose, the area’s true culture. Among the many challenges to sustaining relationships and, in turn, relevance going forward.
What Can We Do?
Enhancing relevance should always be top of mind for CAEs. Taking steps to improve relevance, as the world emerges from the pandemic crisis, are paramount. I suggest you consider some of the following actions:
- Look at internal audit from the outside in (not the inside out) – focus on what the organization really wants from internal audit, not just what we believe we should provide
- Request for, and act on, critical feedback
- Only do what is essential, perhaps for at least a little while – view all work through the lens of “is it really necessary for us to do this right now”?
- Increase time spent on value-add advisory work, possibly deferring some assurance work – the organization needs help in times of crisis, not necessarily another assurance project
- Volunteer to help – find out how you can help and figure out how to do it (see objectivity point following)
- Be more flexible with risks to objectivity – while objectivity is fundamental to internal audit, in times of crisis what the organization needs should potentially take precedence over preserving objectivity
- Move to a (near) continuous risk assessment – risk is dynamic, not static. And, right now, risks are quickly evolving in terms of impact, likelihood, severity, duration, velocity, etc.
Should I Get Help?
Sometimes, the CAE could use a confidential advisor. Someone who has “been there, done that” and can help coach the function towards elevating its relevance profile in the organization. As internal auditors hire third party subject matter expertise when they need it, they should also consider consulting with third party advisors who can recommend ways to improve on the soft skills needed to enhance the function’s relevance. No matter what you do, take proactive steps to enhance internal audit’s relevance and do it now. While never easy, it will not get easier by not acting.
Quite simply, if we are not adding value, we are not relevant. And, if we not relevant, then what is the point?
- Moral Courage & Internal Auditors - July 8, 2020
- Fraud Risk Management (FRM) Instructions - July 8, 2020
- Seven disagreements that fueled tax clashes through the ages - July 8, 2020