Ways to Increase the Efficiency of an Internal Auditor

Who is an Internal Auditor ?

An internal auditor (IA) is a trained professional employed by companies to provide independent and objective evaluations of financial and operational business activities, including corporate governance. They are tasked with ensuring that companies comply with laws and regulations, follow proper procedures and function as efficiently as possible.

Communication skills are critical to an internal auditor’s success. According to the Institute of Internal Auditors’ (IIA) 2011 CBOK study Core Competencies of Today’s Internal Auditor, of 11 competencies surveyed, communication skills ranked first and second for internal audit staff and managers. In addition, the IIA’s 2015 CBOK Study Ten Imperatives for Internal Audit showed over 50% of CAEs stated that communication skills are a top attribute they seek in new team members.

1. Stop Relying on Email

Email should be used to delegate routine tasks and keep people informed of ongoing activity. When email is used to teach or obtain a commitment for action, confusion and indifference normally follow.

For example, internal audit seniors can be more effective when teaching staff new audit procedures, instead of emailing instructions to them. Sending instructions by email can take twice as much time than having an in person meeting. And even when instructions are explicitly clear, they may not be clear to someone with less experience. The staff may struggle to understand what exactly needs to be done, or worse, waste their time doing something that doesn’t need to be done.

For me, the “material weakness” of all communication breakdowns commonly occurs during fieldwork when additional documentation requests are emailed. The email is then followed by three to four days of radio silence. When asked about the hold up, the internal auditor’s response includes: “But I sent an email asking for the documentation. I’m waiting for her to get back to me.”

A face to face meeting, or at least a phone conversation, requires the other party to commit to an action. In this case, the internal auditor can verify that the audit customer will send the requested documentation at a specific time, inform them that they are not the right person to pull the document, or in the best case scenario, remind them that they’ve already sent the documents.

2. Anticipate Your Stakeholder’s Needs

Internal audit seniors and managers have many stakeholders, including staff, their managers, their CAE, and the audit customer. If the audit manager takes a moment to analyze what most of their stakeholders want, a common theme should arise. It’s more information.

An internal audit kick-off meeting is a perfect example of a stakeholder in a position to want additional information. A kick-off meeting is usually held at the beginning of an audit fieldwork where the audit team introduces themselves to the department involved in the audit, and provides information about the audit’s scope and objectives, the audit team, and a summary of the remaining parts of the audit (e.g. status updates, the exit meeting, and when the draft audit report are due).

An audit manager anticipating the needs of the department being audited may include additional details about audit. These details may include why the department is being audited, what is the role of the internal audit process, what happens when potential issues are identified, who the audience of the audit report is, and what happens if the customer disagrees with the audit team’s opinion.

The internal auditor that considers what information a stakeholder may want before meeting with them will be more effective with their time, help their stakeholders be more efficient with their time, and separate themselves from their peers.

3. Keep Meetings Short and on Topic

The purpose of a meeting is not to brainstorm, and inform attendees everything you’ve learned or accomplished on your most recent project. Meetings should provide a status update on a project, or obtain commitment or consensus on a key task. If you want your customer to be involved, do not waste their time by sharing irrelevant and un-actionable information during audit meetings.

At the end of audit fieldwork, most audit teams will hold an exit meeting with their customers to obtain a final consensus on any control issues identified, and a commitment to the agreed upon action plan. Of all of the meetings held during the course of an internal audit, the exit meeting is most likely one that is well attended and attended by senior management.

So, what normally happens at these meetings? The meetings start with the lead auditor rehashing the entire scope of the meeting, all of the meetings held, and thanking the customers for their work. If difficult items are needed to be discussed, they are prefaced with everything that went well during the audit. While none of these talking points are necessarily wrong, what is troublesome is that 20 minutes of the meeting has been used to get to the points of the meeting.

How can this be fixed? To start, create a meeting agenda and stick to it. Put the most important tasks, in this case, agreement on identified issues and management’s action plans, at the top of the agenda. To increase the likelihood senior management agrees to the proposed action plans, successful internal audit departments train their audit managers to verify individual issues individually with the process owner(s) before the meeting.

For items that still need to be vetted, it is okay to share these with senior management, but state that additional information needs to be obtained and analyzed before the full issue is presented to them. While some of these steps may take more time to complete the overall audit, the senior managers should appreciate your willingness to help them make decisions, opposed to creating solutions.

4. Don’t Rely on Technical Jargon

“Risk appetite,” “significant deficiency,” “key control,” “high-risk,” and “DRL” are all terms most internal auditors are well-versed in, however, these terms may mean something completely different, or nothing at all, to our customers and stakeholders. Internal Auditors and CAEs who rely on technical jargon and acronyms to get their point across run the risk of confusing their audience, and decreasing the odds of getting buy-in into whatever it is they are trying to accomplish.

A common feature of most internal audit risk assessments is interviews with senior managers. And a common feature of these interviews is for the CAE to ask the senior managers what they consider high-risk. While this practice may identify pertinent organizational risks, it may also identify areas that are only important to the interviewee, and not the entire organization.

The CAE’s risk conversations may also be incorrectly interpreted based on the interviewee’s understanding of risk. For example, a high-risk item to a Chief Compliance Officer may be perceived to be of little or no risk to an Engineering Vice President.

The CAE who takes the time to explain what “high-risk” means will spend less of their audiences’ time to get the answers they are looking for. A lot of CAEs do this by classifying high, medium, and low risks based on negative financial impacts, impacts to business continuity, or hits to the company’s brand.

Furthermore, with an increased understanding, the interviewee may be able to provide more information than what the CAE was looking for, thereby, saving them time spent on future projects. Seasoned CAEs will agree that their best allies are usually the senior managers who better understand what it is Internal Audit is attempting to accomplish.

And in this instance, the CAE who proposes an audit plan based on senior management’s common understand of risk will be more likely to be seen as understanding the organization, and its key risks.

To Enable Positive Change

The intelligent auditor knows that to increase their effectiveness, their communication skills must mature. And if the internal auditor continues to focus on being less ambiguous, more concise, and anticipating their customer’s needs, it will increase the chances of management asking internal audit for more help. In turn, these new projects provide internal audit identify more opportunities to enable positive change in their organization.

Looking For Internal Audit Services in Dubai,UAE ?

1. Auditing Services
We provide year-end annual audit for many DMCC companies at reasonable fee. Our fees are reasonable and affordable by all types of companies.

2. Part Time Accounting Services
We provide Part-time Accounting Services for companies in DMCC Free Zone. You can hire a qualified and experienced part-time accountant from us and minimize your expenses by eliminating your personnel cost.

For More Details : Please visit us on : www.alyaauditors.com or write us to : audit@alyaauditors.com

For Financial Statement Audit,
Alya Auditors
3204, Park Lane Tower, Business Bay, Dubai
Phone : +971 4 876 9377, Mob : +971 52 4754007,+971 52 975 0690