Internal Audit – Impact of Effective Communication

Internal Audit is an area that requires a combination of technical skillsets to allow a person to effectively deliver their required responsibility. One needs to understand audit standards and techniques, governance, risk, process mapping, regulatory requirements, financial reporting and data analytics just to name a few skills before they can be effective as an Internal Auditor.

However, now with the advantage of a few years under my belt, and the opportunity of having set-up, restructured and led multiple audit functions in a number of different countries and environments, I have a slightly different perspective on this matter. The way I see it is that while one does need the above-mentioned technical skills to become an Internal Auditor, it is ultimately a person’s ability to communicate effectively that will determine how successful they will be as an Internal Auditor.

I feel this is an area that doesn’t quite get the attention it deserves when developing or training for Internal Audit. Our objective is to highlight risks that need to be mitigated. How we communicate that message is critical if we are to achieve that objective. Therefore, the way we say things and/or the way we write matters a lot.

An Internal Auditor’s Dilemma

Let’s start by accepting some harsh realities of our lives. Nobody really likes us! We are seen as this sad lonely function in the company that is perceived as an in-house Police Department. Our job, as defined by everyone else, is to pry into other peoples’ work and criticise them. Whether we like it or not, that is our default starting position in most cases and one we have to accept and address from the onset.

I know we mean to help, and I can assure you the business does not mind the help, just not from us. I have had a chance to step outside of audit once I joined Business Transformation and my role was to develop value adding solutions for the very people I used to audit once. My standard introduction to them was that ‘I am not audit anymore and I am now on your side’. I would be more than welcome after that.

And why should they take help from us? They know their business not us. How are we qualified to help them? It is a question all of us have been asked and to this I usually say that in order to conduct an audit effectively we have to learn to see the business from the business owner’s perspective. But while they are the experts in their area, we are the experts in understanding their processes and know how to identify risk and control gaps. An audit, ideally, should be a collaborative exercise that the business can also use to their advantage.

The ‘’Other’’ Skillsets Required for Internal Auditors

Once you step outside of textbooks and into the real world of competitive business, you realise that your technical skills are just your starting point. As an internal auditor you have to be so much more to be effective. You will find out that are expected to be a Diplomat, a Negotiator, a Salesperson, a Consultant and a Presenter. If our ultimate ambition is to be a Business Partner and a Trusted Advisor, without obviously compromising our core responsibility of proving independent assurance, then this is what our skillsets and approach needs to be.

I have turned down Internal Audit applicants who demonstrated poor communication skills in favour of the ones who were good at it, even if technical capabilities were slightly better for the ones who were not so good in communication. That is how strongly I value the ability of an Internal Auditor to communicate effectively and their soft skills.

What is Effective Communication

Effective Internal Audit communication is aligned to the culture prevalent in the organisation. Therefore, understanding an organisations culture is crucial. What works or worked in one pace may not work in the other. This applies more so to Internal Audit as we have to work with different departments and in different locations or countries. Work out the best way to get your message across and use that tone. There isn’t a ‘one size fits all solution’.

Effective communication isn’t just limited to speak and writing. There is so much more to it. It encompasses the personality of the person, their ability to ‘read the room’, their emotional intelligence and the ability to adapt their tone based on the scenario they face. This requires experience and judgement, but more so one must be aware of its importance of such skills in the role that we do. Once if one is aware can one learn.

Brevity when reporting is one skill that universally seems to work quite well. It’s about Quality and not Quantity. Not everyone needs to know every detail of everything. We can lose the message far too often when you try and say too much. Get to the point and say what matters. The more senior the audience, the sharper and briefer we need to be.

Facts and data have a greater impact than opinion. Eliminate subjectivity as it does not go very well together with audit. Data and facts are our friends. If our message is backed by irrefutable facts, it will sell itself.

However, our opinions sometimes do matter. They may not have a place in an audit report, but if communicated effectively and in an advisory capacity, it goes a long way in establishing your reputation as a trusted advisor and business partner – which should be our ultimate aspiration within the business.

I personally prefer to give my opinions verbally in one-to-one conversations with the right level of executives. I feel they it works better that way than in writing or in a Group.

Criticise constructively but it’s okay to give credit sometimes. I personally try to find aspects of positivity in my audit reports or the cover note. For example, if the business is aware of an observation we raised and are making efforts to address it, or they resolve an agreed action immediately, I make sure I state that fact in the report.

The Opening Meeting Sets the Tone

How we start off our audit project or any assignment is quite critical because that’s when we set the tone of the project and expectations. The business team is more likely than not to feel a little nervous even if they seem welcoming. Because we are, whether we like it or not, intruding in their space, which no one likes.

Our job at that point is to put them at ease. Explain the process and how we intend to work collaboratively and transparently. The one thing we should assure them of is that no report we issue will be without them seeing it first or without their comments – whether it is an action plan or other comments. Make sure the report reflects their view in their words and live up to your promise of transparency.

While we are the audit experts the management are the business experts. We specialise in understanding the business and process from them to try and see things from their perspective. Only then can we add real value and look it things pragmatically.

Meet regularly as you progress, particularly as you find things that need addressing. Give the business a chance to address quick fixes during the audit. So even if we report them, we report them as completed and addressed.

Work transparently unless and only unless there is a very good reason not to do so. A normal audit should not have the feel of an investigation.

The Fundamentals of an Audit Report

The Audit report may have changed a lot over time, but it still remains (in my view) the most important part of our work. It is, in most cases, the only real output and record of all the work we do. Spend a lot of time on it to make sure it is does justice to all your and your team’s efforts.

An ideal report should be easy to read and understand. Keep it brief and keep it sharp. Choose the information you want to highlight carefully and don’t overkill it. My rule for writing observation is introduction to the area is limited to between four and five lines, and then the observations are listed briefly and in bullets.

Any details that need to be added to support the observation are in the Appendices. Avoid excessive jargon and write as simply as you can. I try and stick with language that, metaphorically, a five-year old can understand. Being able to articulate in a simple manner is an underrated skill. Only people who understand what they are doing can explain things simply.

Use neutral words, and do not sensationalise. The report does not need any drama, it just needs facts to be stated in a simple way. While as auditors we have the right and power to impose our observations, it’s always better to convince the stakeholders with reason and logic. Think of yourself as a salesperson when you write or present an observation. Always highlight the impact and know the Root Cause of what you are talking about, else you don’t know what needs to be fixed.

While I know we are supposed to be independent, but do not let that stop you from going the extra mile in developing your recommendation to be as close as possible to a practical solution. Push the boundary of independence as much as you can to help the business rather than use independence as an excuse to avoid helping. Work with the business and continue to support them even after the audit is complete to help them implemented the agreed actions. They implement it but we can guide them as much as needed.

Audit Report – Visualisation and Infographics

The most recent change to the way I prefer to present reports is to include visuals and infographics. It gives the report a ‘Wow Factor’ and I have found myself using just visuals as the one key part of the audit report to discuss the entire project at times.

Visuals can be process flows. We have used them to represent time and motion studies as well and to cross reference the observations on the report. An Audit Report can hardly ever be a joyful document to read but it doesn’t have to be dull. Get creative and think outside the box!

Beyond the Audit Report

While Audit Reports are the key deliverable, there are many other ways of communicating your views. We are in a privileged position as we get to see the entire business and have the opportunity of seeing the bigger picture. We therefore also have the responsibility to make this privilege count and support the business in an advisory capacity where possible.

We can elevate ourselves to be a trusted advisor to the business if we air well thought-out opinions and advise through channels such as one-on-one meetings. Our advice can help improve the way business is done, and not just eliminate risk. If we are seen as a value adding advisor, our views as an auditor will gain more credibility in all respects.

Advisory memos are also useful if you want to put your views on record but caveat all subjectivity within them as this is not audit.

When it comes to the Audit Committee, focus on things you determine they absolutely need to know. There should be less slides and more words in Audit Committee meetings. It is best practice to meet the Audit Committee members before the meeting to run through the slides and address all questions. If the management attends, you should also meet them in advance.

I stress on importance of such meetings because the last thing you want to do in an Audit Committee meeting is put on a show with surprises. Nobody likes surprises or shocks there. There should be no grand standing in the world of audit.

We can be the best at what we do technically, but the reality of life is that how we present our work to our stakeholders is as important as what we actually have to say…………if not more!

Disclaimer - This article is derived from my presentation at the 14th Annual Internal Auditor Conference hosted by Marcus Evans in Dubai on 06 October 2021 and represents my personal opinion only.?I would be happy to know your views and thoughts on this matter.