Within every profession, there are certain characteristics, traits, and tasks that mark great professionals. Internal auditing is no different. Professionals can make the transition from good to great by following these 5 steps.
Experience the products/services
A few years ago, Domino’s pizza did something daring. Well, not really. They asked customers what they really thought about the pizza. That sparked a series of commercials where customers bashed the pizza and management watched in shock. I do not understand the lack of awareness. I’m betting there was no doubt at least one employee who frequently mentioned every item identified in the videos. It is more likely that no one listened to those employees. Or the employees were labeled as troublemaker or people who “rocked the boat”.
I’ve never understood working for an organization without experiencing the product/service offering where possible. When I worked in retail, I consumed the products my employer manufactured and distributed. At one point, there were some issues with the freshness of the produce. It actually happened for years. Several employees mentioned it. They were labeled. However, years later there was a global campaign touting the improvement to those items. While in banking, I established accounts at the banks where I was employed. Now that I’m in higher education, I’ve taken several “for credit” courses as well as continuing education classes. I’ve eaten in the cafeteria, used the workout center, etc. These experiences provided me some comfort surrounding the controls in some areas and made me concerned about others. I would encourage every auditor to experience their employer’s product/services offering. This will make you a better auditor.
Learn the business
The more you know about your chosen industry, the better you serve your clients. This is a fact. Yet, some internal auditors stay pigeonholed in their comfort zone and do not attempt to learn something new. Or some attend training that is specifically centered around auditing. While this is important, industry specific training is also very valuable. I’m wondering, how many of us have actually attended training with our clients (or at least attended training that our clients would attend). Most auditors are lifelong learners and can easily navigate between industries. “Learning a new business” is something we are inherently good at probably because we constantly have to “learn” new processes while performing audit engagements. Therefore, it is essential that we learn as much as we can about the business environment within which we operate.
Speak the Truth
When coordinating with internal audit clients, always tell them what they need to hear versus what they want to hear. For some, this is very difficult. Especially when what management needs to hear conflicts with what they want to hear. However, I believe honesty and integrity always wins in the end (even if the journey to get there is painful).
Many years ago, I remember an area that needed to be in compliance with the new Gramm Leach Bliley Act. Unfortunately, they were not in compliance. We worked with the unit to educate them on the act and even found training courses. They were scheduled to take these courses within the year.
During the exit meeting, we discussed the fact that the unit was not in compliance with the act. It was not direct management’s first time hearing it. The Executive Vice President was in attendance. Now this individual had a busy schedule and did not want to meet with us prior to the exit, so this item may have been a surprise to him (that actually goes against my rule of no surprises, however, it is difficult to not surprise someone who refuses to meet with you). He called me a liar. I informed him that I was not a liar and that he may be in denial. I further told him that we actually helped his unit find training that will bring them in compliance. He pressed on. I presented the facts and politely stopped speaking. You see, the truth has a way of revealing what a lie conceals. He eventually calmed down and listened. Shortly after the meeting, I received an apology and an acknowledgement of the facts. I must say that I was shocked. If something similar happens to you, do not expect an apology. This is very rare. However, do use truth and honestly as your career compass to guide you where you should be.
Connect with Others
Great auditors build a great professional network. You’ve seen them. They may not know everything, but they can find the answer to almost anything. These auditors have a network of external contacts (i.e. other auditors, industry experts, etc) and great company contacts. In some situations you find someone who has both great external and internal connections. These are the individuals who understand the concept of shared knowledge and typically can be seen giving just as much as receiving. Their network is valuable. It is important to cultivate it so that it can grow.
Question Without Challenging (offending)
I’ve said it before, observation and inquiry is one of the biggest tools in an auditors tool kit. This means that auditors must ask a lot of questions. Questions typically make people uncomfortable. Effectively asking questions requires style, tact and skill. Unfortunately, we are wired to ask ineffectively. Successful questioning strategies require daily practice. Furthermore, because people are different, success with one person does not mean success with everyone. To question without challenging requires auditors to truly hear and listen to clients. Using phrases like, “Can you help me understand the process for…”, “Tell me more about…”, “What is your role in…” can help tremendously. Removing the word “You” from questioning is even better. For example, you do not want to say “Why didn’t You process this transaction”. A better question is “Help me understand why this transaction was not included in the batch”. Again, we all get it wrong. It is something we must conscientiously work at every day. But learning how to question without challenging is one of the 5 things great internal auditors do!
What are some great things you’ve noticed internal auditors do?
I have a question about the ‘experience the products’ advice. I work in a tobacco company and i don’t smoke. Should i give it a try at least?
Yes. Start smoking. No I’m just kidding. I thought about that when I wrote this. Of course, ideally, you want to experience the products or services, but not if it compromises you physically, mentally or spiritually.
However, I would talk to customers (friends, family, etc) who use the products/services about their experience. That is about as close as you can get. The general theory is to have as close to first hand knowledge about your organizations services/products as you can.
I agree that in some organisations sampling the products may be easier said than done, although I also agree with the sentiment!
You asked about other characteristics. I would say that being empathetic and practical is important – but “without crossing the line”. A key success factor is that the audit encourages positive change; so “buy in” is essential. If the “client” sees the audit as negative & nitpicking or recommendations too idealistic, then there is less likely to be “buy in”. Having said that integrity should never be compromised, while usually points can be made constructively – there will be occasions where a more critical tone is required (such as your example) or where the “client” blatantly refuses to accept any suggestion that improvements can be made (usually denial).
David. Thank you for your comment. I really like the empathetic and practical.
Sometimes auditors make recommendations that are simply not feasible. Other times the recommendations may be feasible but not with the resources available to the client. So being empathetic and reasonable, auditors can construct recommendations that may result in additional resources for the client. I’m sure many of us have done this, but I’ve never really thought about as you’ve presented (I guesz it was subconscious).
Awesome.
I am surprised that obtaining operating management’s acceptance in writing (prior to the exit interview) isn’t top on the list. I had a similar situation where I was called a liar once– when I presented my evidence, the department head then produced new documentation to make it appear I hadn’t done enough to understand the department and learn the full story. That wasn’t true; I studied that department inside-out and upside-down. I had repeatedly showed the department head my negative findings and he said he couldn’t offer me anything more to prove otherwise. Then at the exit interview everything changed; I had been completely set-up. It was a humiliating lesson learned about how some guys will actually lie just to make another person look bad. It is a strange world we live in!
I had a similar situation. Still I don’t think to be a great internal auditors you should obtain managments acceptance. The truth will come out!
Thank you Robert for this great piece of work. What is your opinion Auditors and organisational politics particularly where it is used to dilute the effectiveness of the Audit Function? This l have observed it happens from two fronts, 1. Where the Auditor allows for compromise in his own independence and objectivity by indulging a lot with management and 2. Where organisational politics is so abrasive and hostile towards to Internal Auditors to the extent that there is little room for positive engagement between Internal Auditors and management. Should Auditors play a role in influencing organisational politics?
Great article! I’m actually a bit surprised that more auditors don’t realize how true this is.
I’ve been told I was exaggerating, over-reacting, lying & so many more comments of this type from executive, senior & middle management in my 40+ career as a systems auditor. I’m fortunate that in many cases I did get an apology or at least an acknowledgement at a later date.
One of the best examples was a company who had a 1-page backup plan in an area prone to earthquake which was basically the backup of data & programs stored at a different site about 5 minutes walk from their main bldg. Only the head IT person had some of his staff’s phone numbers. There was no backup for this person or any of the other mgmt. in other depts. Information gathering & dissemination was their main products. The list goes on & I documented everything including all the people I interviewed. When I returned to corporate headquarters, I got called in by all of the higher ups in the Internal Audit department & everyone kept repeating that the CFO knew what was going on, why did I overreact?, etc. It floored me because no one was willing to read any of my documentation. I had a good reputation so my job wasn’t at risk.
Anyway, about 8 or 9 months later there was a severe earthquake – epicenter in same town. Then I got a talking to about how I hadn’t explained how serious the situation was. Apparently the head IT person wasn’t able to phone or drive to the company location because of road outages, lack of power. There were also so many other issues that the subsidiary almost went under in the process of trying to reestablish the data, data center, etc. A few weeks into the disaster, I got a 2nd hand comment from the CFO that perhaps I had been on to something.
My advice to other auditors – persevere, but document!
Wow. A one page back up plan.
Sometimes it is frustrating to discuss risk and have people stare as if you are speaking a foreign language. You never really know what you need until you really need it.
Great article, Robert. I had to smile at the part about how helpful it is knowing others who can find the answer to anything… it’s true. I’ve been fortunate enough to have a small, but very resourceful, network all my working life, and by example those people have helped me become better at sourcing information for myself too.
I am an accounting/auditing lecturer at the University of Tasmania (Australia), and a Certified Fraud Examiner. I am currently doing world-wide PhD research exploring the natural attribute and skill aspects of professional skepticism.
Specifically, I am researching differences in how people find and use information, experience and knowledge that influence those decisions. IE what distinguishes an auditor from a lay-person? And, as it is so relevant to your page, I take the liberty of asking you and your readers to help me:
The views of auditors are especially important to my research because the input of world-class information analysts is vital for a high-level data set.
Please contribute 15 minutes to my PhD by taking the online survey?
NOTE: Professional affiliations will not be compared, as no identifying information is collected.
Visit http://www.kerriodonnell.wordpress.com for an overview of the project, an Information Sheet with participant FAQs, ethical clearance details, contact information – and of course, the survey.
Many thanks for your help!
Kerri
Kerri. Good luck your research. I think my readers would definitely appreciate a brief article from you discussing some of your research.