AuditBoard Live Webinar banner advert Diligent One Platform World tour ad April 2024 TeamMate ESG advertising banner 2023

Heads of Internal Audit Virtual Forum

16 February 2022

Please note:

  • All Institute responses are boxed and highlighted in blue
  • Where the chair comments in that capacity, the box is highlighted in yellow
  • For confidentiality, the identities of all delegates/attendees are anonymised


Chair: Derek Jamieson - Director of Regions, Chartered IIA
Institute: John Wood – Chief Executive, Chartered IIA
Institute: Liz Sandwith - Chief Professional Practices Advisor, Chartered IIA

Chair's opening comments

Since our last meeting, our external environment has seen much change, with easing of covid restrictions, record oil prices, geopolitical tensions in Ukraine and increasing concerns about energy supplies and pricing to name a few. Record inflation also sits alongside the green shoots of economic recovery. Additionally, momentum continues at pace for ESG and EDI issues, particularly regarding climate risk.

Internal audit needs to be close to the organisation to understand what is going on to provide the context for its work. This will involve critical conversations and delivering difficult messages.

Carolyn Clarke, Founder of Brave Consultancy and a member of our council, joins us today to talk about brave leadership.

Key takeaways

To have impact, add value and be able to rigorously challenge, we must recognise that people have emotions and not be task orientated – we need to be human and have empathy.

There are four elements to being a brave, courageous leader and internal auditor.

These are as follows:


  • You need a sense of purpose – personal and organisational
  • Align your professional purpose with the needs of the organisation


  • Develop a view on non-factual areas
  • Build resilience to be able to push back


  • Empathise – put yourself in other’s shoes
  • Acknowledge the impact that you have


  • Create a positive story about your own value
  • Learn to be comfortable with isolation (independence can be lonely)

Click here for Carolyn’s slide with more detail on the 4Cs.

The 4Cs come with experience and learning. Carolyn’s tip for accelerating this is to seek out the opportunity to be a board member (trustee, non-executive, school governor) gaining personal experience of the skills and value that internal audit brings to the audit committee. This is invaluable.

Institute's comments

The 4Cs are a great way to think about brave leadership. Audit leaders should also reflect on the Standards and ensure that they deliver both assurance and advisory as appropriate. It is important to have a balance and to be courageous in knowing when each is relevant, and to stand by that decision. Speaking truth to power is challenging. It can be easier to keep looking for more facts, doing further tests, than to give the difficult message and this is when brave internal auditing is needed most.

Chair's closing comments

Great questions and lots to reflect on. At our next HIA forum on 16 March, a CEO will share thoughts on the evolving role of internal audit. Check out the full programme here.

For those interested in attending either our fraud Forum or our data analytics forum, please contact for details.

Chat box comments and discussion

Q: How far can internal audit ‘challenge’ when prescribing a solution? What is our independence line?

A: Being bold is important. Internal auditors are not always great at thinking through the risk lens and articulating the risks that our findings identify. This can give management room to devise/agree solutions that might not address the risk completely. Independence should not be about box ticking; it’s really about objectivity and relationships, with the audit committee chair/CEO, to have impact as referenced in the Internal Audit Codes of Practice.

Q: You said this is about human interaction rather than process, what does that approach deliver?

A: Internal auditors tend to fall back on processes and facts: sampling, testing, analytics. It can be too easy to get drawn into auditing and reporting on what is in a neat box rather than being risk-based. There should always be a way to provide assurance over any risk - it might not be immediately obvious, but it will be there. The value can often be in what is less straightforward to audit and unpick: thematic, behaviour, culture. As audit leaders, we have to be prepared to express a point of view – to have professional judgement and not simply reporting findings.

Q: Internal audit can be accused of having too much empathy sometimes and weakening its message. What are your thoughts on that scenario?

A: Our job is like that of a doctor: we’re not doing anyone any favours if we tell them they are ok if they are unwell. Doctors are prepared for an emotional response when they deliver a diagnosis and, as internal auditors, we should do the same. We have to deliver an honest message as to the reasons why a pill isn’t always the only solution and that lifestyle changes may also be needed.

Q: Does our ability to be brave depend on the maturity of the organisation?

A: We have a range of ways of working to give real-time (agile) delivery that the organisation is operating in line with its risk appetite (assurance/advisory). Ultimately, we are about assuring and sometimes delivering a tough message. It is our role to find a way to do that. Our ability to look across the organisation is unique, except for our Chief Risk Officer counterpart, and we need to use that to offer a different perspective.

Q: How do I help my team gain confidence to stand their ground with executives?

A: People often talk down to others to cover up their own weaknesses/behaviour. Everyone has the choice whether to be intimidated or bullied. Focusing on the 4Cs gives individuals licence to speak up. As an internal auditor it’s not personal. We are fulfilling a responsibility -  internal auditors at all levels should be proud of their work and stand up for it. Instilling the confidence is not easy.

Q: Our bravery is only one angle. How can we encourage the business to be braver in addressing issues?

A: In owning the 4Cs, internal auditors can become coaches to their organisations and help them apply the 4Cs for themselves. Rarely do people intentionally overlook controls or put the wrong ones in place – it often stems from a lack of clarity, poor connections, etc.