Communications with stakeholders
As the UK ends its sixth week of lock down, internal audit activities everywhere have adapted, with staff working remotely and annual plans drastically changed. But have our communications changed?
Internal audit’s role, to provide assurance over organisations’ risk and control frameworks, means communicating regularly and openly with a range of ‘stakeholders’. In the context of internal audit, we mean any interested parties to our work and products. This could include the board, the audit committee, and any number of internal staff within the organisation. Outside it, external auditors, regulators, and co-sourced staff are probably the first ‘stakeholders’ who come to mind.
Their needs and interests, and the ways in which we communicate with them, vary enormously. So, what can we do to adapt our communications content and approach during the current crisis, improving them for now and afterwards? Internal audit, in having such a range of internal and external stakeholders, can lead and set the standard in showing the organisation how to do more with less.
The basic principles of what we communicate and to whom will not change. The IPPF says explicitly that ‘The chief audit executive must identify and consider the expectations of senior management, the board and other stakeholders for internal audit opinions and other conclusions’ (Performance Standard 2450). Furthermore, our opinion must always consider stakeholders’ expectations. After all, ‘The internal audit activity adds value to the organisation (and its stakeholders) when it provides objective and relevant assurance, and contributes to the effectiveness and efficiency of governance, risk management and control processes.’
Risk-based internal audit means whatever you do will be useful and relevant to the organisation; it’s no different when communicating. As always, it means understanding the organisation’s strategic objectives, which may well have changed over recent weeks, with knock-on effects for the governance, risk and control framework. This is no different from what every CAE considers in building an audit plan – except that now these factors may be changing almost weekly.
As for communications, it’s one thing to work out a risk-based internal audit plan and communicate its results as usual during normal circumstances. It’s quite another to work out what is important and who needs to know, when the situation changes daily.
You may want to first assess your stakeholders’ level of understanding before deciding what and how to communicate to them. Work out who your current key stakeholders are: some senior managers may not have as important a role to play as usual. Other, less senior people with specialist knowledge may have come to the fore in your organisation.
As always, you should consider all matters from your stakeholders’ perspective, which means identifying any gaps or biases. What are their ‘unknown unknowns’? What do they not realise they don’t know? What do they think has changed? What do you or they think they can do without? This last one is particularly important – in the rush to respond to the current crisis, are some senior managers neglecting key controls? Many of them will be under pressure, working to different objectives and timescales. Some may even be responsible for areas they have little previous knowledge of. Think of how you can communicate in a way that shows internal audit is there to help – not to add to the pressure.
One important and possibly sensitive point is that certain stakeholders may be more or less influential than before. Identify them and work out their current focus. If they are fixating on reporting templates, or demanding the same content and frequency of management information as normal, how can you shift their focus?
This may seem a broad and deep remit: to communicate effectively with a wide group of people, when all are under pressure and some are new to their roles. Yet it’s an opportunity not only to adapt internal audit communications, but also to improve them.
Your activity probably has a continuous, established communications process in place. It likely covers everything from regular audit committee reports and meetings, to informal conversations with stakeholders inside and outside the organisation. If you have a dedicated intranet page or newsletter, now could see it reach its widest readership. Think of how you can engage stakeholders at all levels with immediately relevant ‘headlines’ and features.
Now that it’s not possible to catch up in person over a coffee, have you let informal meetings slide? You could be missing crucial information in fast-changing areas of the business if you focus solely on regular, formal reports, many of which may have been suspended. Recently published guidance, ‘The Chief Audit Executive and the Audit Committee: No surprises in surprising times’, addressed how HIAs can and must keep committee members aware of changes to the audit plan, important findings, and the overall opinion. Other stakeholders also want and need to keep abreast of what internal audit is doing.
Think about how remote working – and the technology enabling it – can still be effective. You can still have brief, face-to-face contact with a senior stakeholder in cyberspace, and most people, no matter how senior, should be open to a 15-minute briefing via video link. What’s more, their diaries may be more flexible now – you can be certain most of them won’t be abroad on holiday, or at conferences!
Consider too how to adapt your reports to the current situation – ideally in ways you can use afterwards. Do you need do deliver a formal report document for certain engagements? Would it have more impact to brief stakeholders live via video? If you are producing reports and audit committee packs, what can you do to keep them even more concise and clear, as mandated by Standard 2420? People are under stress and distracted – now more than ever, lengthy reports are likely to weary, confuse and irritate. Regular informal meetings by video will also prepare your stakeholders for your findings and help them interpret what you communicate.
Use this time to think of what is working well. After the crisis, will we need as many meetings and reports, in the same contexts and formats, as before? Is this an opportunity to create something more effective and efficient? Any improvement should work well not only during this crisis but also throughout the next one. If you can reduce the frequency, length and verbiage in your communications, most stakeholders will welcome it. And few will want a return to the old ways after the crisis passes.
Further reading
International Professional Practices Framework
COVID-19 guidance
Blog - Giving feedback to stakeholders
The following guidance is only available if you are a member of the Chartered IIA:
