Working with stakeholders

Talking to and working with stakeholders is fundamental to internal auditing. It enables internal auditors to explain the value of internal audit while getting to know stakeholder expectations.

This guide looks at some of the ways internal auditors can develop and perhaps improve day to day working relations with their stakeholders.

A two-way process
Understand stakeholders needs
Ways to approach stakeholder interaction
Ensure stakeholders understand your needs

A two-way process

Working with stakeholders is a two-way process. Regular face-to-face meetings enable internal auditors to highlight the function's role in good governance, and explain the value of the independent and objective assurance. Stakeholders on the other hand have an opportunity to talk about internal audit performance and flag risks or issues they would like to see in the internal audit plan.

Regular contact is therefore beneficial to everyone but it can be difficult to organise making it easy put off. To avoid that, plan ahead, especially as other assurance providers may be competing for your stakeholders' attention.

There may also be external as well as internal stakeholders so the emphasis of key messages may be different depending upon the audience. Here are some simple ideas that might form part of a Stakeholder Engagement Plan or a component part of internal audit strategy:

  1. Develop an induction programme for new audit committee members, senior managers and external stakeholders.
  2. Organise separate management meetings and earmark sessions during audit committee meetings to provide updates and relevant information.

    This could include changes in legislation, regulation, risk management and professional internal audit practice and how this might impact the organisation and the delivery of internal audit.
  3. Put together an intranet or internet site that contains useful and relevant information making sure it is kept to update. (This might include, for example, product offerings, information on the service or key information).
  4. Prepare and issue an internal audit newsletter or brochure containing information about the service.
  5. Prepare short guides relating to the internal audit process, internal audit involvement in projects, internal audit's role with regard to risk management etc.
  6. Schedule periodic meetings with key stakeholders, even when there is no direct engagement activity in their area, to keep alive to business change and the potential for new and emerging risks that might call for a revision to the engagement plan. 

Understand stakeholders needs

Internal audit provides value to the organisation and its stakeholders when it delivers objective and relevant assurance, and contributes to the effectiveness and efficiency of governance, risk management and control processes.

To achieve this aim the head of internal audit must have an internal audit plan that reflects the things that are important to stakeholders. In other words a plan that focuses upon the challenges and risks that stand in the way of strategic and other key objectives.

Invest time

You must invest sufficient time in talking to stakeholders to identify and assess priorities. Performance Standard 2020 says:

'The Chief Audit Executive must communicate the internal audit activity's plans and resource requirements, including significant interim changes, to senior management and the board for review and approval'.

This means doing so in a timely fashion, having consulted and taken account of what stakeholders want.

Know what's important

Knowing what's important to stakeholders - learning what is 'on their mind' - is therefore critical. In practice there may be competing priorities and pressure to deliver a wide range of assurance with limited resources but proactive engagement with the audit committee and senior executives is the best way to resolve problems.

Internal audit's independence and objectivity can only be enhanced by weighing up the relative importance of stakeholder issues and making difficult decisions about what to audit, when and by whom.

Our simple message is talk to your stakeholders, particularly your audit committee chair and find out what he or she wants from internal audit. This not only includes the focus of the internal audit plan but also internal audit processes, such as:

  • expressing opinions,
  • reporting styles,
  • performance monitoring, and 
  • quality assessment.

Do this often so that internal audit is in tune with current concerns and have an internal audit plan that is flexible. If need be review and update the plan at the half year point or even quarterly if circumstance dictates.

Continuous process

Working with stakeholders is therefore a continuous process rather than a one-off annual exercise, which requires the involvement of all internal auditors to build and maintain an up to date picture.

Collecting and sharing information can take many forms and a planned approach with pooling of information will help, particularly for larger internal audit functions.

Design a process that brings information together; share it within the internal audit activity to ensure that all auditors are aware of the main business drivers and risks, analyse it and make planning decisions based upon key risks and issues.

One of the most important aspects to think about is the style, frequency and content of communications for each audience so that it is easy for them to get involved. Also consider the balance and benefits of formal and informal protocols.

From surveys and interviews we know that audit committee chairs and CEOs like the head of internal audit to be an informal sounding board with whom they can discuss risks and explore practical responses.

Ways to approach stakeholder interaction

  1. Organise formal, one-to-one internal audit planning discussions with senior executives.
  2. Set up separate 'audit planning days' with the chair of the audit committee and audit committee members outside the formal meeting schedule.
  3. Prepare monthly activity reports or regular briefings for audit committee members requesting feedback. This might include a balanced scorecard or dashboard to show progress on a number of important activities.
  4. Meet informally or call your audit committee chair between meetings.
  5. Meet the chair of audit committee before each meeting.
  6. Schedule planning and update meetings with external stakeholders e.g. external audit.
  7. Establish regular meetings with the risk management team to maintain awareness of risk events and issues.
  8. Keep in touch with other assurance providers to share information.
  9. Build time into follow-up reviews with managers to understand changing risks profiles.
  10. Schedule informal, short 'catch up' meetings or phone calls with managers to keep up with changes and developments in the organisation.
  11. Hold 'audit surgeries' for example, where the Chief Executive may periodically meet with a section of the audit team to discuss significant risks and issues.

Ensure stakeholders understand your needs

There are a number of key areas of internal audit work that require good stakeholder understanding. 

Internal audit charter

Internal audit's charter, which defines internal audit's mission, role and scope, should be a living document that helps to sustain internal audit's value to the organisation.

The charter must be up to date, clear, easily understood and reflect the focus of internal audit. Stakeholders need to be aware of it and it could, for example, be a key document on the internal audit intranet. 

Internal audit opinions

More and more internal auditors are providing opinions, at an engagement and overall level. Standard 2010.2 highlights the need to 'identify and consider the expectations of senior management, the board and other stakeholders for internal audit opinions and other conclusions'.

This means ensuring stakeholders understand the underlying basis on which the opinion is based. The head of internal audit should work with the chair of the audit committee and senior managers to devise a way of expressing opinions that helps them to understand where the business stands in relation to achieving its objectives.

Some audit committees prefer narrative statements, others 'traffic light' systems or gradings. There is no right or wrong way of doing this. It does mean talking through options, agreeing a suitable format and applying it on a consistent basis. 

Quality assurance and improvement

Stakeholder feedback on individual engagements and at the overall service level are important components to continuously assessing the effectiveness of the service and how well it is providing value to the organisation.

It also provides useful evidence for subsequent internal and external quality assurance reviews. 

Further reading

International standards:
1111 Direct Interaction with the Board
2000 Managing the Internal audit Activity
2010 Planning
2020 Communication and Approval
2060 Reporting to Senior Management and the Board
2450 Overall Opinions

Practice advisories

1111-1 Board interaction
2020-1 Communication and approval
2060-1 Reporting to senior management and the board

Practice guides

Interaction with the Board
Formulating and expressing internal audit opinions


Influencing skills

Download PDF
Content reviewed: 26 June 2017