Talking to and working with stakeholders is fundamental to internal auditing. It enables internal auditors to explain the value of internal audit while getting to know stakeholder expectations.
This guide looks at some of the ways internal auditors can develop and perhaps improve day to day working relations with their stakeholders.
Working with stakeholders is a two-way process. Regular face-to-face meetings enable internal auditors to highlight the function's role in good governance, and explain the value of the independent and objective assurance. Stakeholders on the other hand have an opportunity to talk about internal audit performance and flag risks or issues they would like to see in the internal audit plan.
Regular contact is therefore beneficial to everyone but it can be difficult to organise making it easy put off. To avoid that, plan ahead, especially as other assurance providers may be competing for your stakeholders' attention.
There may also be external as well as internal stakeholders so the emphasis of key messages may be different depending upon the audience. Here are some simple ideas that might form part of a Stakeholder Engagement Plan or a component part of internal audit strategy:
Internal audit provides value to the organisation and its stakeholders when it delivers objective and relevant assurance, and contributes to the effectiveness and efficiency of governance, risk management and control processes.
To achieve this aim the head of internal audit must have an internal audit plan that reflects the things that are important to stakeholders. In other words a plan that focuses upon the challenges and risks that stand in the way of strategic and other key objectives.
You must invest sufficient time in talking to stakeholders to identify and assess priorities. Performance Standard 2020 says:
'The Chief Audit Executive must communicate the internal audit activity's plans and resource requirements, including significant interim changes, to senior management and the board for review and approval'.
This means doing so in a timely fashion, having consulted and taken account of what stakeholders want.
Knowing what's important to stakeholders - learning what is 'on their mind' - is therefore critical. In practice there may be competing priorities and pressure to deliver a wide range of assurance with limited resources but proactive engagement with the audit committee and senior executives is the best way to resolve problems.
Internal audit's independence and objectivity can only be enhanced by weighing up the relative importance of stakeholder issues and making difficult decisions about what to audit, when and by whom.
Our simple message is talk to your stakeholders, particularly your audit committee chair and find out what he or she wants from internal audit. This not only includes the focus of the internal audit plan but also internal audit processes, such as:
Do this often so that internal audit is in tune with current concerns and have an internal audit plan that is flexible. If need be review and update the plan at the half year point or even quarterly if circumstance dictates.
Working with stakeholders is therefore a continuous process rather than a one-off annual exercise, which requires the involvement of all internal auditors to build and maintain an up to date picture.
Collecting and sharing information can take many forms and a planned approach with pooling of information will help, particularly for larger internal audit functions.
Design a process that brings information together; share it within the internal audit activity to ensure that all auditors are aware of the main business drivers and risks, analyse it and make planning decisions based upon key risks and issues.
One of the most important aspects to think about is the style, frequency and content of communications for each audience so that it is easy for them to get involved. Also consider the balance and benefits of formal and informal protocols.
From surveys and interviews we know that audit committee chairs and CEOs like the head of internal audit to be an informal sounding board with whom they can discuss risks and explore practical responses.
There are a number of key areas of internal audit work that require good stakeholder understanding.
Internal audit's charter, which defines internal audit's mission, role and scope, should be a living document that helps to sustain internal audit's value to the organisation.
The charter must be up to date, clear, easily understood and reflect the focus of internal audit. Stakeholders need to be aware of it and it could, for example, be a key document on the internal audit intranet.
More and more internal auditors are providing opinions, at an engagement and overall level. Standard 2010.2 highlights the need to 'identify and consider the expectations of senior management, the board and other stakeholders for internal audit opinions and other conclusions'.
This means ensuring stakeholders understand the underlying basis on which the opinion is based. The head of internal audit should work with the chair of the audit committee and senior managers to devise a way of expressing opinions that helps them to understand where the business stands in relation to achieving its objectives.
Some audit committees prefer narrative statements, others 'traffic light' systems or gradings. There is no right or wrong way of doing this. It does mean talking through options, agreeing a suitable format and applying it on a consistent basis.
Stakeholder feedback on individual engagements and at the overall service level are important components to continuously assessing the effectiveness of the service and how well it is providing value to the organisation.
It also provides useful evidence for subsequent internal and external quality assurance reviews.
1111 Direct Interaction with the Board
2000 Managing the Internal audit Activity
2020 Communication and Approval
2060 Reporting to Senior Management and the Board
2450 Overall Opinions