How Some Teams Are Adopting a Customer Service Approach to Internal Audit

It is no secret that internal auditors and the managers of the units, departments and functions they audit do not always get along. After all, it is not easy to welcome outsiders into your office, looking over your shoulder, reviewing your documents and data for everything you did not get right, and then writing it up in a report for your boss and your boss’s boss. This adversarial image of internal audit should long since have lost its validity, yet it is still the prevailing view in many companies and organisations.

Some internal audit leaders are working to change the nature of the relationship between auditor and auditee. They take an approach that sees auditees as clients, and try to ensure that audits work for managers, internal audit’s most important stakeholders, who are in a position to act on audit recommendations. Advisors say a customer-service-oriented internal audit department can deliver better results both for internal audit and for the business units it audits.

As many internal audit leaders know, building sound relationships with colleagues requires working as partners, offering sound insights, showing respect and communicating genuinely. These behaviours, the hallmarks of first-class customer service, are not only right; they also make relationships more productive and valuable.

According to Andrew Twardzik, a partner and member of EY’s Americas risk leadership team, whether you call it a customer-service approach or acting as a trusted advisor, it allows internal audit to “deliver more value to the organisation”. Auditors who build strong relationships are likely to find auditees more open and forthcoming, which helps them identify and understand risks before problems escalate. By contrast, a “policing” approach, sometimes called “gotcha” auditing, does little to increase the value internal audit can offer. Worried about the consequences, auditees may hesitate to alert internal audit to issues that concern them.

Elements of a customer-service approach

The approach spans a range of activities. Ari Sagett, managing director of Protiviti’s internal audit practice, says one of the most basic but often overlooked is simply doing a good job: acting professionally, communicating throughout the process, working with auditees to understand their business, and making sure the audit report accurately reflects the operation and the risks it faces.

A client-focused internal audit department works more closely with the client in planning and carrying out the audit, makes the process as smooth as possible for the audited unit, and keeps the results focused on improving the function. Internal auditors need to be good listeners.

Building relationships with colleagues in other areas, including outside audit, is also vital. As Mike Suffield, director of professional insights at ACCA Global, puts it, “audits cannot be done in silos.” For an audit to deliver valuable insights, the auditor needs to understand the environment in which client departments work and the challenges they face. Establishing a solid relationship before any sensitive finding needs discussing generally leads to less combative, more productive conversations. In the words of Karl Stingily, senior vice president and chief audit executive at Caesars Entertainment: “I never want my first conversation to be about an audit.”

Building relationships deliberately

Developing strong relationships takes deliberate effort. Linda Milburn-Pyle, a managing director for risk and compliance at Accenture, says it does not always happen organically. When she worked in internal audit, each member of her team was responsible for building relationships: newer auditors typically connected with entry-level staff, while managers and directors connected with their counterparts. For this to work, she says, company leadership and the board must support the audit team spending time on these interactions.

At MacLean-Fogg, an industrial manufacturer, Stephen Young, vice president of internal audit, holds quarterly meetings with the company’s vice presidents and steering committee to build relationships and trust, and speaks regularly with division leaders. The aim is to meet everyone and understand what is going on.

Education and communication

Education and communication play critical roles in this approach. Internal auditors can “demystify” the function by helping others understand its role. Jacqueline Breslauer, audit manager at Valley National Bank in Wayne, New Jersey, says her team spends a lot of time educating people about what it is really trying to do, which is to help the organisation achieve its strategic objectives. They explain to clients that internal audit can look at functions from an outside perspective, offer new insight into how well a function works and how it could work better, and provide best practice and guidance on risks and controls.

At the kick-off meeting, the audit team outlines the process and discusses scope and timing. Breslauer says sharing this information reduces concerns by demonstrating transparency and helping auditees understand the steps ahead. At the end of the audit, the team issues an anonymous client survey so auditees can say how internal audit could improve its service.

Young makes sure clients know they can discuss any finding they disagree with. He and his team also give credit to functions that are working as they should. In the report summary they code functions green, amber or red, and “in 99 percent of cases it is green”. A balanced picture reduces the worry that an audit will make auditees look bad.

Sagett makes a “no surprises” commitment: if his team uncovers something that needs attention, it discusses the matter with the auditee immediately, openly and without judgement, before it becomes part of the audit report.

In a strong client relationship, communication runs both ways. Stingily of Caesars says he is very open to feedback and asks auditees for their views on any areas of concern: “Smart teams know how to use internal audit.” If a department is worried about understaffing, for example, auditors can look into it, and if the concern is valid, the audit can support the case for additional resources.

Flexibility in scheduling

Scheduling is another area where internal audit can show a strong customer-service approach. As Milburn-Pyle puts it, “If you say, ‘I’m internal audit, I go where I want when I want,’ you undermine any goodwill.” Many internal audit leaders say they will change the audit schedule to meet clients’ needs when risk is low and the auditee offers a compelling reason. A major software implementation, or the recent departure of a process owner or department head, are examples.

Breslauer says flexible scheduling is especially important in sectors such as banking, where the second and third lines of defence test regularly alongside regulators and external auditors and “testing fatigue” is real. At the start of each year her group prepares a firm-wide testing calendar covering all testing groups; those that can be flexible coordinate or reinforce one another where possible, which reduces duplicate testing. The calendar is then published to all clients. It will probably change, she says, but the testing groups work to keep it current and keep their clients informed.

Maintaining independence

A common concern when an internal audit department considers a customer-service approach is whether it will compromise independence. Suffield of ACCA notes that internal audit is a role that must also be objective, so auditors need to be sure their impartiality is not compromised or open to question because of a personal or business relationship.

Young argues that internal auditors, working in the same company as their clients, are not truly independent to begin with. They can be objective, he says, but unless they are a third party working for the board, independence is open to debate. Objectivity requires presenting the facts honestly and making sure the facts support the risk assessment and recommendations.

Internal auditors can also take steps to protect their impartiality. One is to separate and define clearly the types of engagement they undertake. At Valley Bank, Breslauer’s team performs several types of audits as well as advisory reviews. In advisory engagements they do not issue a rated audit report; if they identify a significant issue they rate it and track it to closure, but the output is a memo summarising the review and providing recommendations and an opinion. Breslauer also makes sure clients understand that internal audit can provide guidance in the form of recommendations but cannot help implement the solutions.

The benefits of strong client relationships, for internal audit and for the organisation, are compelling. In Breslauer’s words: “Being a trusted advisor gets you a seat at the table. If you are not at the table, you are in the dark about what is coming next.” This strengthens internal audit’s ability to help management identify and head off emerging risks that could threaten the organisation’s ability to reach its goals.

This article is an adaptation of “How Some Teams Are Taking a Customer Service Approach to Internal Auditing” by Karen Kroll, published on Internal Audit 360. Source: https://internalaudit360.com/how-some-teams-are-taking-a-customer-service-approach-to-internal-auditing/