Assurance vs. Advisory Work: Is it Time to Rebalance?

Most internal audit functions spend somewhere between 80 and 100 percent of their time doing traditional internal audits, generally known as “assurance work.” Yet, many also do some level of advisory work, and aspire to do more. Many chief audit executives fret over how to allocate internal audit’s limited resources among these two activities.

Assurance work is the main focus of internal audit and where many boards and audit committees expect the emphasis to be placed. But advisory work may be more likely to add more immediate and tangible value, improve relationships, and boost internal audit’s profile in the organization. In other words, assurance activities are the base hits that continually win games, but advisory projects are the home runs that wow fans and make the evening highlight reels.

Before we delve into this conundrum, let me reiterate: internal audit is predominately an assurance function. When internal audit resources are constrained, the primary focus must be on assurance work to prioritize commitments made in the audit plan and emphasize what the board and audit committee expect.

That said, it is not unheard of, especially in well-resourced internal audit functions, for as much as, or more than, 20 percent of total resource availability to be dedicated to advisory projects. When advisory efforts are undertaken judiciously, these projects can add as much value, if not more, to the organization than many of the necessary assurance efforts. Indeed, well executed, properly scoped, and collaborative advisory projects have a demonstrated track record of improving relationships and adding significant value to the organization. According to the IIA, the mission of internal audit is: “To enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight.”

So, the question remains: how much assurance versus how much advisory work?

Maybe we internal auditors have been thinking about this question the wrong way. Could it be that it is not about how much of available resources should be dedicated to advisory work, but the better questions might be when, how and, most importantly, why we provide advisory work. “If we haven’t struck the right balance between assurance and advisory work … some stakeholders might question whether they are getting what they pay us for,” wrote Richard Chambers, president and CEO of the Institute of Internal Auditors (IIA), in a blog post on the topic.

The Difference Between Assurance and Advisory Work
For some background on the topic, let us turn to the IIA’s working definitions of assurance and advisory services, from its International Standards for the Professional Practice of Internal Auditing:

Assurance Services: An objective examination of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes for the organization.

Consulting Services: Advisory and related client service activities, the nature and scope of which are agreed with the client, are intended to add value and improve an organization’s governance, risk management, and control processes without the internal auditor assuming management responsibility.

It’s worth noting here, that the word “consulting” as it relates to internal audit’s efforts has fallen out of favor, since it may carry a negative connotation for some. So, I will use the term “advisory” instead of “consulting” throughout, although they are, for most purposes, synonymous.

What is Happening Now?
The pandemic has upped the stakes on the assurance vs. advisory question for internal audit. During the crisis, some internal audit functions have doubled down on achieving the audit plan, while others have shifted a large percentage of their efforts to advisory work that is not part of the audit plan, as the business needs and risks evolved at a rapid pace, and internal audit personnel had the requisite skill set to most help the organization in a crisis situation.

With this in mind, we recently asked a small group of internal audit professionals the following question: “Has the percentage of your internal audit team’s efforts dedicated to assurance versus advisory work changed during the pandemic?”

The results of this informal poll are as follows:

• Stayed about the same: 59 percent
• More assurance work: 12 percent
• More advisory work: 29 percent

While nearly 30 percent say they have increased advisory work, I thought it would be even higher. I contend that the failure to put more emphasis on advisory work during the crisis might very well enhance the risk of loss of relevance for some of these internal audit functions in their organizations. More on that later.

Walk a Mile in Their Shoes
Put yourself in the shoes of a busy operating manager of your organization. They have hundreds of priorities to juggle, and the prospects of dealing with the complexities and time demands of an audit (as nice as the internal auditors might be) is just not what they likely want or need right at the time you want to or need to execute that work, particularly during a crisis. Who would look forward to having a group of folks (well meaning, of course) ask a lot of questions, interrupt daily activities, and tell you what they think about what you are doing? (Do not get me wrong, this may be high-value assurance work for the organization, but the local operating management doesn’t always see it that way.)

How do you effectively change that dynamic? You say you are there to help … but are you really helping? Do you help them solve a problem they are facing, or are you just there to identify new or existing problems for them to deal with? So, perhaps lending a hand and really helping might be the ticket to changing the minds of those local operating managers on how they view internal audit. And how do you do that? You provide some real, value added, advisory work. Do this enough and those operating managers will be happy to see you coming, rather than gritting their teeth in anticipation of your arrival.

Questions and Answers
To further explore the issue of assurance versus advisory work, I recently put some questions on the topic to members of the internal audit community. I will share here a summation of the answers I received along with my own views.

Q: Is there a clear trend toward internal audit providing more advisory work?
A: No, there is not a clear trend regarding doing more or doing less advisory work when looking at the macro level. But a definite troubling situation is that more and more internal audit functions are struggling with sustaining relevance in their organizations, exacerbated by the pandemic. Put quite simply, relevance is all about being perceived as adding value. What does seem to be a potential trend is that those internal audit functions that are doing less advisory work might be the ones struggling to maintain a reputation as a value-adding partner to the business.

Many internal audit functions have, rightfully, prioritized the audit plan and their primary role as assurance providers. While doing this, however, they may have slowly chipped away at the positive perceptions of relevance across the organization except, perhaps, with the audit committee. To reclaim lost relevance, some internal audit functions are reasserting their role in advisory work. They are working to identify areas of the organization where assistance might be needed and helping where practical. As well, following a track record of successful advisory engagements, the organization learns the value internal audit can provide beyond traditional assurance work and, as they say, “the phone starts ringing.” It’s a much better situation to be in when you must turn down requests for assistance, then when you are never asked at all.

Importantly, if you develop that track record of helping beyond just the traditional assurance work, you can materially enhance value creation and the perception of the function throughout the organization. It may also help internal audit secure the resources it needs for success, starting a positive feedback loop.

Q: What are the barriers to doing more advisory work?
A: The biggest barrier is when the organization does not view internal audit as credible to provide advisory services. If you view advisory work as a product, you can have all the supply of the product you want but if there is no demand then there are no buyers of that product. And, in the end, internal audit advisory work is a product you are supplying to the organization.

An internal audit function that has taken on advisory work in an area where it doesn’t have expertise, for example, will likely produce a poor result. You know how you feel when you buy a product and it turns out to be substandard. You don’t go back. The same will happen to internal audit advisory opportunities; they will dry up.

It’s true, insufficient resources can act as a barrier to internal audit’s ability to provide advisory services, especially when the audit plan is behind schedule, but a negative perception of internal audit’s ability to deliver on those projects is often a bigger barrier. As Michelle Bennett, senior director of risk management and internal audit at Cable ONE, put it: “One area I see as a barrier is a fundamental misunderstanding of internal audit’s purpose and capabilities. Many folks who have prior, perhaps challenged, experiences with internal audit may believe it to be a ‘gotcha’ department. Instead, we want to be trusted advisors to not only help protect the company but, more importantly, help the company achieve its strategic goals.” The lesson here is that internal audit must not only manage its reputation in the organization, but it should also be careful to take on the right kinds of advisory projects, where it has expertise and where it can provide a positive result.

Q: What are the areas that internal audit needs to strengthen to enable it to do more high-value advisory work?
A: Sometimes we want to do what we think is best for the organization, which might not always square with what the organization needs or wants. It ends up being perceived as what we are doing to the organization, as opposed to being what we are doing for the organization.

“For internal audit to shift and do higher value advisory work … it needs to find out what the executives in their organization really need. Too often we do what we think the organization needs,” says Jason Mefford, president of Mefford Associates.  “The executives often don’t think we are qualified to help. Instead of telling them we can help, start showing them. It’s doesn’t matter what we say; it matters if we can show it.”

So, where to start if the self-reflection results in a conclusion that perceived relevance or the perceived ability to add value is lacking? It is all about relationships. If you do not have strong relationships throughout the organization, people will not know you, will not trust you, will not know your capabilities, and will not seek out your help. Therefore, the primary things internal audit needs to strengthen are relationships. It may take a little work, particularly with people working remotely, but from strong relationships come trust. From trust comes demand for participation. And, from participation comes value. Can you hear that phone ringing now?

Q: What about dealing with the objectivity and independence questions that can arise with advisory work?
A: Advisory work can raise concerns about independence or objectivity. Such work can and should be done, however, without negatively impacting independence. If objectivity issues do arise, it doesn’t mean, necessarily, to scrap the project, just that those issues must be managed.

“It requires careful attention to ensure that we stay independent and objective,” says Eleanor Andrews, SVP of internal audit and chief risk officer at American Tower.  Eleanor continued by adding, “There are times when we do need to venture into the grey area, but we make sure those circumstances are well understood, the conflicts are mitigated, and the situation is time-bound. If management wants us to execute an advisory project, we draw up an informal statement of work to share with management that clearly spells out what we will do, what the boundaries are, and how much time we will spend. That way we can control both our schedule and our independence.”

Q: What are the areas that are ideal for internal audit to provide more advisory work?
A: The areas will be different by organization, industry sector, competence of the internal audit professionals, and the challenges the organization itself is facing. (Let us ignore the potential, although it is certainly an option, of hiring 3^rd party resourses in this answer.)

Given that there is not a go-to list of areas that will make sense for every company, what should internal audit do? If internal audit is attentive to the needs of the organization, knows where help might be needed, and has strong relationships with key individuals, the value internal audit can bring may already be well understood. If not, some relationship building and marketing of internal audit services, capabilities, and competencies may be needed. It is internal audit’s responsibility to match the right competence to the right projects, so that internal audit can add tremendous value to the organization by taking on more advisory work. (It’s worth noting here, that sometimes the answer might also be to hire third-party resources managed by internal audit in either a co-sourced or outsourced project capacity to execute an advisory project.)

Sometimes the advisory work will be truly risk-based and in areas of highest risk to the organization consistent with the achievement of strategic objectives, but not always. Some of the most impactful advisory projects can be done on a more localized level, where the skills of competent internal auditors who truly know the business well can greatly aid operating management. Enough of these efforts across the organization might, and generally will, have more lasting value than one big, high profile, “risky” advisory project.

Maintaining Relevance
It is my considered opinion that internal audit functions that are not nimble, flexible, proactive, and visible in their organizations will become less and less relevant over time. Advisory services and advisory projects are highly effective means to address the dangers of losing that relevance. Remember that the mission of internal audit is about assurance, is about advice, and is about insight. Providing all three in the right measure will ensure internal audit can and will continue to add value as organizations evolve, manage though to the other side of the pandemic, and stand ready for any other crises that undoubtedly will arise. 

Hal Garyn is Managing Director and Owner of Audit Executive Advisory Services, LLC based in FL.