How Some Teams Are Taking a Customer-Service Approach to Internal Auditing

It’s no secret that internal auditors and the managers of the units, departments, and functions they audit don’t always get along. After all, it’s not easy to embrace the idea of strangers coming into your offices, looking over your shoulder, sifting through your documents and data to find all the things you’re not doing right, and then writing it up in a report for your boss and your boss’ boss to read through. While this adversarial picture of internal auditing should be outdated by now, it’s still the prevailing view at too many companies and organizations.

Some internal audit leaders, though, are working to change the nature of the audit-auditee relationship. They are taking an approach that views auditees as clients and customers and working to ensure the audits they conduct work for internal audit’s most important stakeholder: the managers who are in the position to put audit recommendations into action. Indeed, consultants say the customer-service oriented internal audit department has the ability to yield better outcomes for both internal audit and the business units they audit.

As many internal audit leaders know, building solid relationships with colleagues requires working together as partners, offering solid insight, demonstrating respect, and truly communicating. These actions, all hallmarks of first-rate customer service, are not only right, but they can make relationships more productive and worthwhile.

Perhaps no time is this truer than when it comes time for internal auditors to work with auditees. Whether it’s called taking a customer service approach, or acting as consultants and trusted advisors, this allows internal audit to “provide greater value to the organization,” says Andrew Twardzik, partner and member of the American risk leadership team at EY.  Auditors who establish strong relationships will likely find auditees to be more open and forthcoming, he says, which helps auditors better identify and understand risks—before issues escalate.

Conversely, a “policing” approach to internal audit (also sometimes called “gotcha” internal auditing) generally does little to boost the value the internal audit function can offer. Auditees may hesitate to alert internal audit to issues that concern them, worried about repercussions.

Elements of a Customer-Service Approach
A customer-service approach encompasses a range of activities. One of the most fundamental, yet often overlooked, is simply doing good work, says Ari Sagett, managing director with Protiviti’s internal audit practice. Among other steps, this means acting professionally, communicating throughout the process, working with auditees to understand their businesses, and ensuring the audit report accurately reflects the operation and the risks it faces.

A customer-focused internal audit department will work more closely with the client on planning and conducting the audit, make the process as painless as possible for the unit or function being audited, and ensure the results are focused on improving the function. It is commonly noted that internal auditors must be good listeners. This is especially true in the customer-service oriented internal audit department.

Building relationships with colleagues in other areas, including outside the audit itself, is also vital. “Audits can’t be done in silos,” so audit leaders need to engage, says Mike Suffield, director of professional insights at ACCA Global, an organization for chartered certified accountants. For any audit to provide valuable insights, the auditor needs to understand the environment in which the client departments work and the challenges they face.

Establishing a solid relationship before it’s necessary to discuss any sensitive findings generally leads to less contentious, more productive conversations. “I never want my first conversation to be on the audit,” says Karl Stingily, senior vice president and chief audit executive at Caesars Entertainment.

Intentionally Building Relationships
Developing strong relationships requires intentional action. “It’s no different than any other relationship. It doesn’t always happen organically,” says Linda Milburn-Pyle managing director of risk and compliance at Accenture. When she worked in internal auditing, members of her team were responsible for building relationships. Newer auditors typically connected with entry-level staffers, while managers and directors connected with other managers and directors. For this to work, company leadership and the board of directors have to support the audit team spending time on these interactions, Milburn-Pyle says.

Stephen Young, vice president of internal audit at industrial manufacturing company MacLean-Fogg, initiates quarterly meetings with the company’s vice presidents and steering committee to build relationships and foster trust. He also makes a point of talking with division leaders on a regular basis. The goal is to meet everyone and understand what’s going on, he adds.

Education and Communication
Education and communication play critical roles in a customer service approach. By helping others understand internal audit’s role, internal auditors can “demystify” the function. “We spend a lot of time educating people about what we’re really trying to do, which is to help the entity achieve its strategic goals,” says Jacqueline Breslauer, chief audit executive at Valley National Bank in Wayne, New Jersey. For instance, they’ll let the client know that internal audit can look at functions from an outsider’s perspective, offering new insight on how well a function is working and how it might work better, and that audit can provide best practices and guidance on risks and controls.

At the audit kickoff meeting, the audit team outlines the audit process and also discusses its scope and timing. Providing this information reduces concerns by demonstrating transparency and helping auditees understand the steps ahead, Breslauer says. At the audit’s end, the audit team provides an anonymous client survey, so auditees can tell internal audit how it can improve its customer service going forward, she adds.

In discussing the audit process, Young lets clients know if they don’t agree with a finding, they can discuss it. He and his team also give credit for functions that are operating as they’re supposed to. In the report’s summary, they’ll code different functions with a green, orange, or red rating. “In 99 percent of cases, it’s green,” he says. Presenting a balanced picture reduces concerns the audit may make auditees look like they’re not doing a good job.

Sagett commits to “no surprises.” If his team uncovers something that warrants attention, they’ll discuss it with the auditee promptly, openly, without judgment—and before it becomes part of the audit report.

In a strong customer relationship, communication travels both ways. “I’m very open to hearing feedback,” Caesars’ Stingily says, adding that he wants auditees’ input on any areas of concern. “Smart teams know how to use internal audit,” he says. For instances, if a department is concerned about insufficient staffing, auditors can check this. If it’s a valid concern, the audit can lend support to the idea of acquiring additional resources.

Scheduling Flexibility
Another area in which internal audit can demonstrate a strong customer service approach is with scheduling. “If you say, ‘I’m the internal auditor, I get to go wherever I want, when I want,’” you’ll demolish any goodwill, Milburn-Pyle says.

Many internal audit executives say that when the risk is low and the auditee offers a compelling reason, they’ll shift the audit schedule to accommodate their clients’ needs. Examples of compelling reasons include sizeable software implementations and the recent departure of a process owner or department head.

Scheduling flexibility is especially important in industries like banking, where “testing fatigue” is a reality, given that risk and compliance internal audit (the second and third lines of defense), along with regulators and external auditors conduct regular testing, Breslauer says. At the beginning of each year, her group draws up a firm-wide testing schedule that includes all testing groups. Those that can be flexible will work to coordinate or leverage each other to the best of their ability. This helps reduce duplicate testing.

Then, they’ll issue the schedule to all clients. It will likely change, but the test groups work to keep it updated and their clients informed, Breslauer says.

Maintaining Independence
A common concern that surfaces when an internal audit department considers a customer service approach is whether in doing so, they’ll compromise their independence. “Internal audit is also a role that needs to be objective, so the auditor should ensure that their objectivity isn’t compromised or could be challenged due to a personal or business relationship,” ACCA’s Suffield says.

Young argues that because internal auditors work for the same company as their clients, they’re not truly independent to start. “We can be objective,” he says. “But independence goes out the window unless we’re a third party working for the board.” Objectivity, he says, requires presenting facts honestly and ensuring the facts support the risk assessment and recommendations.

Internal auditors can also take steps to safeguard their objectivity. One way is by clearly segregating and defining the types of engagements they do. At Valley Bank, Breslauer’s team completes several types of audits, as well as consulting reviews. On consulting engagements, they won’t issue a rated audit report. If they identify a significant issue, they’ll rate and track it for closure, but the deliverable will consist of a memo summarizing the review and providing recommendations and an opinion. Breslauer also lets clients know that while internal audit can provide guidance in the form of recommendations, it can’t help execute solutions.

The benefits—to both internal audit and the organization—when internal audit builds strong relationships with its clients are compelling. “Being a trusted advisor gets you a seat at table,” Breslauer says. “If you’re not at the table, you’re in dark about what’s coming next.” That hinders internal audit’s ability to help management identify and get ahead of emerging risks that could threaten the organization’s ability to achieve its goals. 

Karen Kroll is a finance and business writer based in Minneapolis, Minnesota.