GUEST BLOG
For years, leaders in the internal audit profession have talked about the proverbial “seat at the table.” They envisioned internal audit having place at the table when some of the most important decisions are being made at the highest levels of the organization. Some chief audit executives and internal audit leaders have made this a reality, playing a role by providing counsel on critical matters affecting the organization’s risk profile. But for many, it remains somewhat aspirational at best.
Just because internal auditors want a seat at the table, doesn’t mean senior executives will automatically pull back the chair and gesture for audit leaders to sit. It must be earned. Once it’s earned, it must be retained. Auditors earn and keep a seat at the table by continuously providing valuable insights, making commitments, and delivering on promises. All these attributes fall under “being relevant.”
What Does it Mean to Be Relevant?
Let’s define relevance in this context. Picture a Venn diagram, with intersection of the two circles representing the level of relevance. The left circle addresses “what you want to say” and the right circle addresses what your audience is “interested in hearing about.”
How much do those two circles overlap? Just because we think we have something important to say, does that information matter to our colleagues? Is it the right information, at the right time, delivered to the right people, and is it insightful? Do we add value in order to stay relevant?
After the Pandemic Hit
Maybe you felt quite relevant going into 2020. Did you still feel relevant as the pandemic unfolded and professionals in many parts of the world were asked to work from home? Were you happy with how internal audit participated in the slew of critical decisions the organization needed to make in managing the crisis? Did internal audit have a voice?
Throughout the pandemic, your organization is undoubtedly facing elevated and unprecedented risk. Certain risks that were high on the risk radar before the crisis began were not as important as it unfolded, and some risks seem to materialize out of nowhere. All your executives, board members, and key organizational leaders have faced significant pressure, at a time when sage and valuable advice from a relevant internal audit function can add great value as the organization navigates this changing risk profile.
If internal audit at your organization was truly relevant before the pandemic, then it should have been asked to participate in many of the critical efforts that have sprung up as the organization navigates the crisis. Hopefully, internal audit is being consulted on the issues that matter most, which emanate from the evolving risk dynamics impacting the organization. Is internal audit present? Is it contributing? Is it being heard? In other words, when it matters most, are you relevant during the crisis?
If the answer to that last question is “yes,” then congratulations. But, for many chief audit executives (CAEs) and their staff, the answer is likely to be a disappointing “no,” or at least “not as much as we’d prefer.” If so, don’t feel bad or alone. However, it is time for some self-reflection on why internal audit is being left out, and time to create a plan to address the issues. Keep in mind, it will likely get even harder to find influence with some of the challenges ahead.
Challenges, Now and Going Forward
Yes, it was hard before, but trends indicate it will be even harder to gain a seat at the table going forward. Internal audit, even with its reliance on technology, data analytics, and electronic communication, will still be most successful because of the interpersonal relationships it has now and will develop over time. For example, you can have the strongest, most insightful points to report, but if you do not have strong pre-existing relationships executives will not be interested in what you have to say. Your audit clients will, as they say, not “give you the time of day.”
Consider, for instance, the newer challenges brought on from working remotely. While you can email, text, chat, and videoconference to communicate, those means of interaction are not ideal for developing or sustaining interpersonal relationships. Many of the informal ways we develop and sustain relationships over time—all those hallway chats, water cooler interactions, drop-by impromptu meetings, and lunchtime chats—have all but disappeared this year. Add to that not being physically present at client locations, and it gets much harder to get a read on, and diagnose, the area’s true culture. This adds to the many challenges inherent in sustaining relationships and relevance going forward.
What Can We Do?
Enhancing relevance should always be top of mind for CAEs. Taking steps to improve relevance as the world navigates through, and eventually emerges from, the pandemic crisis, are paramount. Consider some of the following actions:
- Look at internal audit from the outside in, not the inside out: Focus on what the organization really wants from internal audit, not just what we believe we should provide.
- Request for, and act on, critical feedback.
- Do what is essential, for at least a little while longer: Consider and prioritize the work that is absolutely necessary, even if it is outside the typical internal audit work, and leave the work that doesn’t address the immediate problems for another time.
- Increase time spent on value-add advisory work, possibly deferring some assurance work: The organization needs help in times of crisis, not necessarily another assurance project.
- Volunteer to help: Determine how you can help and figure out how to do it. Don’t wait to be asked. The four words every internal audit leader should be asking senior executives is: “How can I help?”
- Be more flexible with risks to objectivity: While objectivity is fundamental to internal audit, in times of crisis, what the organization needs should potentially take precedence over preserving objectivity.
- Move to a near-continuous risk assessment: Risk is dynamic, not static. Right now, risks are quickly evolving in terms of impact, likelihood, severity, duration, and velocity. If you are conducting risk assessments on a quarterly or, dare I say, annual basis, your assessments are yesterday’s news.
Sometimes, the CAE could use a confidential advisor. Someone who has “been there, done that” and can help coach the internal audit team on elevating its relevance within the organization. As internal auditors hire third-party subject matter expertise when they need it, they should also consider consulting with third-party advisors who can recommend ways to improve on the soft skills needed to enhance the function’s relevance. No matter what you do, it is imperative to take proactive steps to enhance internal audit’s relevance. While never easy, it will not get easier by not acting.
Quite simply, if we are not adding value, we are not relevant. And, if we not relevant, then what is the point? 
Hal Garyn is Managing Director and Owner of Audit Executive Advisory Services, LLC based in FL.