What are internal audit strategies?

As the saying goes, "you can't make an omelet without breaking a few eggs." It's likely an expression internal auditors have heard or even used themselves to characterize the tension that can result from auditing a particular function or process.

Internal audit's role is to provide independent assurance that an organization's risk management, governance, and internal control processes are operating effectively. This role is unique because the internal auditor is an agent that monitors other managers' actions who are employed by the same organization. The process of expressing an opinion on the client's operations, financials, and controls unavoidably leads to a certain amount of conflict or tension between the internal auditor and the auditee or audit client.

According to Richard Chambers, president and CEO of the Institute of Internal Auditors, tension between internal audit and management can arise from the following:

• Inequitable distribution of resources to the internal audit unit

• Disclosure of risks to the audit committee

• Unflattering internal audit reports

• Disputed ratings and opinions of the internal audit

• Internal audit's unique relationship with the audit committee

While some conflict may be unavoidable, internal audit doesn't have to have a strained relationship with the managers of functions and processes it audits. Indeed, by using a few strategies to manage tension and involve audit clients in the planning and decision-making process, internal auditors can keep those tensions to a minimum. Here are nine measures to manage tension with auditees during audit assignments.

1) Involve auditees in audit plan development

The audit plan is the framework for the performance of audit work. For effective execution of an audit, it becomes imperative that internal audit involves the audit client in the audit planning. This will bring about mutual understanding on the scope of the audit. Accepting input from the auditee will reduce or eliminate tension elements as they are aware of what the audit is to do at their function or process to improve the system. Typically, managers will be far less critical of a process that they had a hand in developing. Not only does it increase the transparency of the audit process, but it also lessens the idea that an outsider is coming in to look over someone's shoulder. A copy of the audit plan should then be made available to the auditee to prepare them for the audit assignment.

2) Hold an entry conference

The opening conference is the initiation of the audit work or the internal auditor's formal introduction to the client. An entry conference provides an opportunity for the audit team to explain the key audit thrust areas to the auditee to add value to the entity or auditee operations and not to act as a detective to find faults with the auditee. Besides conveying the goal of adding value, it is the means to outline the audit plan and audit program to the auditee. This is one of the avenues to educate managers on the purpose of the audit assignment. It also provides an opportunity to hear again any concerns the audit clients have so they can be addressed early, before they develop into points of contention. The entry conference opens the door for the management or the auditee to ask questions and get responses that can help settle any misunderstandings, which in the long run will reduce or prevent tension between the internal audit and the auditee.

3) Use care during fieldwork

During the audit process, the internal auditor uses interviews as one of the instruments to solicit information. Interviews, inquiry, and observation are used to understand the audit environment, regulatory environment, and activities carried out by the auditee. It's essential to be thorough in this information gathering, but internal auditors should also use what doctors would call, "good bedside manner." Show appreciation for the auditee's schedule and work to create as little disruption as possible.

It's also vital to provide auditees the chance to make clarifications to assumptions gained during fieldwork. The auditor should clarify matters that are raised as a finding by writing to the auditee to respond to them before including them in the audit reports. Proper documentation is critical to the audit work as it is the only evidence of the work done. Documenting events will help reduce tension since auditors will have evidence to substantiate, authenticate, and prove the findings raised in the audit.

4) Write balanced audit reports

Audit reports that only include deficiencies and problems are sure to provoke the ire of process owners. Be sure also to mention things that are working well in audit reports. Audit reports should be a representation of the events and transactions that have taken place. The report should highlight the successes, failures, and challenges of the auditee. When auditees feel appreciated for their successes and wins are celebrated, they will be far more likely to accept negative findings and work to improve them. This helps reduce the tension between the auditor and the auditee. It's also important to ensure that the recommendations in the internal audit report are achievable. Unrealistic recommendations or those that can't be achieved with existing resources will certainly breed frustration and create tension between the auditor and the auditee.

5) Use care in the wording of the audit report

Language can be an effective way to ease tension when it comes to report writing. Avoid words that are inflammatory or convey opinions more than factual findings. Some examples include absolutes (e.g. never, always, everyone, every time) and qualifiers that may come across as being overly judgmental (e.g. incompetent, refuse to, neglected to, careless or carelessly, ignored). The wording of sentences is also crucial as communication ends with how the recipient understood the report and not how the auditor intended to communicate findings. This makes the auditor responsible for the contents of the audit report and thus should be particular about the wording and the intent to express his or her findings. Be sure to get impartial readers of audit report drafts to ensure the intended message is indeed the message that is being communicated. Internal auditors should also take care not to dilute or reduce the impact of the internal auditor report.

6) View auditees as customers

Before the audit, the auditee may have a prejudiced opinion that the internal auditor intends to find fault with them and not necessarily to improve the system. When the internal auditors' attitudes suggest they are acting to find fault with them, auditees will become defensive to protect themselves against the auditor rather than cooperating to improve the system.

Internal auditors should carry and conduct themselves in a manner that suggests that they are partners with the shared goal of process improvement. The internal auditor should respect the auditee and not treat them as wrongdoers and not take the auditee for granted. Viewing them more as customers can go a long way to changing the relationship from adversarial to cooperative.

7) Follow standards and abide by all policies

When auditors carefully abide by professional standards, such as the IIA's International Standards for the Professional Practice of Internal Auditing, they have a strong basis and justification for their actions. When they show that they are following approved standards and guidelines, audit clients will be less likely to push back on internal audit methods. When required, bring the standards to the attention of auditees.

Internal audit must also closely adhere to the policies and standard procedures of the organization. When the auditor flaunts the same rules that he wants the auditee to comply with, it can lead to conflict and tension.

8) Avoid surprises

Nothing will create conflict faster than when audit clients feel sideswiped. The auditee should always have a chance to address contentious findings before they are included in the report or discussed with others in the organization. The auditee will almost always become frustrated when they are sidelined and matters of the report are discussed with third parties, who could either be their boss in the chain of command or a person who has no connection to the audit process. The auditor and auditee should discuss the report's contents; however, to avoid potential conflicts, the draft report should be made available with ample time to prepare a response to prevent escalation.

9) Conduct a well-organized exit conference

An exit conference is one of the ways to resolve tension between the auditor and the auditee. During this meeting, if care is not taken, stress can heighten and could result in verbal exchanges. Possible audit findings should be made available to the auditee to respond to before the exit conference to enable a smooth exit meeting. When an exit meeting for the discussion of audit findings is arranged, battle lines are often drawn. Auditors stand resolute in a tension-filled atmosphere, ready to argue with management and armed with the fully supported, cross-referenced audit report. Management is equally prepared with standard catchphrases to disarm the audit team such as: "Oh, that's just a paperwork problem,” "This issue doesn't seem report-worthy," "That is what we have been doing all these years" or "If management already fixed the problem, then why do we need to have it in the report?"

After a few hours of debate, one thing becomes very evident: both sides have a clear but different view of risk to the organization. It will take some good communication to arrive at a consensus on the underlying risks and how they should be addressed.

Before the internal auditor issues any report, be it satisfactory or unsatisfactory, the internal auditor must showcase a high sense of professionalism and ensure that any problems that have arisen throughout the audit are resolved. Over-communicate rather than under-communicate, treat everyone involved in the process with respect and keep an open mind on the auditees' views and arguments. Doing those things can dramatically the reduce occasional tension between internal audit and the auditees.

Daniel Quainoo is an internal auditor at the University of Cape Coast in Cape Coast, Ghana. He has more than 15 years of experience working as an internal auditor.