Walking a Tightrope: When Stakeholder Expectations Don't Align

Richard Chambers, CIA, CGAP, CCSA, CRMA, shares his personal reflections and insights on the internal audit profession.

 

One of the features that makes internal auditing so valuable to modern enterprises is that we serve multiple stakeholders, including the board, various levels of management, and even external auditors and regulators. One of the challenges is that these stakeholder groups often have very different expectations of us, and very different perspectives on how we add value.

Differences of opinions among internal audit stakeholders are not uncommon, but it can become particularly problematic if the disagreement is between the audit committee and management. In such cases, the chief audit executive (CAE) can feel caught between two very powerful forces.

I have heard CAEs taking sides in these debates, based not on the particular issue at hand but on whose opinion should take precedence. The stance, for example, may be: “We need to work with management. Management knows the company best, so we will just have to discreetly ignore the audit committee’s requests.”

I’ve also encountered CAEs whose view is that the audit committee, rather than management, should prevail when internal audit is determining its priorities. “Management doesn’t approve our annual plan; the audit committee does. We will just have to explain to management why we need to follow direction from the audit committee rather than to undertake a special audit request from the chief financial officer (CFO).”

From my experience, neither of the foregoing approaches is healthy. If you elect to follow the direction of a single stakeholder group without making every effort to find common ground, you are missing an opportunity. What’s worse is that you are often engaged in a dangerous game of corporate politics. Hitch your wagon exclusively to the wrong stakeholder group, and the results could prove disastrous for internal audit and even fatal to your career.

It is true that the audit committee generally has responsibility for final approval of the annual audit plan and, by extension, levels of resources. The real issue is not whose opinion should take precedence. Instead, we must operate with a shared vision regarding risks and controls. With that in mind, the issue becomes how to bring management, the audit committee, and the CAE to a consensus.

When the audit committee and management disagree about audit priorities, I believe the first step should be for the CAE to have a candid dialogue about all potential options. For example, the audit committee may believe internal audit’s primary focus should be to provide assurance on the effectiveness of financial reporting controls, and management may believe that internal audit should focus on operational effectiveness or compliance. At this point, the CAE generally should avoid creating any tension about what each stakeholder groups wants, and instead try to understand each point of view. It also may be helpful to ensure that both the audit committee and management have an appreciation for the full range of internal audit’s capabilities.

If these initial discussions have not cleared up differences of opinion, it may be time to discuss the other party’s views with each stakeholder group. For example, you might need to tell the audit committee that management wants internal audit to focus on cost containment and reduction opportunities and moderate some of the focus on financial controls in the coming year. These discussions must be handled with care. The situation can get difficult if management officials believe you are putting them on the spot with the audit committee by pointing out that they take a different view.

In most cases, agreement will be reached at this point. However, if there is still disagreement, my advice is to hold a three-way conversation involving the CEO or CFO, the audit committee chair, and the CAE. The CAE should facilitate a candid conversation about the different expectations and try to foster a consensus among these important stakeholders on internal audit’s priorities.

Of course, senior management and audit committees are not our only stakeholders. Take, for example, regulators, who in some industries (such as financial services) are starting to outline specific expectations regarding audit plans and schedules. It’s possible that neither management nor the audit committee will agree with regulators’ priorities. Moreover, it is unlikely that you will get regulators to sit down and discuss the alternatives with your leadership team. But even if we can’t bring all parties together to discuss the issues, we can clearly articulate to management and the audit committee the risk of developing internal audit plans that are not aligned with regulator expectations.

We all want what’s best for our organizations, but it’s only natural for people to see things differently. Things would certainly be easier if we didn’t need to worry about keeping all of our stakeholders happy. But without our stakeholders, internal audit has no mission. The best audit schedules are built upon the advice and consent of all our stakeholders. By actively working to establish consensus, we are helping to ensure the audit schedule addresses risks appropriately. If we consistently assess and reassess stakeholder needs and expectations, and if we align the delivery of our services to meet these evolving demands, we are more likely to deliver the value they are seeking.

What are your thoughts and insights for aligning stakeholder expectations?

Posted on May 20, 2014 by Richard Chambers

Share This Article:    

  1. Richard:  Thanks for this post.  Conflicting customer expectations is a very significant and escalating issue for the IA profession.  The good news is that boards around the world are beginning to genuinely have expectations on what they want from internal audit that go far beyond traditional relatively narrow and modest expectations focused on financial areas.  This means the profession must transition from being predominantly "supply driven" with often apathetic customers to being  "board driven".  This change is being driven by regulators, post 2008 financial crisis post mortems, that are increasingly calling on boards to oversee management's risk appetite and tolerance. This new expectation has profound implications for the IA profession. Boards need help to discharge this new expectation.  It is highly likely that at least some percentage of senior management will not welcome boards actively overseeing management's real risk appetite and tolerance on major issues and may not be supportive of internal audit departments that prioritize these new board requirements over their preference for low visibility on risk taking. Conflicting customer requirements will have to be tempered by the very real fact that senior management generally control the future of internal auditor's careers. The goal must be to seek new tools and methods capable of balancing conflicting requirements in pragmatic ways.

  1. Thanks Richard for he Insight.

    The most widened gap of stakeholder expectations is that of Regulators for some of us working with financial institutions. For instance in the eyes of most Regulators, the theorem of "CAEs to have a seat at the table" especially at strategy setting is some thing unthinkable most times confused with compromising independence. Yet CAEs need to know where the organization will steer in the next period. Indeed the Audit Committee, Senior Management, Regulators etc.;  presses different forces on the audit plan thus balancing the audit plan takes some good thinking.

    Cheers

  1. Richard – I will start by saying that your articles published in the last year or on this site so go to the heart of what keeps CAE’s up at night – keep it up! I only wish I had the benefit of this type of insight in my first position as a CAE 30 years ago. Regarding your “Walking the tightrope” piece, once again, you hit the nail on the head. I have the luxury of posting my following comments because my path safely down from the tightrope is assured – I retire from my CAE position shortly. Personally I struggle with the non-alignment of stakeholder expectations because I have tried but failed to resolve it. In spite of communication of options and suggestions to clarify stakeholders’ expectations of IA with both the President and the Audit Committee Chair, there is a reticence of either stakeholder to spend the time to discuss the options or make a decision. I suspect one reason I have been unsuccessful in engaging these stakeholders on this question is that my communication of the options, the pre-requisites and the implications have not been as simple, structured and clear as they might have been. Therefore I strongly echo Tim Leech’s comment on your piece: “The goal must be to seek new tools and methods capable of balancing conflicting requirements in pragmatic ways.” I recognize there are other things at play here – I refer to the first point of Richard’s “Five things the Audit Committee won’t tell Internal Audit” article: “You are not as important to us as the external auditors”. However, my goal is to help my successor by getting this process completed or at least well under way before my retirement date.

Leave a Reply