Stakeholder Expectations: How Do You Assess Them?

Richard Chambers, CIA, CGAP, CCSA, shares his personal reflections and insights on the internal audit profession.

In my last blog entry, I explored the concept of internal auditing’s stakeholders and who I thought they were. I identified the primary stakeholders of a typical corporate internal audit function as:

  • The audit committee and the board.
  • The CEO (or head of the enterprise).
  • The chief financial officer or individual to whom the chief audit executive (CAE) reports administratively.
  • Potentially, the other chief officers of the enterprise.

Whether the list is the right one or not is subject to debate, and will clearly vary by organization. What is not subject to debate is the need to identify your own stakeholders and to appropriately align with their expectations.

In its recently published “Common Body of Knowledge (CBOK)” report, The IIA Research Foundation noted:

“It is also imperative for the CAE to determine the specific expectations of his or her chief stakeholders and to develop strategies and tactics to address these expectations. Moreover, it is critical to monitor stakeholder feedback in an ongoing, systematic manner and to update internal audit plans as needed to address changing expectations.” (CBOK 2010 Report V, Imperatives for Change: The IIA’s Global Internal Audit Survey in Action)

Stakeholder assessment is not a passive activity. From my experience, they will typically not come to the CAE to initiate a discussion unless an “expectations gap” has emerged. By then, the damage is already done. I strongly urge CAEs to actively engage in stakeholder expectation assessments as a part of ongoing operations. In a recent Audit Executive Center survey, respondents were asked which strategies they most frequently deployed to assess stakeholder expectations. The results were interesting:

  • Ongoing informal discussions with audit committee chair to assess expectations — 69 percent.
  • Regular formal meetings with key stakeholders to assess expectations — 59 percent.
  • Discussions with full audit committee to assess collective expectations — 57 percent.
  • Formal surveys of stakeholders to assess expectations/performance — 40 percent.
  • Discussions with the full executive leadership/management team in the same room to assess collective expectations/performance — 26 percent.

If it is true that 30 percent of CAEs do not discuss expectations with the audit committee chairman informally, then I fear they are really missing a key opportunity. From my experience, the most meaningful feedback on expectations comes from informal conversations — not structured meetings or surveys.

While there are lots of ways CAEs can assess stakeholder expectations, one thing is certain: It needs to be undertaken continuously. The expectations of a typical U.S. corporate audit committee in 2005 are dramatically different than the expectations of that same audit committee in 2011. From my experience, an internal audit activity that is still performing against outdated expectations “is an accident waiting to happen.”

I welcome your thoughts on effective strategies for assessing internal auditing’s stakeholders’ expectations.

Posted on Mar 7, 2011 by Richard Chambers

Share This Article:    

  1. Richard

    This is good and focused relative to internal audit's stakeholders which is different from all of a company's stakeholders. The bottom line is that proactiveness is the order of the day. Passivity is a recipe for disaster.

    Two additional strategies that may be helpful are first to document in writing the expected communications plan that internal audit should  have with each of its primary stakeholders. Such communications plan should contain what the expectations are, how they will be communicated, what will be communicated, how often, etc. This is the easier of the two strategies. This will encompass both the formal and informal processes.

    The second strategy is that more often than not the major stakeholders do not understand clearly what their expectations need to be because they have not been properly trained and so their expectations may not be in line with what the internal auditors knows or should know is needed (eg in the area of risk management). So the answer to this is that when documenting expectations communicated to him/her by say the Board that the internal audit head finds to be deficient, the internal audit head should augment the expectations in the communication document and then seek to provide the Board or other party with the necessary training needed. Or at a minimum, seek to engage the stakeholder in further discussion.



  1. Dear Mr. Chambers,

    I am a student major in Auditing. Recently I am confused by the differences between risk-based internal audit and risk-oriented internal audit. And I notice that in the IPPF "risk-based" is the only used word. Could you help explain the differences if possible? Thanks a lot.

    Best regards,


Leave a Reply