control, and governance
control, and governance
The Auditor as Internal Consultant
Consulting skills can boost the internal auditor's influence in the organization.
Scott D. White, CIA, CFSA
Assistant Vice President, Audit Services
John Hancock Financial Services
The International Standards for the Professional Practice of Internal Auditing defines internal auditing as a "consulting activity," but how many internal auditors have ever really studied what it takes to be an effective consultant? Internal auditors may recommend change with their internal audit reports, but can they "influence" change in other ways? Do internal auditors just perform an audit, or do they collaborate with their clients to make an outcome better?
Increasingly, internal auditors are being held to higher standards of performance and accountability. In many cases, they need to act as objective and critical "outsiders" within their own organizations, delivering the hard facts and bad news that management typically does not want to hear. Additionally, they need to be prepared to deliver the truth to management beyond what is presented by the facts. They need to be good at the "off- the-record" conversation, which is sometimes more important than the written report. Internal auditors who master the principles of effective internal consulting can use the related methods and techniques to dig deeper and deliver the truth.
DELIVERING BAD NEWS
In these days of increased regulatory scrutiny, growing importance is being placed on the vital role internal audits play within the organization's overall governance framework. Internal auditors often are viewed as one of the few objective sources of information within the organization. The auditor's role is to deliver that news, no matter how uncomfortable the task or resistant the audience.
According to Marcia Meislin, president of mcm Management Consultants and author of The Internal Consultant: Drawing on Inside Expertise, most people are ambivalent about hearing honest feedback. However, contacts with management can result in "moments of truth" — any point at which someone forms a perception about an individual, an individual's department, or the company. These can be "make or break" moments that determine the success of the auditor's message. A positive moment of truth for an auditor in which bad news is delivered can turn a potentially disastrous situation into one of trust, partnership, and lowered defenses. An auditor who understands management's point of view regarding an issue can present difficult news in a helpful and supportive manner, can offer well-thought-out solutions, and can often have far greater positive impact in affecting an outcome. This can lead to more honesty, fewer walls, and minimized finger pointing. The client and auditor can then collaborate to fix common problems rather than approach them in an adversarial way. Instances where the client remains in denial about the problem until it festers and gets out of hand will become fewer.
Internal auditors can apply Meislin's techniques to their work to ensure moments of truth occur when working with clients. For example, auditors should:
- Be authentic with no phoniness or hidden agendas.
- Do their homework and know the business issues at hand as well as the audit issues.
- Conduct a good interview by asking open-ended questions and listening actively to the responses.
- Confidently articulate internal auditing's value to the organization and benefit to the contact.
- Be honest about the level of confidentiality of the information that the individual is about to share.
The Internal Auditor as Consultant
Examination of the principles behind effective internal consulting practices reveals an alignment between the skills required to be an effective consultant and those required to be an effective internal auditor. According to Marcia Meislin, author of The Internal Consultant: Drawing on Inside Expertise, use of consulting skills and techniques can help internal auditors:
- Reposition themselves from an in-house "enforcer" or policing function to a valued adviser.
- Establish collaborative relationships.
- Minimize resistance and expand positive influence with clients, peers, superiors, and employees.
- Reduce or eliminate the use of "audit lingo" by listening to clients speak the daily language of business.
- Identify clients' behavioral styles to maximize communication and minimize conflicts and misunderstandings.
- Create a plan for increasing the real and perceived value of the audit function.
Internal auditors are typically adept at executing the technical aspects of planning, performing, and reporting on their audit work. They sometimes struggle, however, with the softer skills related to communicating effectively with clients, establishing credibility, and overcoming resistance. Although internal auditing is a discipline related to consulting, auditors often overlook or are unfamiliar with the skills that professional consultants may use to interact effectively with their clients and deliver the services that their clients want and deserve.
Confidentiality, especially at higher levels in the organization, is critical. Failure to maintain confidentiality could come back to haunt the auditor. To avoid any misunderstandings about what will be kept confidential, the auditor should disclose up front internal auditing's reporting requirements and intentions. Auditors should ensure that the client understands internal auditing's professional responsibilities and that auditors are guided by their professional standards and reporting obligations. Internal auditors must explain carefully to executives what information will be confidential and what may end up in a public document.
In some situations, the auditor could consider letting the client manage the flow and timing of the release of audit results up the chain of command, especially if it's bad news. Anything the auditor can do to help the client be seen as cooperative and proactive in addressing audit issues will benefit both the auditor and the client.
REALITY VS. PERCEPTION
Most seasoned internal auditors have had the experience of a client articulating how he or she believes a business process is working and then discovering that it actually works much differently than perceived or expected. When the auditor explains the reality to the client, the typical reactions are disbelief that the auditor truly understands what is happening or anger and disappointment directed at subordinates for not meeting business objectives.
For internal auditors to have an impact and to be seen as true consultants, they must get clients to articulate their vision of how things should be and what is currently happening. Questions the auditor should ask include:
- If everything were working exactly as expected, what would be happening? What would employees be saying or doing? What would customers be experiencing? How is that different from what's happening now?
- What is the ideal state? Is there an example of how you would like things to work?
- What are your two top business objectives, and what is the biggest obstacle in attaining those objectives?
Understanding the client's vision helps direct the auditor in deciding what matters — and what doesn't — to the client, and provides the auditor with opportunities to add value and further build credibility during the audit process by focusing on the areas considered most critical for the client's success.
NEGOTIATE, NEGOTIATE, NEGOTIATE
To be successful as internal consultants, auditors must understand the needs of their clients and ensure clients understand the auditors' needs. Typical early negotiating points might include the timing or length of a particular audit in a business area. For example, a client might say that his or her business cannot accommodate an audit of six weeks in the time frame that the auditor has scheduled and request that the project be delayed or deferred to the next audit cycle. Instead of saying "No," Meislin suggests using the "Yes, and..." technique: "Yes, I understand your time constraints and we can make it work for you; however, we will need more assistance from you and your managers to meet those requirements." The auditor's willingness to negotiate to meet the business manager's needs reflects a customer-oriented consultant.
FACT FINDING
Auditors often see their role as conducting an audit consisting of planning, fieldwork, and reporting. In consulting terms, auditors are data gathering. As an "outsider," the internal auditor isn't locked into the same assumptions as the business and is free to question and probe. To provide value as a consultant, the auditor must be able to gather all the information to help the client understand and fix identified problems.
To achieve this mission, internal auditors need to focus on two specific skills: active listening and questioning. These techniques can be especially useful when the auditor is encountering resistance from the client. Resistance often takes the form of passive-aggressive behavior characterized by indirectness or lack of disclosure during fact finding. Clients may exhibit passive-aggressive behavior in several ways:
- Not returning e-mails or phone calls.
- Controlling the point of contact during the audit (e.g., not allowing auditors to speak with anyone but a designated individual).
- Not producing, or slowness in producing, requested documentation.
- Late reply or no reply to internal audit points or findings.
- Agreeing with the issues discussed during the audit, but then disagreeing with the same issues when they appear in the written report.
- Appearing cooperative, yet critical of the auditors to others.
Resistance to change is normal. Still, there are specific strategies that internal consultants can use to minimize its frustrating effects. To overcome resistance, Meislin recommends:
- Not taking resistance personally; do not become passive-aggressive yourself.
- Identifying the comments and behaviors the client is making that hint at his or her resistance.
- If the behavior continues, stopping and acknowledging what you have observed and what you are experiencing.
- Getting the issue on the table where it can be dealt with openly.
- Giving the client a chance to respond and staying quiet until he or she does.
- Determining how to handle the client's issues by either modifying your actions, reaching an agreement, or being more sensitive to the client's needs.
- Giving the client a say in what is happening early so that his or her resistance is not as likely to derail the audit later.
Auditors should ask direct, yet polite, questions about observed behaviors as opposed to asking someone, "Do you have a problem with me?" — to which the answer could be, "What problem?" A better question might be, "I noticed early on in the audit you were quite cooperative, but lately it sounds like you are angry with us. Is there a problem with the audit or with me that we need to address?" The auditor should remain quiet and let the client respond. If the client does not provide an explanation, the auditor should assure the client that he or she is concerned and ready to listen when the client wants to talk.
Strategies for Building Credibility in the Organization 1. Know what's happening in your company.
2. Know your client and their customer.
3. Find out what hurts the most or needs attention.
4. Develop authentic client/consultant relationships.
5. Provide services that are pragmatic, yet innovative.
6. Market and sell your services internally.
Source: The Internal Consultant: Drawing on Inside Expertise, by Marcia Meislin, MCM |
Internal auditors give feedback through periodic meetings with their clients, an exit conference, and a written report. Although internal auditors tend to be tied into their reporting methodology, there are other techniques that consulting auditors can use to build credibility with their clients, including:
- Present a balanced report starting with information about what went well during an audit and then move to the issues.
- Have a conversation with the client rather than presenting him or her with a presentation on issues. Give the client time to digest comments and respond to them. Be conscious of the client's body language and adjust the tone of the conversation if needed.
- Do not apologize for telling the truth. Maintain your integrity.
- Stick to the specific facts uncovered by the audit. Do not be judgmental or editorialize about your feedback.
- Have your evidence in order and be prepared to provide examples if asked to clarify your point.
- At some point, ask for the client's feedback on your work. If the feedback is negative, ask for clarification if needed and take steps to address the client's concerns. Celebrate success. Don't be afraid to tell others if the feedback was positive.
The audit report does not always suffice as an effective feedback tool. Reports tend to become structured with boilerplate language and generalized statistics and information. The truth sometimes becomes unprintable, and the trends can be left unidentified in a written report. The off-the-record report often is more meaningful and more effective for providing feedback about the root causes of the issues identified. Take for example the veteran internal auditor whose audit results in a certain department left him feeling uncomfortable with that area's financial management. Audits were completed and "satisfactory" reports were published that outlined issues and trends over time but never identified the real issue. The financial manager's method of "resistance" was to create smoke screens and blame others while appearing to be totally cooperative in addressing the issues identified by the "on-the-record" audit report. By continuing to "peel the onion" for the truth, the auditor discovered that the financial manager had covered up a larger mess that existed beneath the surface. The auditor approached the vice president of the area and admitted that the audit reports for the past few years hadn't really identified the critical issue, which was the mismanagement of the area. The issue was dealt with as a result of the off-the-record report, the manager was moved out of the position, and corrective action began.
GOING FORWARD
Increasingly, internal auditors are being held accountable for not only making appropriate recommendations, but also following through on them to ensure that management has taken necessary corrective actions. Auditors grapple with the issue of whether they should make very specific recommendations regarding how a problem should be resolved. Is internal auditing going to be viewed as telling management what to do if it makes specific recommendations? As hard as auditors try, they sometimes might make recommendations that are not realistic for management to implement, or it may not be possible to take action as quickly as they would like. Auditors then run the risk of losing credibility with the client.
Creating management buy-in is probably the most critical, and perhaps the most difficult, step internal auditors can take to positively affect the outcome of the audit. Steps for ensuring buy-in include:
- Know the risk and impact of the issue if nothing is done about it. If it's not important, it will not get addressed.
- Take a business approach to determining how important an issue is. Ask yourself, "If I were the vice president would I care about this issue, and if so, what would I do about it?"
- Understand how the action you are suggesting affects business areas (e.g., does it increase or decrease costs, or increase or decrease headcount?). Issues regarding costs and headcount are near and dear to most managers. It will be difficult to get buy-in on your recommendations if you are not on solid ground.
- Use experts or other resources when needed. Often, others within the organization can help you create buy-in by using their expertise to prove your point. This could be individuals such as the compliance officer or data security officer. Also, outside information such as benchmarking and best practices studies are useful for managers and help create buy-in.
Once the action plans have been set in motion, internal auditors need to step back and evaluate their performance as consultants. They should solicit their client's feedback. If the feedback is negative, the auditors should ask for suggestions on how to improve and take actions to do it better the next time. If it's positive, auditors should ask the client to talk with other managers about the positive experience they just had with internal auditing. Much like a consultant, internal auditors can then build a portfolio of successful projects, expanding their influence and improving the positioning of internal auditing within the organization.
To comment on this article, e-mail the author at scott.white@theiia.org.
Internal Auditor's Role as Internal Consultant
very practical and effective ways demonstrated in this article.
Posted By: Shainul Bhanji
2011-05-20 3:41 PM
consultant as an internal Advisor
The strategy to be an effective consultant,we must be on solution side not on problem side.This can be gained when we look at the issues independently free from partisan pressures as an outsider yet add value by telling them how to fix it and what is not done and to be done at the least cost else our role will be taken away by somebody
Posted By: A.Rajamani
2010-07-08 9:00 AM
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.
To make something bold:
<strong>Text to bold</strong>
To make something italic:
<em>Text to italicize</em>
To make a hyperlink:
<a href="URL">Text to link</a>
