October 2011

To build an effective relationship, CAEs need to establish trust and credibility as the basis of their ongoing communication with the audit committee.

Think of strawberries and cream, or apple pie and custard. Each is fine on its own, but it’s the combination of the two that really makes the mouth water. There is a similar relationship between audit committees and internal auditors. In isolation, each can do a good job. But when they work together, when they have a mutually supportive relationship, they can achieve amazing things for their organizations.

This is a fact once recognized in IIA guidance. Internal auditors and their audit committees have “interlocking goals,” according to Practice Advisory 2060-2: Relationship With the Audit Committee, issued in 2002. “A strong working relationship is essential for each to fulfill its responsibilities to senior management, the greater board of directors, shareholders, and other stakeholders,” it continues. But that guidance no longer forms part of the International Professional Practices Framework — it was considered out of date after the U.S. Sarbanes-Oxley Act of 2002 and other boardroom reforms around the world transformed the role of the listed-company audit committee. From a relatively sleepy forum tasked with overseeing the external audit process, the committee has become a linchpin of good governance. Its needs have changed.

An effective relationship with the audit committee, built on excellent communication, is more important than ever, leading chief audit executives (CAEs) say. The secret to communicating well is to acknowledge that every audit committee is different, to listen to what yours wants, and to meet its needs in a way that builds an unshakable trust in the CAE’s professional competence and that of the audit team. It might not always be easy, and on occasion it might entail some career risk, but the end results are worth it, these CAEs assert.

THE RULES OF ENGAGEMENT

Every great communicator tailors his or her message to the needs of the audience. “But what audit committees want from heads of internal audit varies considerably from one audit committee to the next, and even on the same committee it can vary from one member to the next,” says Hanif Barma, partner at U.K.-based strategic governance consultancy Independent Audit. “It’s vital that the CAE engages effectively with all committee members, not just the chair, to find out what their expectations are. These sometimes conflict, so any differences must be aired and acknowledged.”

Jeff Curtiss, a private investor who serves as audit committee chair at Houston-
based engineering company KBR, is clear about the kind of communications he wants from his CAE, Stephen Shelton. First up, call a spade a spade and keep a lid on the detail, he says. Indeed, nothing annoys an audience more than long-winded explanations and technical jargon, agrees Martin Shovel, a U.K. communications expert who advises internal auditors on their presentation style.

Outstanding communicators use simple language, “But simple is hard, and takes courage,” Shovel says. “It takes courage because it goes against the grain of workplace communications. In organizations, language is often used as a protective veil, the main purpose of which is to cover the speaker’s back rather than enlighten their audience. A concoction of jargonistic words arranged into convoluted sentences is an effective way of covering up ideas that are half-baked, obvious, or trivial.”

Beyond simplicity, Curtiss’ golden rule is to spring no surprises. After the financial crisis, this is a hot point for most audit committees. “When issues or bad news arise, it’s incumbent on the head of internal audit to communicate it at least to the audit committee chair,” Curtiss stresses. CAEs should do that quickly and clearly, and without necessarily waiting for the next scheduled audit committee meeting.

“It’s easy just to blast off an email to give people a heads up. Even if you don’t have the issue resolved,” Curtiss says. The audit committee will respond far better if you tell it you’ve got a problem and are working on a solution, than it would if you kept quiet about the situation until you had a fix. “Some people might say ‘let’s find a solution before we communicate the problem,’ but in today’s world that’s a poor response,” he explains. “The audit committee members have to trust the competency and character of their CAE. If that trust breaks down because there are surprises, it puts the relationship under real stress.”

Shelton agrees, but he cautions that CAEs must be careful not to sound alarmist or appear to be “crying wolf.” In fact, the CAE’s credibility can be enhanced by demonstrating good judgment about which issues to escalate quickly to the audit committee and which to leave for a scheduled meeting. But a willingness to communicate problems quickly, should the need arise, is now a “fundamental differentiator” that sets the best CAEs apart from the rest, he explains. “The audit committee is relying on the CAE to provide assurance services and objective information concerning the overall internal control framework and corporate governance,” Shelton says. “For them to feel comfortable about that reliance, they need a personal sense of faith in the individual who is leading internal audit, in terms of that person’s credibility and willingness to bring good news and bad.”

Without trust it becomes far harder to avoid swamping the audit committee with a tidal wave of information and issues, says Cindy Overmyer, CAE at Oakland, Calif.-based health-care organization Kaiser Permanente. “We have more than 80 people working in internal audit, and the audit committee can’t possibly digest and make sense out of everything we do,” she acknowledges. It’s only because the audit committee trusts her judgment that she can focus on what she thinks is important and omit much of the underlying detail that underpins her decisions.

“They have many other responsibilities,” she says. “They need to have confidence that, out of all of the many things I could bring to their attention, I’m focusing on the things that are most relevant. If they are asking me questions that seem off the point or to be coming from a place of misunderstanding, that tells me that either they don’t have confidence in what they are looking at or I haven’t framed or presented it properly.”

EFFECTIVE PRESENTATIONS

With trust and credibility established, a good CAE can focus on the finer points of communication. A tip from Overmyer is to sweeten the audit committee’s normal diet of bad news by slipping in a few positive morsels. “The audit committee gets to hear about so many negatives and problems, by the nature of their role, and that can give them a sense that everything in the organization is broken,” she says.

So before each of its meetings Overmyer will reflect on whether any successful audits warrant a mention. Maybe the audit shop has discovered an improved business process, or management in one unit has shown a special enthusiasm for the experience of being audited. “It’s helpful for the committee to know that some things are working really well,” she says. “It puts the bad news in perspective.”

Overmyer also suggests involving the organization’s senior management in the audit committee presentation, when appropriate. “If I’m talking about an audit and it gets to the point where we discuss how management is responding to our findings, I turn to the operational leaders and let them explain what they are doing,” she says. “I don’t surprise people with that, of course — I let them know in advance so they can prepare. It broadens the discussion and gives the committee a richer picture of what is going on.”

Shelton advises CAEs to deliver “crisp, attractive presentations that communicate information in reasonable detail and are easy to read.” Audit committee members need to digest the important stuff without it seeming like a real effort, he says. “I want to make my audit presentations compelling so that people want to read them.”

Shelton carefully plans his remarks and makes crib notes of all the important points to cover, which he takes along to the meeting. The process helps him think out in advance all the key issues and identify any questions the audit committee members are likely to ask, he says. In the meeting itself, he applies what he calls his “20 second rule.” If a committee member asks for more information, and Shelton isn’t sure that he can lay his hands on it within 20 seconds, he will promise to supply it after the meeting. Shuffling through your papers trying to find something will hurt your credibility, he warns.

Suzanne Williams, CAE at telecommunications company Sprint Nextel Corp. in Overland Park, Kan., is another advocate of thorough presentation. She keeps formal presentations at audit committee meetings short and to the point, but she does produce detailed speaking notes for her own reference. “I keep them in my ‘back pocket’ in case I get asked for more information,” she says.

Williams has a pre-meeting with her audit committee chair, former WellPoint Inc. Chairman of the Board Larry Glasscock, at least four times a year to get feedback on the items that she plans to discuss at the full audit committee meeting. Glasscock sometimes will give her tips about how to present an issue in a way that will best engage the other committee members. “He’s like a bridge between me and the rest,” she says.

It’s important to make the most of any opportunities to communicate with the audit committee chair between meetings. But Overmyer advises caution: Don’t make contact just to remind the chair you exist or look for excuses to get in touch. “Artificial interaction comes across as artificial,” she says.

STAFF INTERACTION

Another way to build a relationship of mutual respect between the CAE and the audit committee is to create opportunities for the chair to talk directly to the internal audit staff. When Williams became CAE at her organization, she invited Glasscock to meet the rest of her team. Glasscock dropped by and talked to everyone on the team. He then asked them to write down their biggest challenge on a piece of paper and hand it back to him. He read the responses there and then — some of them aloud to the room.

Giving the audit staff a chance to speak straight to a board member was
worthwhile for Williams. Her team members didn’t raise any problems that she wasn’t already on top of, and they came away with genuine respect for the chair. “It was a home run for him,” she says. “It showed that he wanted the unvarnished perspective from auditors.”

Shelton also has invited his chair, Curtiss, to meet the audit shop. “He spent some real quality time with them and had a chance to get to know individual staff members,” Shelton says. “I wanted him to have a sense of who these people are and what their capabilities are.”

Curtiss says the exercise was extremely useful and is something he’d recommend to other audit committee chairs. He now makes an annual presentation to the audit shop; among other things, he uses the time to remind staff members how important their role is and how highly their work is valued by the business.

FEEDBACK SIGNALS

Every successful relationship is built on two-way communication; being willing to meet and talk to the audit team is just part of what audit committee chairs should do to keep up their side of the partnership, Curtiss says. “The CAE should request that the audit committee chair has at least some visibility to his or her staff and sets a clear tone from the top,” he says. “That should include an expectation that audit committee members will read their papers; will be skeptical, inquisitive, and engaging; and will ask a lot of good questions. If that’s not happening, then the CAE should ask what he or she is doing wrong.”

Audit committee members also need to be direct and candid about what kinds of communication they like and don’t like. “The CAE needs to know what’s important to them,” Shelton says. “The communication shouldn’t all be one-sided.”

But even when audit committee members are open about what they want from their CAE, the CAE should keep watch for other feedback signals — some of which may be unintended. “What really differentiates good from highly effective communicators is their ability to listen fully,” says Duncan Brodie, a former CAE who now advises other internal auditors through his U.K.-based coaching business, Goals and Achievements. “You can learn a lot by paying attention not just to what is being said but also to the body language,” he says. “You can often tell when the audit committee chair or members have heard enough as you notice their concentration going elsewhere.”

Brodie also stresses the importance of empathy: Asking the committee what it wants is one thing, but a great communicator will have the ability to “step into someone else’s shoes” and really see an issue from that person’s perspective. If the audit committee members seem bored by, or hostile to, what the CAE is saying, that might indicate a deeper lack of respect for the value of internal audit, he points out.

And if that is a problem, communication can be the best way to fix it. If the relationship is not as it should be, Overmyer advises going back to basics: Try to understand what’s important to the audience. “I’d think about what matters to them as individuals, what perception they have of my role and the contribution and capability of my function,” she says. “I’d ask, ‘How can I create and encourage a dialogue?’” The action needed to get the relationship back on track could range from a five-minute conversation at a coffee break to enlisting help from the CEO’s office.

PUT THE RELATIONSHIP IN CONTEXT

Curtis Verschoor has seen this issue from both sides. A former CAE and audit committee chair, he’s now an emeritus research professor in the School of Accountancy at DePaul University in Chicago. His advice is to communicate as well as possible, but to keep the relationship with the audit committee in context.

Providing oversight of internal audit may not necessarily be the audit committee’s most important role, and the committee is not necessarily internal audit’s most important stakeholder, he says. It’s often management — usually the chief financial officer — that controls the internal audit budget, hires and fires the CAE, and decides the function’s remit, despite what best governance practice might say. So the CAE should listen to what the audit committee wants, but his or her chief aim should be to “do a good job and be of value to the organization,” Verschoor says. “The CAE needs to be very sensitive about how best to do the important work that needs to be done,” he cautions. “Build the audit committee relationship from a position of strength; don’t try to do everything for everybody and end up doing it poorly.”

But perhaps it’s in those organizations that don’t follow governance best practice, where the CAE doesn’t have direct access to the audit committee chair, that exemplary communication skills are even more necessary. The CAE will need to persuade those higher up in the organization that internal audit’s voice must be heard, even if what it needs to say can sometimes be uncomfortable for senior executives to hear.

Wherever they sit in the organizational structure, and whatever relationship they have with their audit committee, Brodie advises CAEs to imbue their communications with honesty, sincerity, and authenticity. “Don’t ever try to be someone you are not,” he says. “You can still say the difficult things without compromising your own values, if you know what you stand for and act in accordance with those values.”

 

---

Great insights. How about communication with the institutions senior management. How can you influence their commitment to resolve audit issues....nothing is more frustrating than picking the same issues over and over agin.
Posted By: isabel Wanjohi
2011-11-07 7:00 AM

---

Stronger Partnership
Neil, Excellent article and right on point with the critical topics. Good insight from Audit Committee and CAEs. No easy task but great objectives to aspire to. Thanks, Michael
Posted By: Michael Gelormino
2011-11-05 10:09 AM

---

Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.

Name:

Email:

Subject:

Comment:

---

To make something bold:
<strong>Text to bold</strong>

To make something italic:
<em>Text to italicize</em>

To make a hyperlink:
<a href="URL">Text to link</a>

---