All Things Internal Audit: Leading Small Audit Functions: Strategies for Success

00:00:02 Speaker 1

The Institute of Internal Auditors presents all things internal audit in this episode, George Barham talks with Martin Skip Langlois about the unique challenges and opportunities of small internal audit functions. They discussed definitions of a small function, advice for starting one, managing expectations, building relationships and developing.

00:00:24 Speaker 1

Future leaders in a small audit environment, Langley also shares insights on leveraging AI and why emotional intelligence matters as much as technical skills in a small audit environment.

00:00:38 Speaker 2

Hello, skip. Thanks for joining us today. Today's topic is on small audit functions. We're really pleased to have you today. Well, thanks a lot, George. Appreciate that. Yeah, absolutely. Look forward to to hearing your insights on small audit functions. And I have a little experience with small audit functions as well. So look, look forward to hearing your thoughts well.

00:00:56 Speaker 3

George, what would you define as a small audit?

00:00:58 Speaker 2

Function well I have worked for a small audit function that is one to three people, OK and I have worked for what I would say is probably the largest internal audit function that I'm aware of. Walmart.

00:01:10 Speaker 2

We had over 300 auditors, so I've seen kind of both ends of the scale so, but I guess for a a definition of small function maybe less than 10 something like that I guess how would you define?

00:01:21 Speaker 3

You.

00:01:22 Speaker 3

It. Yeah, George, you and I are in total agreement on that less than 10 like you. I actually started to internal audit departments, which is why we're talking about small internal audit.

00:01:31 Speaker 3

Departments where it was just me and what's really interesting is for the external review of our quality assurance improvement program, we did one when I only had two people.

00:01:42 Speaker 3

Which was very interesting. I don't think they've ever done one that small before.

00:01:47 Speaker 2

Yeah, the I guess the smallest one I worked for there were two of us and then we had a a part time person. We had an intern occasionally so, but yeah. So let's get into small audit functions. Maybe first question for you skip someone who is is starting a new internal audit.

00:01:52

OK.

00:02:03 Speaker 2

Function and they know it's going to be small. They don't have a lot of resources.

00:02:09 Speaker 2

Maybe it's just a a one person team. What advice would you give to them and and getting started? What would be some good practices, good approaches that that you would try to communicate to them for for starting a?

00:02:20 Speaker 3

New function. I think the first thing you got to do is you got to manage expectations because the expectation is that they're you're going to be able to do everything.

00:02:29 Speaker 3

At a Walmart, internal audit department can do and and and. That's not at all possible.

00:02:34 Speaker 3

And then the other thing I would say is you've got to have the respect and the what I call mirror authority of of the organization senior leadership team. So they brought you in for a reason. They said, hey, we need to have an internal audit function, but you don't want to be internal control eye candy.

00:02:54 Speaker 3

You want them to respect you. You want them to value you, and as a result of that, at a small audit function, you're going to be expected to what I would call play in the Gray areas. You're not independent. I don't care what anybody tells you, you're not ever going to be truly.

00:03:11 Speaker 3

Independent. And so you just need to make sure that you remain objective and you need to make sure that you're adding value to the organization, because if it's just you and inevitably you're going to make somebody mad at you because of something you found, you want them to respect that and not just say, well, this this individual, we don't want them anymore.

00:03:34 Speaker 3

That's one of the dangers you run into with a small audit function, but one of the advantages you have with a small outage function is your agility. You're able to, you know, turn on a dime and look at 1 area, look at another area, and then the last thing I would leave you with is.

00:03:48 Speaker 3

Find Co sourcing opportunities.

00:03:51 Speaker 3

Within the organization or, you know, have the authority to bring in outside assistance when you need to bring in guest auditors, there's people within the organization that may want to have a greater appreciation for what the how the organization operates and internal audit offers an ideal opportunity to see everything.

00:04:12 Speaker 3

From soup to nuts, entire view of the organization understanding of the.

00:04:16 Speaker 3

Risks. And if you can get management to realize that value and if you can get management to say, hey, I want my people to understand what's going on in internal audit, then you can leverage that to to to to provide you with the assistance that you need to have to be able to do your job. Yeah, I think that really speaks to building relationships, establishing.

00:04:37 Speaker 2

Credibility. You know, having folks within the organization get to know you some of your backgrounds, some of the things that maybe internal audits could assist with.

00:04:45 Speaker 2

Could you talk more about that? Could you talk about the relationship side, the credibility side? Just maybe some helpful tips for someone trying to kind of establish themselves as they establish the internal audit function as.

00:04:55 Speaker 3

Well-being in charge of an internal audit function, starting an internal audit function is a different skill set than being an auditor. You can be the best auditor in the world, but if you can't communicate.

00:05:06 Speaker 3

If you can't make your, you know your recommendations concise. If you can't address it to the audience, then you're not going to be able to add that value and you're going to basically make yourself, you know, somebody that they're not going to rely on, somebody that they're not going to respect.

00:05:22 Speaker 3

So you develop respect by providing a quality product and what I would say with respect to a quality product, it's we all have a tendency as internal auditors to document ourselves to an insane degree. And I understand why we need to do that from, you know.

00:05:42 Speaker 3

If somebody's relying on our work, but if you're communicating your audit results to management, if you're communicating your audit results to the board and audit committee.

00:05:54 Speaker 3

You need to address them to their audience. You need to address your your your findings to that audience. So you need to be concise. You need to be clear and you don't need to tell them how to build a clock. You just need to tell them.

00:06:06 Speaker 2

What time it is? OK. Good analogy. Yeah, kind of an extension of of that. What about identifying those key?

00:06:13 Speaker 2

Stakeholders and and key folks in the organization to start to have these discussions and start to understand their needs and their expectations. I mean obviously if there's an audit committee in place, probably the Chair of the Audit committee might be a good place to start. But if you think about more of the management.

00:06:28 Speaker 2

Side who are some key folks in the organization you'd recommend having those initial discussions with?

00:06:34 Speaker 3

Well, on a small audit function, you're probably working for a small company. Obviously the the the CEO, president is somebody that's going to be key. You're reporting relationship, you may report administratively to them and even if you don't report administratively.

00:06:49 Speaker 3

To them, you need to develop a relationship with them. You need to schedule an ongoing meeting with them. It could be initially, you know, once a week. Eventually you know, maybe going to once a month or something like that, CFO and whoever their direct report is, whether it's control or whatever.

00:07:07 Speaker 3

If you're in a heavily heavily regulated industry like I am, Chief Risk Officer, Chief Compliance Officer, General Counsel, very good relationship with human resources because the expectation is that eventually you may grow and you need to have that developed that relationship with them. And the other thing is.

00:07:27 Speaker 3

Human resources will give you a different perspective on something they are more in touch with the emotional intelligence side of things. We we don't have a real good emotional intelligence. Most of us because that's the nature of what we do. We don't attract that type of a.

00:07:43 Speaker 3

Person and so developing a relationship with them and then this is going to sound kind of strange, but developing a relationship with like the executive assistance, the individual that you know if you have restricted access into the building that lets you in in the morning, the janitor that you know that comes in and cleans your office.

00:08:03 Speaker 3

Is those are people that you would be surprised at the type of information that you can glean from just having a relationship with them?

00:08:11 Speaker 2

Yeah, that's an interesting point. Yeah, I agree.

00:08:13 Speaker 2

About the administrative folks, I mean they they see everyone coming and going and that's always a good person. I think to to develop that relationship with do you find skip that most smaller internal audit functions focused more heavily on financial reporting or would you say it's a mix or maybe less so on financial reporting, what what would you say?

00:08:34 Speaker 2

Is a typical, you know, focus of of effort for smaller functions.

00:08:38 Speaker 3

Well, it's going to depend on the organization and it's going to depend on the industry that you're in and it's also going to depend on the relationship that you have developed with your external auditor.

00:08:50 Speaker 3

If you've got a good relationship with the external auditors, and even when I was just a really small internal audit function, we were doing direct assistance work with them, we realized here's all of the things that they're doing. I don't need to look at that now and the insurance industry, we have something called the model audit rule, which we jokingly refer to as socks.

00:09:11 Speaker 3

Right. And so you should probably involve yourself in that in the socks review, but you don't want to become just the socks.

00:09:18 Speaker 3

Person and so I would say again depends on the industry financial industry, you're going to be spending a little bit more time looking at the financial stuff, but it's also as you develop these relationships with people, they're going to be hopefully at some point saying, hey, can you come in and help me with this? Can you provide me with some you know?

00:09:38 Speaker 3

Some consult.

00:09:40 Speaker 3

Seeing type of arrangement and the thing that people get concerned about, and I think that a lot of times, unfortunately we use this as a crutch. I can't do that because I'm not into it will affect my independence. And I've said this, I don't know how many times we are not independent because we work for the same organization. If the organization you know fails.

00:10:00 Speaker 3

Then we're going to lose a job just like everybody else.

00:10:02 Speaker 3

But we need to be objective. We need to be, you know, we need to have integrity and you develop that objectivity and you develop that integrity just by the fact of, you know, developing these relationships within your organization. But the other thing I would say from a from a small audit perspective is you got to have a network outside of the organ.

00:10:22 Speaker 3

Sensation. So join your local chapter of the AIA. If the IA doesn't have a chapter, then figure out a way to forward them one or you know, see if somebody some other professional organization has a local chapter and expand your knowledge outside of just internal audit. You know look at Isaac and ACF and I'd say those are.

00:10:42 Speaker 3

Or fairly closely related to what we do, but maybe professional organizations that are, you know your industry and if you have an issue with you know, public speaking then you know.

00:10:53 Speaker 3

Others go talk to them. If you've got things within your organization, associate resource groups or you know, something like that, that are bringing in individuals of, you know that, you know, want to discuss the the the issues that they're having. See if you can get involved with one of those. So you know, in my role, I'm I'm actually the executive sponsor.

00:11:13 Speaker 3

For the military and 1st responders Associate Resource Group because obviously I have a background in military but at the same time they want somebody with that visibility that can talk to, you know, senior management about it. And by doing this in a diff.

00:11:29 Speaker 3

Current role, you know you're not approaching them as an an auditor. Now you're approaching them as somebody that's trying to help them in a in a specific area. Again, you develop that that trust with management, you develop that, hey, this is somebody that is concerned about the overall welfare of the organization and somebody who we are going to be able to leverage to help us.

00:11:50 Speaker 3

If we run into something.

00:11:53 Speaker 2

Yeah, it it goes back to the relationship side, right, the the people.

00:11:57 Speaker 2

Absolutely. You're getting to know folks. So yeah, totally agree with you there. So skip, next question, how how would you suggest that a small internal audit function demonstrates the rationale for maybe expanding the function, maybe adding an additional professional to the?

00:12:15 Speaker 3

Department. Well, that goes back to the.

00:12:17 Speaker 3

The the value proposition if you can demonstrate that you're adding value, then what you can do is you can use that to support the addition of of an additional.

00:12:26 Speaker 3

Staff person. The other thing you can do is do the benchmarking. There is you've got peers in the industry and you can say, hey, you know this, this company has this many internal auditors. We only have one, you know, and maybe it's something that, you know, we ought to think about doing. It's getting the audit committee chair on board with it.

00:12:47 Speaker 3

But it's also not surprising the CFO and CEO, you don't want to go to the Audit committee chair and say, hey, I need additional people and you haven't talked to the CEO or the CFO about it. If they got on board.

00:12:57 Speaker 3

With it then.

00:12:57 Speaker 3

You know you're going to get it, but if they're not on board with it and you have to convince them of.

00:13:03 Speaker 3

That that's what you want to do because again, you don't want to put that. You don't want to damage that relationship that the CFO and the CEO has with your audit committee chair by, you know, holding it out there that you don't think you have enough enough resources on an annual basis. The audit committee should be asking you, do you feel like you are adequately, you know, staff, do you feel like you have adequate?

00:13:23 Speaker 3

Resources and a sufficient budget. And then the last thing I would say is if your organization is growing then by default you should be growing as well. So if the organization is doubled in size and it's still just one person.

00:13:39 Speaker 3

You know, you gotta say, hey, you know, we're twice as big as we used to be. And you know, conceptually, that means that we need 2 people where we only had one.

00:13:48 Speaker 2

Before, right. Great point. Let me change gears just a little bit on you skip recruiting and retaining top talent for smaller internal audit functions. Can you say a few words about tips or advice?

00:13:59 Speaker 3

For that we need to get away from looking for internal auditors that have an accounting background. I mean, almost everything we do now has an aspect of information technology.

00:14:12 Speaker 3

Or even more, you know, specific an aspect of information security. Now what I will tell you is finding an individual who is well versed in IT and is an auditor is something I call the flying purple Unicorn. There's not a lot of them out there.

00:14:31 Speaker 3

So you may have to have somebody that you bring in and you know organically develop that skill set. But you know, at the same time it's.

00:14:41 Speaker 3

Looking at the and and this is gonna you know, it's going to sound like you're flipping this on its head, but if you bring somebody in straight out of college, they probably already have that skill because of what they what they've had to do. If you want somebody to have that skill set you, you may need to think about. I don't want somebody who has experience.

00:15:01 Speaker 3

I want somebody fresh out of college and.

00:15:04 Speaker 3

Bring them in and somebody that's got an IT background. Somebody that's got a finance background, somebody that may have an HR background, somebody with a fine, you know, Fine Arts background, you know, because you can teach anybody how to audit, but you can't teach them to be creative. You can't teach them to be curious. That has to be something that they, that that occurs naturally.

00:15:24 Speaker 2

That, yeah, kind of a extension of that, that answer that you just gave. What about leveraging AI? I mean, that's something that's a very, you know, popular buzzword and you hear.

00:15:35 Speaker 2

You know, that talked a lot about what about for smaller functions as well. I mean I think there would be some opportunities for that, but could you speak about just?

00:15:42 Speaker 3

So absolutely, yeah. Artificial intelligence. You got to be careful, though that you're not using a software or an agent and you in using your your your private information in that. So when we develop an audit program, we'll use ChatGPT and we'll say, hey, we want an audit.

00:16:02 Speaker 3

Program on workers compensation claims handling and the system that they're using as a software that we use.

00:16:10 Speaker 3

And it'll spit something out and you take a look at that and you say, wow, I never thought of that one. And then you look at this one and you say, well, that one's kind of silly. I don't think we need to look at that, but it's that keeping that as Alison or Theresa said, keeping the human in the loop, looking at what's what, what's being spit out and saying, hey.

00:16:29 Speaker 3

Does this make sense? And but you're using it as a tool and you leverage that tool so that you don't have to have somebody who's, you know, scraping data and and putting it into an Excel spreadsheet and and trying to determine it the other way that we use artificial intelligence is in data analytics.

00:16:47 Speaker 3

And getting that data and you know the the we typically would look at 25 do a sample of 25 and then you know impute what that does to the entire population. But you develop credibility with management if you're able to look at the entire population and say hey, we found this issue and.

00:17:07 Speaker 3

The entire population, and here's what the dollar value or the reputational value, is of that issue that adds a lot of credibility.

00:17:15 Speaker 2

Skip, you mentioned that you were in the military. First of all, thanks for your service.

00:17:19 Speaker 2

What? What lessons or the experience that you had in the military, would you say you're able to bring forward and implement that in internal audits and and advice that you would give a small internal audit?

00:17:30 Speaker 3

Function. That's a really good question, George. And what I would say is when you're in the military, you are given an opportunity to exhibit or to engage in leadership.

00:17:39 Speaker 3

At a very young.

00:17:41 Speaker 3

Point in your career, I was a commanding officer of a patrol boat, 82 foot patrol boat, Newport Beach went California when I was 30 years old. I got an opportunity to do that again for 110 foot patrol boat in Seward, AK. But when I first graduated from the Coast Guard Academy, I was put in charge of a department and the expectation.

00:18:01 Speaker 3

Was is that you know, I was going to lead that department. And you know, if something happened that I was going to be able to step up and and go up to A to to a larger role within the within the organization. So it's that opportunity to get the leadership at an early point in your career that has really served me well.

00:18:20 Speaker 3

And I learned a couple of hard lessons while I was in the military. One of the first ones was hubris. I developed that, you know, you're in a position. You're in charge of this ship, and oh, my God, you know, you feel like you're walking on water and, you know, reality hits you in the face and you realize, you know, you're not.

00:18:40 Speaker 3

You're not performing to the level that you're that your boss expects you to.

00:18:45 Speaker 3

And so that's a hard lesson to learn. But you learn it early in your career and you know that's that's what's very beneficial. So how do you equate? How do you do something like that to somebody that doesn't have that military experience? And it goes back to the, the, the development aspect of, you know, your staff and it's getting them involved in things where they are.

00:19:04 Speaker 3

Able to exercise their nascent leadership capabilities in a very low threat environment. Get them involved with the local chapter of the CIA or some other professional organization. If that's not available, see if there's some sort of a group within the company itself. Not that they can get involved with, and if that's not available, tell.

00:19:25 Speaker 3

You know, join a homeowners association if you got a house somewhere, get on the board of your church, get on the board of your synagogue, get on the board of something and that way, you know, as a volunteer you can develop those skills and those will serve you very well in the.

00:19:42 Speaker 3

Future.

00:19:44 Speaker 2

OK.

00:19:45 Speaker 2

Skip, that's all I have for you today. Thank you so much. Really appreciate.

00:19:48 Speaker 3

Your time. Ohh. You're welcome. Awesome. Nice talking to you and I I really enjoyed this. Thank you very much.

00:19:56 Speaker 1

Small internal audit teams boost your efficiency at the 2025 audit sphere. This one day virtual conference on June 17th offers expert strategies and practical tools just for you. Register now at the dia.org.

00:20:12 Speaker 1

If you like this podcast, please subscribe and rate us. You can subscribe wherever you get your podcasts. You can also catch other episodes on YouTube or at the iaa.org that's theia.org.