Internal audit: The importance of being “soft”

Internal auditors were once thought of solely as the go-to guys for all issues relating to financial controls and governance. After all, just a decade ago their world revolved around meeting compliance requirements spelled out in the Sarbanes-Oxley Act in the US or other internal controls requirements spreading around the rest of the world.

But today, in the wake of the global financial crisis, internal audit’s remit has expanded. Increasingly, the function is relied upon to identify operational risks and provide strategic insight on everything from mergers and acquisitions to IT system implementations.

Indeed, 75% of C-suite executives believe risk management is where internal audit can have a positive effect on long-term earnings and performance, according to Ernst & Young’s study The Future of Internal Audit Is Now.

As the role of the internal audit function has evolved in recent years, so too have communication channels – and not just with executives.

“A lot of [boards] have begun to realise that internal audit can be very effective in helping them understand what goes on when they are not there,” said Richard Chambers, chief executive of the Institute of Internal Auditors (IIA). “Another thing I have noticed is that audit committees are looking to internal auditors to help avoid surprises. Internal auditors must monitor not only traditional risks, but also emerging risks – things that nobody might have on their radar. We have to understand the geopolitical and economic risks that our enterprises face.”

And so the skills needed to do the job are expanding, too. An analytical mind-set and critical thinking were the most sought-after skills for new internal auditors in all regions in the past year, according to an IIA study, The Pulse of the Profession, which found operational risk to be the top priority for shareholders and internal audit agendas.

Better communication skills are also in demand. Being able to get across the right message can be the difference between internal audit playing a largely reactive, assurance-based role or being a proactive business adviser – where real value can be added.

The internal communicator

In the late 1990s and early 2000s, audit committees didn’t place much emphasis on internal audit, despite often having oversight responsibility. But from the late 2000s, pressure began to build on boards and, by extension, audit committees, because of tougher public and regulatory scrutiny in the wake of the global financial crisis.

Richard Fowler, a senior audit specialist at US Navy shipbuilder Huntington Ingalls Industries, said audit committees are more involved with the audit planning and “are more engaged in what the results are and how we are progressing than in the past.”

Audit committees are important to internal audit teams because they are often a chief audit executive’s boss and are considered primary stakeholders.

At the Roswell Park Cancer Institute in the US, for example, the internal audit function reports directly to the audit committee and board, according to internal audit and advisory services manager Deborah Kassirer, CPA, CGMA.

“This reporting line provides the most independence possible for the function, increases the sense of credibility by line employees and their willingness to candidly speak to internal audit,” she said. “And it reduces that chance for management perceived or actual interference with audits and results.”

Aside from senior management and audit committees, internal auditors need to manage relationships with operations executives, finance teams and external auditors, amongst others. This has made communication skills and how to properly nurture relationships an important part of the internal audit tool kit.

Different folks, different strokes

The internal audit profession has placed greater emphasis on professionals to learn soft skills – such as communicating, building relationships, negotiating – for several years. But every communication channel, whether it is with senior managers or audit committees, requires a different strategy.

“When you are with managers, you are in persuasive mode, communicating with them in order to persuade them to do something,” said Phil Tarling, vice president of the Internal Audit Centre of Excellence at telecom equipment-maker Huawei Technologies. “When you are with the audit committee, you are more in an explaining mode – what is happening, what has gone on and how do we get to the end results.”

An important part of effective communication, regardless of the target, is being able to display an understanding of the business.

Chambers said, “For example, if I am going to try to build and sustain any relationship with the CIO, I’d better have some understanding of the IT environment, IT issues and challenges. I need to sit down and talk to him or her about things like cloud-computing risk. So you have to build credibility.”

Showing empathy is another often overlooked trait. “Having the ability to put yourself in the shoes of the people you are auditing and develop empathy for the issues and challenges they face can make you so much more effective,” Chambers said.

Soft skills matter

A fundamental part of an internal auditor’s role is to conduct interviews for assessments and write reports. Fowler believes that too many auditors “seem to rely on a set of prepared questions and do very little digging into the responses they receive.”

“Interviewing is a trainable skill, but other than those auditors who are also trained in fraud detection and investigation, there are few who receive training in interviewing techniques,” Fowler said.

Too few audit managers and directors within business think soft skills training is worth the expense, Fowler said, noting that he had to pay for his own lessons. The tragedy of such a short-sighted approach to soft-skills training is that effective communications can drive efficiencies and save organisations money.

Carolyn Dittmeier, CPA, is the chief audit executive of Italy’s postal service, Poste Italiane, and has first-hand experience of how effective communication can help internal audit bring about positive change.

At Poste Italiane, “internal audit pushed on certain areas of information technology, both in terms of efficiency and security, such as the fact that certain areas were manual and should be automated. And they pushed, and pushed, and pushed in the right way, and little by little they saw it change, and the IT area improved,” said Dittmeier, who manages more than 400 auditors. “That was the advisory part, and then the audit committee and senior management see change that wouldn’t have happened, or wouldn’t have happened as quickly, if it hadn’t been for internal audit. It’s this play between making sure things change by convincing in the right way that’s important.”

In E&Y’s report The Future of Internal Audit Is Now, respondents noted that improving risk assessment, enhancing the ability to monitor emerging risks and becoming more relevant to business objectives were the priority areas for improvement.

As the function of an internal auditor evolves more into a risk-management and business advisory role, being able to communicate effectively with a range of business functions will be an important tool for internal audit to remain relevant in the future.

Four “soft” communication tips:

Be right or be liked?: Sometimes, when auditors have to deliver bad news, they need to be prepared for an angry response or two.

The IIA’s Chambers wrote in a recent blog post that clients need time to cool off when first presented with negative information. The measure of an auditor’s talent in this regard is how he or she responds to the situation, where anger might be followed by denial. As long as the information is delivered fairly and accurately, Chambers wrote, auditors are in the clear. “Our reputations as auditors depend upon our ability to present the situation in a balanced way that neither overexaggerates nor understates risks and possible consequences,” Chambers wrote. An auditor might have to choose between being right and being liked. Being right, Chambers said, is the only ethical choice.

Listen and learn: What type of listening do you use in internal auditing? How do you evaluate all that you’ve heard? The IIA lists three types of listening that can be applied to internal audit work.

“Comprehensive listening” is the most difficult, as the listener is trying to take in everything the speaker is putting out: words, tone of voice, body language. Often, comprehensive listening cannot occur early on in a new audit, because the auditor does not yet know enough to take in all the material. “Critical listening” involves forming opinions about what is being said, making inferences and separating fact from opinion. “Relationship listening” is about getting to know the speaker instead of simply hearing the speaker’s words, understanding the person instead of understanding the message. This is the sort of listening that helps build rapport.

Know your listening style: The IIA also details the ways in which people listen. A good auditor should be able to apply a variety of listening styles depending on the situation. The IIA points out that understanding the listening styles of others can help you deliver messages better.

“People listeners” show concern for others’ feelings; they can exhibit empathy. “Action listeners” are focused on the actual words, especially the content that is action-oriented. “Content listeners” take their time digesting material, valuing information that is complex. As opposed to action listeners, content listeners will be more likely to take into account the opinion of the speaker. “Time listeners” are the watch-tappers; they value only the most basic and vital information. This is a style that would seem to have a negative effect on speakers, but time listeners tend to excel at time management and can keep speakers on task.

How to influence people: An auditor might be respected for being punctual, accurate and fair in delivering news, but can the auditor win people over? The approach taken depends on the context: Is an appeal to a client’s emotions in order? Or is the direct approach best? The IIA writes about influence and negotiation as critical skills: “Influence refers to internal audit’s overall standing in the organisation, as well as individuals’ abilities to persuade or inspire others.”

The IIA lists four components for influencing people. Social skills include the ability to relate to people in a variety of situations. Information skills entail the ability to focus on and analyse the key data and deliver it in the most relevant format. Listening skills have been addressed above. Judgement is knowing when to apply a hammer or a feather to a problem. If you know the chief executive is swamped by meetings all day on Mondays, it’s best to schedule another day to deliver major news.