Help your audit committee to help you

How to help your audit committee help you

I believe that a key factor to an effective and respected internal audit function, is having an engaged and proactive audit committee that understands the role and value of internal audit and sets the tone for a culture that uses assurance to drive business improvement. As an audit committee raises its expectations of internal audit, it creates space and encouragement for the business to do the same, and for internal audit to step into that space to deliver.

 
Every business, internal audit team, and audit committee is different. The following ideas reflect some of the challenges I have seen in the past 18 months.

1.  Talk to the committee about quality

During external quality assessments, it is surprising how many audit committees and heads of internal audit have only had cursory discussions about internal audit quality: the annual statement about conforming with internal auditing standards; reporting to the committee the plans for an external assessment; perhaps some notes around new publications such as the IIA's Code of Practice. I think that some audit committees' views of what they should do regarding internal audit effectiveness and quality can be constrained by dry wording in their own terms of reference, but also by the slightly dull expectations in some of those self-assessment checklists that audit committees tend to use and revisit each year.

So, my first tip is to talk to the committee about internal audit quality. What does internal audit quality mean to you, and to the committee? Do these views diverge, and why? What are the committees expectations for internal audit, and if you think they are low, or a little generic, what expectations do you think the committee should have of your function?

Make sure that the committee is an active participant in, and sponsor of, your external assessment when you plan for one. What are the qualitative factors that are not picked up through your regular KPI reporting to the committee on internal audit performance that would help encourage those discussions?

2.  Have a business plan for internal audit

When you talk to your audit committee about an internal audit strategy, do you mean a high level outline plan for internal audit coverage for three years, or a business plan for the function setting out a vision for the coming years and how you will get there? I encourage you to develop the latter, and of course to tie it in with the organisation's business plan and strategy.

Not only does this road map demonstrate how your team is aligned to the priorities of the business, it can help focus on the skills and tools that you will need in the future, and encourage discussions about investment in team and function.

3.  Pick up the ‘phone

A surprising number of HIAs and audit committee chairs don’t have much, if any, contact between formal committee meetings until there is something major to discuss or a crisis in the business. It is probably the topic for a separate article to investigate why this is the case.

Emails are OK, but nothing builds a relationship like speaking to someone. So pick up the phone, book in regular catch-ups, and use these informal discussions to talk around the wider business and the work of internal audit, not just the content that will be in your formal progress report at the next meeting.

4.  Get the committee involved

Does the audit committee know the wider internal audit team, or is their view of the function all about the head of internal audit? Regardless of the size of your team, it's really useful for committee members and the audit team members to get to know each other. Perhaps someone from the committee could present at an internal audit team meeting, or answer questions from the team. How many times have you changed the executive summary for an audit report to make sure it was properly pitched for senior stakeholders such as the audit committee? Regular communication and interaction between the committee and the internal audit team should help embed this understanding for internal auditors.

There's a more formal opportunity here too for audit committee involvement. Recently I have worked with a few audit committees who feel that the internal audit plan is a done deal by the time it comes to committee; the executive team has agreed the plan in principle with the HIA, and it seems as though there is little scope for the committee to make significant changes. Building time in to the committee's annual programme to look ahead and gain their views on emerging issues, risk profile and audit priorities can strengthen working relationships between the committee, internal audit, and management. As more internal audit teams move to a more flexible rolling audit plan, these existing discussions are vital to an effective and responsive plan.

5.  Support training and development for audit committee members

Last but not least, remember that audit committee members need continual development and training just like everyone else. There will be aspects of the business that are obviously important, but HIAs may be in a great position to identify areas where the committee may benefit from training or a briefing, and can provide some of that insight and knowledge transfer themselves.