Having a sound relationship with the board is crucial if internal audit functions are to serve their organizations well and provide effective assurance. Whether chief audit executives (CAEs) report directly to the board or, more likely, to an audit committee, it is vital that the two sides share an informed understanding of internal audit and its role and purpose within the organization. That is why educating the board about the level and nature of assurance internal audit provides is an important part of any CAE's role.
While that is an easy principle to grasp, achieving it in practice can be a difficult and prolonged journey for both sides. Explaining what internal audit can do and how the function should be positioned in the business is likely to be unhelpful, unless it is done in the context of the board's real-life needs. "CAEs should be thinking about putting themselves in the shoes of the board members, and understanding what is on their agenda and why," says Ninette Caruso, CAE at Discover Financial Services in Riverwoods, Ill. Boards are more likely to be concerned with business issues such as profitable growth, dealing with competitors, net profits, and complying with pressing regulatory issues. If internal audit is not engaged in those areas, trying to educate the board about assurance is likely to feel too abstract and disconnected from the business.
As internal audit begins to provide specific value and advice to the board in those parts of the business where it has genuine concerns, Caruso says it will be effectively educating the board about what true risk-based internal audit means to the organization by demonstrating the type and level of assurance it can provide. In doing so, internal audit will be greatly appreciated and recognized for it.
"Let's try to understand where the board is coming from and not waste time trying to add value to, say, a compliance audit if the board is not really interested in that area," Caruso says. "Instead, the internal audit function needs to focus on perhaps two main issues on the board's agenda at that particular point in time and to put all of its efforts into those areas."
Getting issues onto the board's agenda that internal audit feels are important, but the board does not, can be more challenging. Caruso says it demands a level of storytelling that auditors are not often used to about what they have found and why that matters to the organization.
"Even if the board only wants internal audit to check the controls put in place by management and risk functions, internal audit can still play an educating role by standing back and looking at themes that emerge from the interaction between different parts of the business," Caruso says. "Nobody may want that from internal audit until we bring it to them and they can see the value of it firsthand."
A CLEAR UNDERSTANDING
Louis Cooper, chief...