Today, whenever corporate fraud or scandal hits the headlines, no player is held harmless. Along with everyone else involved, internal auditors will be asked, "What did you know, and when did you know it?" Internal audit departments must continue to ask themselves how they can better help the organization maintain a healthy, ethical culture.
Several years ago, Farmers Insurance Internal Audit addressed that question by putting in place its Relationship Management process. This four-step cycle has enabled us to keep our fingers on the pulse of the company's culture by sitting down at regular intervals with the top leaders to review their visions, values, and strategies. The process has afforded the means of reassessing company risk and adjusting our audit plan to cover those risks timely.
Our relationship management cycle has played a big role in conforming to IIA Standard 2010: Planning, which states: "The chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization's goals."
As the diagram on page 63 shows, the relationship management cycle consists of:
Conducting periodic meetings with the top 150 leaders.
Reassessing risks based on those meetings.
Adjusting the audit schedule to meet the changing risk environment.
Updating the audit universe to ensure adequate coverage in all key areas.
Step one of the cycle--the relationship management meetings--is the engine that drives the other three steps in the process and is the focus of this article. The benefits of the meetings are multifold, as they enable us to:
* Promote a relationship of trust, mutual respect, and partnering between company leaders and internal audit.
* Systematically identify business strategies, objectives, initiatives, risks, and controls.
* Update our audit universe and schedules to reflect emerging risks and business needs.
* Grow our talent by having audit managers, and often auditors, participate in the meetings.
* Provide value and insight to our customers through these meetings and the projects that result from them.
For this process to work, relationship management owners must be adroit and capable. The owners are audit staff who are matched to company leaders based on their expertise, areas of specialty, and interests. Take, for example, an audit manager who specializes in underwriting. It makes sense to assign him as relationship management owner to the Underwriting...