What information does the audit committee want from the CAE?
LINDSTROM First and foremost, the audit committee is looking for information, not data! CAEs should think about the top three to five "takeaways" they would like their directors to get from the audit committee meetings. The CAE also should ask the committee what its area of focus is, so the CAE can avoid guessing and instead concentrate on building a good relationship with the members. Potential areas of audit committee interest include: risk assessment results and trends; internal audit plan coverage and progress; audit results and trends; and remediation status and trends. I purposely repeat "trends," because this is internal audit's opportunity to provide information, not just data, by connecting the dots. An audit committee mantra may well be, "Tell me what I don't already know."
JOHNSON Questions audit committee members want answered include: What's the state of the union for the organization in light of our charge as audit committee? What's going well? What's not? Why? Are there any concerns we haven't asked about? If the organization is experiencing significant or unexpected change, what is internal audit's role in understanding the changing risks and how they're being managed? What should we be thinking about next? What are the issues the CAE is most focused on?
How do audit committees want that information presented?
JOHNSON Different committees want different levels of detail. Some are very detail oriented, while others are comfortable with a summarized reporting approach. The CAE should have an open dialogue with the audit committee and tailor presentations to the members.
LINDSTROM CAEs can make the audit committee's risk-oversight role easier with their presentation format. The CAE should start by considering the audit committee's expectations, its communication style, and the frequency of its meetings. Does it prefer a pre-read or a presentation? How much time has been allotted to the CAE on the agenda? Audit committee presentation materials should be visually appealing--verbiage or data-intensive presentations can lose the audience. Content should report on results and trends, not activities. Internal audit can effectively communicate department performance through the use of dashboards, metrics, and benchmarking.
What don't audit committees want to see from the CAE?
LINDSTROM Committees don't want to see an audit plan that is not aligned, or relevant, to the...