To quote Marshall Goldsmith from his book What Got You Here Won’t Get You There, “Almost everyone I meet is successful because of doing a lot of things right, and almost everyone I meet is successful in spite of some behavior that defies common sense.” Being successful not only means doing things well, it means not making big mistakes.
Here are nine mistakes that are common in Internal Audit. There are many more, but these seem to be the most common and the most devastating. I’ve listed them, but not in any particular order.
Failure to manage/educate the audit committee and management
I see this as the paradox of high level business men – They know a lot, but they are dependent on those below them for details (especially new details). The members of the Audit Committee are busy and important, so we tend to limit what we share.
So, what information should we share with the Audit Committee?
The Audit Committee needs to know four things: 1) Your progress since the last reporting; 2) the significant issues identified during the period; 3) the status of significant issues identified in prior periods; and 4) any outstanding risks left to be addressed by management.
Not investing in training
Are you openly encouraging your staff to get additional certifications? Are you supporting them in getting their required CPE? Is that all you’re doing?
I’d like to quote Richard F. Chambers from Lessons Learned on the Audit Trail, “The average internal auditor receives roughly forty to eighty hours of formal training each year, which is not sufficient if you aspire to become a world-class internal auditor.” Then jumping ahead, “It’s not enough to be a continuous learner; we must also ensure we are learning the right things. Too many internal auditors concentrate on a narrow range of specialised knowledge, but to advance into internal audit management requires a deep understanding of a wide range of business and industry practices.”
Not developing soft skills
This may be the single most career limiting mistake internal auditors make. Most of us are introverts by nature. Soft skills don’t come easy.
Read the book How to Win Friends and Influence People by Dale Carnegie.
I always make sure I’m on a path to delegate more and as my team absorbs what I’ve given them, I look for more opportunities to leverage their skills. It is a dance of trust and growth, each feeding the other.
Not doing enough planning
Imagine a surgeon walking up with you lying on the gurney and he asks, “What are we working on today?” I know I wouldn’t want to be the one on the table.
Are you doing the same thing with your client? Engagement planning is such a critical part of the audit.
If the auditee knows the control is not effective, then the auditor shouldn’t be performing audit work. Instead, they should be performing a consulting engagement to help management get to the root cause. Don’t tell them what they know, help them fix it. This seems like a simple thing, but it takes slowing down and investing in planning.
If you’ve done proper planning, this is a lot easier, but it can still happen. Auditors will often flush out some rabbits. Many of those rabbits, we suspected we would find. But what happens when we flush out a big rabbit and it wasn’t on our plan?
At that point, you have three choices: 1) Ignore it (but not likely if the issue is big enough); 2) Scope it in (but only if it can be done within a reasonable budget tolerance); or 3) Document it and decide with the client where, when and how to address it.
Not getting and keeping client engagement
Here’s a question for you: When does an audit engagement end? Answer: Never.
If you’re only spending time with your client when you’re auditing that client, then you aren’t really engaged. Our clients have issues and risks to deal with each and every day. If you’ll stay top of mind, you’ll have more opportunities to add value.
Massive audit reports
Nobody enjoys reading audit reports. So, why would you write War and Peace?
While you might not be able to get to the meat of an issue with a Twitter post of 140 characters or less, you should ensure your findings are clear and concise.
Reports from the best audit departments start with an executive dashboard that gives a full overview in a single page. The detail is in the back of the report if the reader wants it, but they can get to the core issues on the first page or two.
Forgetting to add value
It seems counterintuitive. After all, adding value is a part of the definition of Internal Auditing. But many auditors can’t see the forest for the trees. They get stuck on the execution issues, and lose sight of the greater opportunity.
They look for the easy solution. For example, an auditor will conclude that an issue occurred because the staff were not properly trained and recommend training. Had they taken the time to do true root cause analysis, they may have come to see how the problem was something else entirely.
How many times have you started auditing an area and finding issues management already knew about? Did that work add value? Wouldn’t it make more sense to partner with management to ensure all of your invested time and effort are adding value?
Have you made some of these mistakes? What are you going to do to ensure you don’t make them going forward? Take some time to think about each of these. Then design systems that will allow you to avoid them.