Your Internal Audit questions answered

You Ask. We Answer.

Responses to your questions from our conversation on the future of internal audit.

In our live discussion with Chief Audit Executives Jim Enstrom from Cboe Global Markets and Steve Brown from Booz Allen Hamilton, our conversation focused on the future of internal audit, but covered various elements including how much audit plans should align to strategic business initiatives, whether outsourcing audit activities would continue, the value in adding audit management software now, whether internal auditors will soon become educators, and how our physical workspace will evolve post-pandemic.

Questions from the audience varied just as much as our discussion, so we answered those submitted to keep the conversation going. If you missed the live conversation, go back and view the How Internal Audit Adjusts for the Next Normal recording.

Q: What are you doing to enhance the value of the internal audit function in the new “normal”?

A: Flexibility is the key to internal audit adding value to the enterprise. That flexibility means internal audit teams need the ability to get uncomfortable in their surroundings, yet comfortable in sharing their opinions without getting bogged down in hundreds of hours of fieldwork.

Everyone’s yearly audit plans are out the door at this point, which means you need to shift to smaller audits that are hyper-focused on specific elements such as cash management or subsets of controls, for example. This opens the door to real-time monitoring of your organization and moves away from the static “let’s go do an audit” approach.

So, internal audit is primarily adding value by remaining flexible and ensure that they remain focused on the areas of the business that have the biggest impact (e.g. focusing audit resources and attention on emerging risks or opportunities and protecting the assets that are most essential to the business). They can also provide value by taking the perspective gained through their unique position with the organization to proactively share knowledge and insights with those in the business who may not have the benefit of having this broad viewpoint.

Q: What’s the best way to handle management push back while continuing to conduct audits?

A: We’re all trying to learn together ─ none of us has lived through or lead a business during a pandemic, but boards and senior management are placing expectations on internal audit to understand the current risks and addressing them going forward.

In terms of managing stakeholder expectations, continue to adapt and be responsive to the new environment. Since many traditional ideas about long-term planning have gone out the door, position yourself to be adaptive in thinking about your risk assessments and how you conduct audits. Look for ways to make those processes more agile and share recommended changes to management, along with the anticipated value. Bring your ideas to the table to demonstrate to management your ability to lead during this time. They’ll thank you for helping to think through challenges and alleviate some of their own stress.

Q: How are you coping with managing your teams in a social distancing environment?

A: Conduct weekly 1-on-1 check-ins with each team member and host over a video call so you can see one another’s faces and have the ability to read body language and demeanor. Your conversations should cover updates on work activities to understand where your team might be struggling so you can identify how to best help. But don’t stop there! Ask about how they’re feeling during this period of working remotely and learn about how they are coping. Have they picked up a new hobby or skill? As Jim Enstrom mentioned in our internal audit conversation, remote working has allowed him to build stronger relationships with some of his team members that would not have otherwise blossomed in a physical working environment.

At Onspring, we’ve been hosting virtual happy hours that include games, breakout rooms using Zoom features, and virtual background themes. As awkward as that may sound, they provide a convenient way to conduct social interaction in a safe environment. And with the use of virtual backgrounds, these happy hours not only let us see new sides of our team members but also led to pop quizzes on movies from the ‘80s. While local virtual happy hours might not last forever, we predict they’ll continue to stick around for global teams.

In addition, we are actively reaching out to clients to schedule virtual coffee sessions where we can help those clients troubleshoot any issues they are having or simply have a personal conversation. These could prove to be meaningful ways for you to connect as a department as well as maintain that level of trust and cooperation with others in the business.

Q: How can we keep enhancing internal audit maturity?

A: Colleagues in your organization are looking for stability. The stress felt in moving from office to virtual and the difficulty of separating home and office causes a fatigue in everyone. That fatigue makes radical change difficult for individuals and for organizations.

Don’t make radical change your focus right now. Focus on your people – start here. Know what is going on in one another’s lives and let people know it’s ok to step away from the desk at home to go for a walk. This isn’t the time to rock the boat, this is the time to provide stability.

That said, this could also be seen as a good time to identify small but meaningful advancements in how you conduct your activities – for example, using downtime to formalize and refresh Internal Audit policies and practice guidelines, evaluate and clean data in your audit management solution or pursue individual and team training opportunities are all ways to make incremental gains towards a higher level of maturity.

Q: How can Internal Audit help, if not involved in decisions?

A: The role of internal audit becomes an advisor in the future, as the internal audit function has a full purview of the enterprise and can connect dots between risks, departments, and macro-economic factors.

Change your perspective on when internal audit contributes – it should no longer be only at the completion of an audit to present findings, but at the beginning of new and throughout current initiatives. Take your findings from historical audits and use those as lessons to guide new ideas and strategic initiatives through share-outs, presentations, updates to other teams in the organization.

You might not have to go so far as to put together an ‘internal audit company newsletter’ but make sure you let other teams know what results have come from your findings and the implications to your organization. When possible, keep your updates to other teams in their language so they understand how they need to think about future projects, initiatives, or updates.

Q: How to retain reduced travel and not lose the increased productivity and significant expense reduction from less travel.

A: We think this question is asking, “how do we continue working from home to stay productive and reduce costs?” You might not have to do too much to keep the current momentum. As Steve Brown mentioned in our internal audit conversation, we will likely not go back to full-time working in an office.

The key to making this work for you long-term is to stay visible. Make sure you communicate with your team and superiors frequently and using the formats they prefer (e.g. email, phone, video call, etc.). When you’re out of sight, you can become out of mind, so continue to check in with others regarding what you’re working on, where you need their advice, and what you have coming up. And as you do this, remain focused on the outcomes you are producing – if you can clearly demonstrate that you are completing work in an efficient and competent manner, you will have a stronger justification for maintaining the time and cost savings you are currently realizing.

For many, this extended working from home experience has enabled the concentration and convenience needed to deliver unprecedented amounts of productivity. This newfound freedom has also given employees the flexibility to work at the hours and locations that best suit them. Not all of us are early birds and everyone could benefit from a 15-minute afternoon power nap, right?

See how others responded when asked about their return to work plans.

Q: How best to leverage Onspring?

A: Internal audit teams should think about Onspring as a platform to connect their efforts to the rest of the enterprise by means of aligning audit plans to the most significant risks and organizational objectives and driving accountability into the business for issue mitigation.

Think of the myriad tasks that go into an audit – the collection of documents, the assigning of tasks, the review of policies against controls, findings compilation, confirmation issues are resolved. Some steps are concurrent, while others waterfall. The smartest way to leverage Onspring is to utilize the automation functionality to manage workpapers, findings, review notes, milestones, and project status, and create real-time reports that feed into dashboards by level. So your audit projects can have customized dashboards that fit their needs, while you serve separate dashboards to the executive team that call-out major findings and risk prioritization.

Read more benefits of audit management software, or if you’re interested in seeing how to best leverage Onspring for your own team, reach out to us.

Q: Would like to learn about the data visualization features for Internal Audit.

A: The data visualization features of Onspring enable you to graphically represent any data record captured and demonstrate relationships with other records in your enterprise, such as risks, financial values, likelihoods, correlated audit findings, and more.

Data can be displayed in heat maps, with Gantt charts, pie, bar, line, and bubble charts. Data displayed in individual reports can be aggregated and organized to display as dashboards unique to users. And with a click, you can reveal underlying data sets with each data point displayed, so you can drill down into the details straight from a dashboard.

Q: How we can assess business continuity during COVID-19 as customers are closed and there is no idea about the end of the pandemic?

A: Lean on your business continuity team to activate tasks in your organization’s plan that surveys vendors and customers. In those surveys ask for likelihoods and projections on future activities and avoid asking for black and white answers (because they don’t know the answers).

Use the inputs from these surveys along with your risk assessment inputs to create scenarios for your business. These scenarios will be fluid as the situation continues to change, but at a minimum provides options based on data that your business can make decisions against.

Read best practices for business continuity planning during the coronavirus pandemic.

Hear the full story.

Replay the webinar to hear what Chief Audit Executives from Cboe Global Markets and Booz Allen Hamilton had to say about internal audit’s next normal.

Internal Audit Discussion

Go a level deeper.

Check out more lessons from a former auditor that explains why internal audit is well positioned to lead by example.

Lessons from a former internal auditor