More internal audit shops are treating auditees as customers, emphasizing service and value
By Karen Kroll
February 14, 2017
This is part one of a four-part series on how internal audit departments can benefit from a customer-service approach to auditing. See part two, Tell Us How We Did: More Internal Audit Departments Surveying Auditees.
By now, we've probably all heard as much as we care to about the need for internal audit to move from acting as a policing function to that of a trusted business partner. Indeed, many have moved in this direction during the last several years.
Now, some internal audit departments are looking to take the concept to the next level and treat the business units, functions, and process owners they audit as customers. They are ensuring not only that a thorough audit is completed that provides assurance and enables better decision-making, but that the auditees—now called customers—are happy with the audit work, face minimal disruption during the audit, and are treated with the care and concern typically reserved for paying customers.
While the customer service centric internal audit department isn't exactly new, more companies are using aspects of this approach. They are treating auditees with consideration for their schedules and concerns, inviting their input during the planning and scoping phases, looking for other ways in which their auditing skills can be an asset to the organization, and often taking on initiatives that fall outside the traditional scope of internal audit.
Taking a customer service approach can benefit both the internal audit and those audited. "I don't believe in being the bad guy, where you come in and tear them apart," says Barry Lucas, an internal auditor at DESCO Federal Credit Union in Portsmouth, Ohio. For instance, he'll ask the internal customers with whom he works which processes they'd like him to examine in addition to those scheduled for audits. Auditees who feel they've been treated fairly and considerately are more likely to come to the internal audit department with problems before they escalate, he says.
The growing focus on customer service is a shift, Lucas says. "When I first got into internal audit, it was more adversarial. Now, it's 'we're all in this boat together.'"
Substance over Form
If others see internal audit strictly as a "corporate cog there to enforce rules," the department tends to lose credibility, agrees Grant Ostler, director of financial compliance with Western Refining, an oil refiner and marketer headquartered in El Paso, Texas. Taking a more customer service approach, he says, can allow internal audit to shift focus from the form-over-substance approach of old—sometimes literally, he adds. That is, the auditors may zero in on forms that were filled out incorrectly. This tends to frustrate those in the departments being audited, notes Ostler. Just as important, the audit often fails to provide a greater service by watching for the more significant risks the company faces.
While internal audit might be known primarily for "ticking and tying," it can offer several other qualities valuable to the areas which it audits. One of internal audit's "secret sauces" is its understanding of processes, says Greg Grocholski, chief audit executive at SABIC, a diversified chemical company headquartered in Riyadh, Saudi Arabia. Internal auditors are unique among most employees in that they review processes and activities from end to end. "They should be more apt to connect the dots," he says. That can provide valuable insights for process owners that are looking to boost efficiency and streamline operations. The customer service focused internal audit department isn't just looking for problems, its looking for solutions. Another attribute: internal auditors are a step removed from operations. They may be better able to point out—tactfully, of course—where a process lacks controls or is inefficient, Lucas says.
Of course, even when internal audit professionals want to be of service, they're not guaranteed a warm welcome by other department heads. Some will assume the auditor is there to assign blame, Lucas notes. He lets them know he's there to be of service, and not to play the "gotcha game."
Customer Service Skills
To adopt a more customer service oriented approach, internal audit departments may find they need to boost skills that are required to treat auditees as customers, such as communication skills, diplomacy, and critical thinking. They also need to "know thy customer," which translates into an even greater need to know the business and industry. And, taking another page from the playbook of good customer service, they must excel at building relationships.
Developing strong relationships with leaders of operational units requires both behavioral and cognitive skills, says Glenn Sumners, director of the Center for Internal Auditing at Louisiana State University in Baton Rouge. The ability to work with others is critical, he says. At the same time, auditors need brainpower to uncover problems and shortcomings. And then they need communication skills to convincingly present their findings. "You can't be a trusted advisor unless you have good soft skills," he says. "Yet you also need to understand the business, its key performance indicators, and how it makes money."
These skills have to extend beyond the management level. Audit leaders need to foster a culture in which employees don't simply check a box, but approach other departments as clients or customers. They should want to work with others and understand how the company's operations work, Western Refining's Ostler says.
Tell Us How We Did
Another staple of customer service that is becoming more common in internal audit departments is the "how did we do?" survey, also known as a customer satisfaction survey or a post-audit exit interview. Such a survey can help internal audit departments hone their customer focus and improve their own processes.
Such feedback gathering surveys or interviews are becoming more common, says Gordon Braun, managing director of the internal audit and financial advisory practice with consulting firm Protiviti. These provide a mechanism for auditees to provide feedback on the process, the output, and the overall experience.
"Sometimes internal audit organizations rely too much on anecdotal feedback," Braun says. Skipping a more formal review process can be a missed opportunity for improvement.
The goal is to obtain thorough feedback on the performance of the team, says SABIC's Grocholski. Did the auditors appear knowledgeable and communicate well? Most importantly, did the audit team help the organization and add value?
To be sure, the feedback may need to be taken with a grain of salt, Grocholski notes. Few people enjoy being audited, no matter how considerate and service-oriented the auditor is. Even so, it's critical that auditors gain some idea of the value and relevance of their work.
Technology as Catalyst
Technology has helped drive some of the shift in internal audit, says Grocholski, who's also a past board chair of ISACA, an association for information systems audit, risk management, and governance. Along with boosting productivity, technology has brought new risks, like the ability of outsiders to illegally gain access to confidential corporate data. Internal auditors provide value to their organizations by identifying and examining these risks. "From an internal audit perspective, we need to determine how to factor these risks into our risk assessment," he says.
Another area in which internal audit can demonstrate its customer-service focus is the IT governance process. Auditors can assess the decision-making process management uses to determine which initiatives received funding, says Braun. "Time and time again IT initiatives get funded and ultimately are not successful," he says. Internal audit can help identify the people who should be involved in the decision-making process, check that the budget and timeline are reasonable, and ensure the transparency of the process. "You have to make sure that that process has the right set of rigor around it, and the right people plugged in," he says.
While IT and computer systems are a natural starting point for internal audit departments that are incorporating a customer service approach and looking at all areas in which they can add value, they're not the only ones. For instance, internal audit can work with departments that engage third parties, helping them ensure that their business partners are complying with the contracts in place. It even can work with marketing to develop a process for approving social media posts, to reduce the risk that a single poorly crafted post compromises the organizations' reputation.
What About Independence?
A common argument against internal audit taking a customer-service approach when working with other departments is the concern that it will compromise auditor independence and objectivity. If an auditor makes a recommendation a department later implements, how can the auditor independently examine it? Another question that might arise is: "If we're trying to treat auditees as customers, how do we report on things that we know they won't be happy about?"
Many say auditors can both serve their internal customers and remain objective. "You're monitoring risk," Grocholski says. "You start crossing line when you perform management functions."
Indeed, Lucas points out the trouble with not taking a more holistic, customer service view of the internal audit function: "If I know something doesn't work and I don't tell the operating units I'm being irresponsible."
So, while internal auditors need to remain experts in assessing controls and compliance, they also need to keep their eyes open for additional ways they can assist the organization. "Have a wide aperture," says Ed Williams, senior manager of risk advisory services at Experis Finance. "You never know what you'll stumble across."
Karen Kroll is a writer and editor based in Minneapolis, Minnesota.