NOTE: This is part three of a four-part series on treating auditees as customers. See part one, The Customer Service Oriented Internal Audit Department, and part two, Tell Us How We Did: More Internal Audit Departments Surveying Auditees.
First-rate internal audit departments are working to foster better relationships and achieve smoother audits by treating process owners and others in the functions and departments they audit more like customers. For the strategy to work, they must ensure that internal auditors in the field—those staffers and audit seniors who interact most with auditees—are prepared and empowered to act as customer service agents.
So, how does an auditor working in the field take a customer service approach? While some practices stem from common sense and courtesy—treating auditees with respect and working within their schedules to the extent possible—many internal audit departments extend their customer service approach beyond this. They're partnering with auditees to identify and explore areas of concern, developing recommendations to improve processes, and jointly presenting problems to those in management who can act to correct them.
One of the things internal auditors can change right away is doing a better job of explaining why they are there. Simply outlining the steps of the audit process helps audit customer arrange their schedules, but doesn't explain why an area was targeted for an audit, notes Jaimie Yang, senior internal auditor at CEC Entertainment. At the beginning of an audit, she sits down with process owners to discuss the risk factors that were considered during the risk assessment process to give them a better idea of why the area is being audited. Then she explains that the audit will review policies, procedures, regulations, and best practices. "Educating an auditee can help detract from the 'gotcha' attitude because we provide a rational reason for what we are doing," she says.
Keeping Audit Customers in the Know
Customers never want to be in the dark, so communication is vital, say internal audit managers. "In everything we do in the audit process, we prioritize clear, consistent, and open communication," says Brian Rourke, an internal audit manager at Analog Devices. At least eight weeks before field work begins, for example, Rourke's department holds introductory meetings with the process owners to confirm the timing of document requests, walkthroughs, and the audit report, among other steps. "We put it all on the table," Rourke says.
Six to seven weeks before the audit, the team schedules a pre-planning meeting. The first day of the audit includes a kick-off meeting. During field work, Rourke and his team schedule weekly status meetings. The more information the audit customers have, the more comfortable they are with the audit and the more likely they are to cooperate and remain open to the audit process.
All formal meetings are scheduled one to two weeks in advance, with a detailed agenda. "We never like to go into meetings blindly," Rourke notes. In addition, all internal auditors at Analog Devices use a standard communication format. The uniform materials make it easy for auditees to understand the documents.
Along with communicating the details, auditors also need to be skilled listeners and watch for words or actions, such as an individual freezing up or looking confused, that indicate concern or the need for more information," says Stephanie Gray, senior manager, business assurance services at SRI International. "Most people in their first interaction with an auditor are going to be somewhat nervous," Gray says. "Ask, 'is this something that worries you?' "
Taking a customer service approach on the front lines of an audit also involves being more personable and relating to individuals in a caring way. Taking a genuine interest in the person can put auditees at ease and establish a good rapport with those working on the other side of an audit. When working with someone new, look for something you can relate to or ask about, such as a diploma on the wall or pictures of loved ones. "Take a moment to get to know them," Gray says.
Like a Boy Scout, Be Prepared
Another way to provide better service to audit customers is to adopt the motto of the Boy Scouts, and "Be Prepared." Auditees who hear a vague "tell me about your process" often assume they're going to have to train the auditors on their department, says Pauline Sevigny, senior vice president of internal audit administration at financial services firm Brown Brothers Harriman. "Read the prior audit work papers and talk to the audit managers so you can ask smart, pointed questions," she says.
Internal auditors also should collect any presentations, written policies or procedures, or employee training they can review ahead of time, says Maggie Berkeley, director, risk advisory services at RSM. And they should pursue as much of this information independently on company intranets and databases themselves. Not only can the information trigger questions relevant to the audit, but it minimizes the time auditees must spend providing information that's already available elsewhere.
Most audits are going to disrupt the auditees' work days to some extent. To minimize this, Jennifer Cunningham, integrated project manager at Raytheon, adjusts her work schedule, so all phone calls occur during auditees' working hours, no matter in what time zone she resides. She also asks auditees what "minimizing disruption" means to them. Some might want meetings scheduled far in advance; for others, it's critical that meetings start and end on time.
Sevigny cautions against sending long emails with numerous questions and requests or continually calling an auditee with one or two questions. Emails can be misinterpreted, and a barrage of calls is inefficient. Instead, note the questions and arrange meetings at regular intervals to address them, she says. Face-to-face conversations are an efficient way to resolve questions and work through issues. They also help build relationships, she adds.
Auditors who learn to pull data and run reports themselves, when feasible, help customers and add value. They reduce the demands made on auditees for information. In addition, "the audit shop is able to do more analysis because they pull their own data," says Yang, who learned SQL so she could gather her own data more easily.
Bridging Process Gaps
Treating auditees as customers also encompasses adding value to both the auditees' department and the organization as a whole. A starting point is inquiring about process shortcomings or gaps—what are often referred to as "pain points."
For instance, breakdowns or inefficiencies often accompany the hand-off of a function from one department to another, says Maureen O'Connor Pearson, internal audit integrated project manager at Raytheon. Because audits themselves touch multiple functions, the audit team usually is in a position to recommend improvements. When bringing on a new supplier, for example, one department typically conducts the due diligence and compliance review, and the purchasing department must wait until that's complete before it can onboard the supplier. The internal audit team can recommend ways for the purchasing department to monitor compliance activities and become involved earlier in the process. "We can take some of the pain out," O'Connor Pearson says.
The internal audit team can also ask auditees about process inefficiencies or control gaps that ought to capture the attention of management but haven't, says Nick LeBlanc, internal audit manager at Athena Health. For instance, LeBlanc and his team were reviewing information systems and learned of one application that that had bounced between several support teams. The audit team brought together the heads of the support teams, so they could jointly decide who'd own the process. Auditees "can use our brand and process to put these issues and concerns in front of high-level people who can do something about them," he says.
Of course, LeBlanc first verifies the issue presented is real. "We still need support to back up claims, but this gives us a head start about where to look," he says.
After identifying where a process is breaking down, internal audit can make recommendations to improve it. Brendan Day, director of the risk advisory service practice at RSM, was reviewing a company's travel and entertainment expense policy and noticed certain individuals' T&E reports had been sitting in the system for six or eight months. That meant the expenses weren't being captured in the general ledger. While the dollars weren't high enough to cause a misstatement, they also weren't being captured in the budgeting process. Day and his team developed a report management could run to identify employees who hadn't submitted expenses.
Another way internal audit can add value is by sharing its expertise and resources. As part of one audit, Cunningham created a detailed flow chart of a process, identifying all steps and control points. The audit team not only reviewed the chart with auditees but taught them how to create their flow charts for other processes. "We weren't just giving it to them, but teaching them the process," she says.
Gray's team has conducted data analytics to check the efficiency of various operational processes, comparing budgeted to actual numbers. "It's eye-opening," she says. Often, process owners have tried to assess the expenses but lacked the resources needed to pull together the information to the extent internal audit can. Many ask for even more information, such as a breakdown by business group. "If we can, we're happy to provide it," she says.
A Word of Caution: These Customers Aren't Always Right
Taking a customer service approach doesn't mean internal audit refrains from reporting an issue out of concern that doing so might jeopardize the relationship. "It should be the opposite," Sevigny says. Once internal audit has developed a strong relationship with a business unit through its efforts to treat the employees like customers, management of the unit likely will better understand the value of identifying inefficiencies or risks and be receptive to working together to correct them.
By employing a customer service approach to their audits, an internal audit team can smooth the process for all involved. And that can help the team uncover risks and inefficiencies that otherwise might be overlooked. "When you have buy-in," says RSM's Berkeley, "you can use internal audit as tool to improve processes."
Karen Kroll is a writer and editor based in Minneapolis, Minnesota.