Internal Auditor as Consultant

The Auditor as Internal Consultant
Consulting skills can boost the internal auditor's influence in the organization.
Scott D. White, CIA, CFSA
Assistant Vice President, Audit Services
John Hancock Financial Services
he International Standards for the Professional Practice of Internal Auditing defines internal auditing as a
"consulting activity," but how many internal auditors have ever really studied what it takes to be an effective
consultant? Internal auditors may recommend change with their internal audit reports, but can they
"influence" change in other ways? Do internal auditors just perform an audit, or do they collaborate with their
clients to make an outcome better?
Increasingly, internal auditors are being held to higher standards of performance and accountability. In many
cases, they need to act as objective and critical "outsiders" within their own organizations, delivering the
hard facts and bad news that management typically does not want to hear. Additionally, they need to be
prepared to deliver the truth to management beyond what is presented by the facts. They need to be good at
the "off- the-record" conversation, which is sometimes more important than the written report. Internal
auditors who master the principles of effective internal consulting can use the related methods and
techniques to dig deeper and deliver the truth.
DELIVERING BAD NEWS
In these days of increased regulatory scrutiny, growing importance is being placed on the vital role internal
audits play within the organization's overall governance framework. Internal auditors often are viewed as
one of the few objective sources of information within the organization. The auditor's role is to deliver that
news, no matter how uncomfortable the task or resistant the audience.
Internal Auditor PRINT CLOSE
T
According to Marcia Meislin, president of mcm Management Consultants and author of The Internal
Consultant: Drawing on Inside Expertise, most people are ambivalent about hearing honest feedback.
However, contacts with management can result in "moments of truth" — any point at which someone forms
a perception about an individual, an individual's department, or the company. These can be "make or break"
moments that determine the success of the auditor's message. A positive moment of truth for an auditor in
which bad news is delivered can turn a potentially disastrous situation into one of trust, partnership, and
lowered defenses. An auditor who understands management's point of view regarding an issue can present
difficult news in a helpful and supportive manner, can offer well-thought-out solutions, and can often have far
Page 1 of 7Internal Auditor
6/10/2010http://www.theiia.org/intAuditor/feature-articles/2007/february/the-auditor-as-internal-con...

greater positive impact in affecting an outcome. This can lead to more honesty, fewer walls, and minimized
finger pointing. The client and auditor can then collaborate to fix common problems rather than approach
them in an adversarial way. Instances where the client remains in denial about the problem until it festers
and gets out of hand will become fewer.
Internal auditors can apply Meislin's techniques to their work to ensure moments of truth occur when working
with clients. For example, auditors should:
 Be authentic with no phoniness or hidden agendas.
 Do their homework and know the business issues at hand as well as the audit issues.
 Conduct a good interview by asking open-ended questions and listening actively to the responses.
 Confidently articulate internal auditing's value to the organization and benefit to the contact.
 Be honest about the level of confidentiality of the information that the individual is about to share.
Confidentiality, especially at higher levels in the
organization, is critical. Failure to maintain
confidentiality could come back to haunt the auditor.
To avoid any misunderstandings about what will be
kept confidential, the auditor should disclose up front
internal auditing's reporting requirements and
intentions. Auditors should ensure that the client
understands internal auditing's professional
responsibilities and that auditors are guided by their
professional standards and reporting obligations.
Internal auditors must explain carefully to executives
what information will be confidential and what may end
up in a public document.
In some situations, the auditor could consider letting
the client manage the flow and timing of the release of
audit results up the chain of command, especially if it's
bad news. Anything the auditor can do to help the
client be seen as cooperative and proactive in
addressing audit issues will benefit both the auditor
and the client.
REALITY VS. PERCEPTION
Most seasoned internal auditors have had the
experience of a client articulating how he or she
believes a business process is working and then
discovering that it actually works much differently than
The Internal Auditor as Consultant
Examination of the principles behind
effective internal consulting practices
reveals an alignment between the skills
required to be an effective consultant and
those required to be an effective internal
auditor. According to Marcia Meislin, author
of The Internal Consultant: Drawing on
Inside Expertise, use of consulting skills and
techniques can help internal auditors:
 Reposition themselves from an in-
house "enforcer" or policing function
to a valued adviser.
 Establish collaborative relationships.
 Minimize resistance and expand
positive influence with clients, peers,
superiors, and employees.
 Reduce or eliminate the use of "audit
lingo" by listening to clients speak the
daily language of business.
 Identify clients' behavioral styles to
maximize communication and
minimize conflicts and
misunderstandings.
 Create a plan for increasing the real

perceived or expected. When the auditor explains the
reality to the client, the typical reactions are disbelief
that the auditor truly understands what is happening or
anger and disappointment directed at subordinates for
not meeting business objectives.
For internal auditors to have an impact and to be seen
as true consultants, they must get clients to articulate
their vision of how things should be and what is
currently happening. Questions the auditor should ask
include:
 If everything were working exactly as expected,
what would be happening? What would
employees be saying or doing? What would
customers be experiencing? How is that
different from what's happening now?
 What is the ideal state? Is there an example of
how you would like things to work?
 What are your two top business objectives, and
what is the biggest obstacle in attaining those objectives?
Understanding the client's vision helps direct the auditor in deciding what matters — and what doesn't — to
the client, and provides the auditor with opportunities to add value and further build credibility during the
audit process by focusing on the areas considered most critical for the client's success.
NEGOTIATE, NEGOTIATE, NEGOTIATE
To be successful as internal consultants, auditors must understand the needs of their clients and ensure
clients understand the auditors' needs. Typical early negotiating points might include the timing or length of
a particular audit in a business area. For example, a client might say that his or her business cannot
accommodate an audit of six weeks in the time frame that the auditor has scheduled and request that the
project be delayed or deferred to the next audit cycle. Instead of saying "No," Meislin suggests using the
"Yes, and..." technique: "Yes, I understand your time constraints and we can make it work for you; however,
we will need more assistance from you and your managers to meet those requirements." The auditor's
willingness to negotiate to meet the business manager's needs reflects a customer-oriented consultant.
FACT FINDING
Auditors often see their role as conducting an audit consisting of planning, fieldwork, and reporting. In
consulting terms, auditors are data gathering. As an "outsider," the internal auditor isn't locked into the same
assumptions as the business and is free to question and probe. To provide value as a consultant, the auditor
and perceived value of the audit
function.
Internal auditors are typically adept at
executing the technical aspects of planning,
performing, and reporting on their audit
work. They sometimes struggle, however,
with the softer skills related to
communicating effectively with clients,
establishing credibility, and overcoming
resistance. Although internal auditing is a
discipline related to consulting, auditors
often overlook or are unfamiliar with the
skills that professional consultants may use
to interact effectively with their clients and
deliver the services that their clients want
and deserve.

must be able to gather all the information to help the client understand and fix identified problems.
To achieve this mission, internal auditors need to focus on two specific skills: active listening and
questioning. These techniques can be especially useful when the auditor is encountering resistance from the
client. Resistance often takes the form of passive-aggressive behavior characterized by indirectness or lack
of disclosure during fact finding. Clients may exhibit passive-aggressive behavior in several ways:
 Not returning e-mails or phone calls.
 Controlling the point of contact during the audit (e.g., not allowing auditors to speak with anyone but a
designated individual).
 Not producing, or slowness in producing, requested documentation.
 Late reply or no reply to internal audit points or findings.
 Agreeing with the issues discussed during the audit, but then disagreeing with the same issues when
they appear in the written report.
 Appearing cooperative, yet critical of the auditors to others.
Resistance to change is normal. Still, there are specific strategies that internal consultants can use to
minimize its frustrating effects. To overcome resistance, Meislin recommends:
 Not taking resistance personally; do not become passive-aggressive yourself.
 Identifying the comments and behaviors the client is making that hint at his or her resistance.
 If the behavior continues, stopping and acknowledging what you have observed and what you are
experiencing.
 Getting the issue on the table where it can be dealt with openly.
 Giving the client a chance to respond and staying quiet until he or she does.
 Determining how to handle the client's issues by either modifying your actions, reaching an
agreement, or being more sensitive to the client's needs.
 Giving the client a say in what is happening early so that his or her resistance is not as likely to derail
the audit later.
Auditors should ask direct, yet polite, questions about observed behaviors as opposed to asking someone,
"Do you have a problem with me?" — to which the answer could be, "What problem?" A better question
might be, "I noticed early on in the audit you were quite cooperative, but lately it sounds like you are angry
with us. Is there a problem with the audit or with me that we need to address?" The auditor should remain
quiet and let the client respond. If the client does not provide an explanation, the auditor should assure the
client that he or she is concerned and ready to listen when the client wants to talk.
PROVIDING FEEDBACK
Internal auditors give feedback through periodic
meetings with their clients, an exit conference, and
a written report. Although internal auditors tend to
Strategies for Building Credibility in
the Organization

be tied into their reporting methodology, there are
other techniques that consulting auditors can use to
build credibility with their clients, including:
 Present a balanced report starting with
information about what went well during an
audit and then move to the issues.
 Have a conversation with the client rather
than presenting him or her with a
presentation on issues. Give the client time
to digest comments and respond to them. Be
conscious of the client's body language and
adjust the tone of the conversation if needed.
 Do not apologize for telling the truth.
Maintain your integrity.
 Stick to the specific facts uncovered by the
audit. Do not be judgmental or editorialize
about your feedback.
 Have your evidence in order and be
prepared to provide examples if asked to
clarify your point.
 At some point, ask for the client's feedback
on your work. If the feedback is negative,
ask for clarification if needed and take steps
to address the client's concerns. Celebrate
success. Don't be afraid to tell others if the
feedback was positive.
The audit report does not always suffice as an
effective feedback tool. Reports tend to become
structured with boilerplate language and
generalized statistics and information. The truth
sometimes becomes unprintable, and the trends
can be left unidentified in a written report. The off-
the-record report often is more meaningful and
more effective for providing feedback about the root
causes of the issues identified. Take for example
the veteran internal auditor whose audit results in a
certain department left him feeling uncomfortable
with that area's financial management. Audits were
completed and "satisfactory" reports were
1. Know what's happening in your company.
 Build and maintain a strong network.
 Read the company's literature and media
information.
 Keep up on industry developments.
 Keep your skills current.
2. Know your client and their customer.
 Know your client's business and
customers.
 Visit your clients to see things firsthand.
 Go on customer visits with your client.
 Know and understand the jargon of the
business.
 Know where your client stands relative to
the competition.
 Build a strong relationship based on your
service.
3. Find out what hurts the most or needs
attention.
 Find out the areas of greatest pain and
help if you can.
 Study your client's strengths and
weaknesses.
 Give honest and constructive feedback.
 Meet the employees and listen when
they talk.
 Learn to read verbal and nonverbal cues.
4. Develop authentic client/consultant
relationships.
 Respect the sacredness of confidentiality
agreements.
 Manage your "moments of truth."
 Make sure that your own "baggage" is

published that outlined issues and trends over time
but never identified the real issue. The financial
manager's method of "resistance" was to create
smoke screens and blame others while appearing
to be totally cooperative in addressing the issues
identified by the "on-the-record" audit report. By
continuing to "peel the onion" for the truth, the
auditor discovered that the financial manager had
covered up a larger mess that existed beneath the
surface. The auditor approached the vice president
of the area and admitted that the audit reports for
the past few years hadn't really identified the critical
issue, which was the mismanagement of the area.
The issue was dealt with as a result of the off-the-
record report, the manager was moved out of the
position, and corrective action began.
GOING FORWARD
Increasingly, internal auditors are being held
accountable for not only making appropriate
recommendations, but also following through on
them to ensure that management has taken
necessary corrective actions. Auditors grapple with
the issue of whether they should make very specific
recommendations regarding how a problem should
be resolved. Is internal auditing going to be viewed
as telling management what to do if it makes
specific recommendations? As hard as auditors try,
they sometimes might make recommendations that
are not realistic for management to implement, or it
may not be possible to take action as quickly as
they would like. Auditors then run the risk of losing
credibility with the client.
Creating management buy-in is probably the most
critical, and perhaps the most difficult, step internal
auditors can take to positively affect the outcome of
the audit. Steps for ensuring buy-in include:
 Know the risk and impact of the issue if
not interfering with the relationship.
 Show flexibility in being able to support
as well as confront.
 Stay out of the rumor mill.
 Learn to say "yes ... and" rather than
"no."
5. Provide services that are pragmatic, yet
innovative.
 Do what you do best; you can't be all
things to all people.
 Think globally, act locally; respond to
your clients' needs but keep the big
picture in mind.
 Take responsibility for communication
with your client, as you might be "out of
sight, out of mind."
 Keep thinking out of the box.
6. Market and sell your services internally.
 Break in where you know you will be
successful, and have satisfied customers
provide testimonials.
 Sell your client on your strategy so it is
perceived as his or her idea.
 Don't get desperate; if you keep getting
rejected, find out why and either adjust
or cut losses and get out.
 Don't take criticism personally; getting
defensive is one of the worst things you
can do as a consultant.
 If you need positive stroking all the time,
this may not be the job for you.
Source: The Internal Consultant: Drawing on
Inside Expertise, by Marcia Meislin, MCM

nothing is done about it. If it's not important, it will not get addressed.
 Take a business approach to determining how important an issue is. Ask yourself, "If I were the vice
president would I care about this issue, and if so, what would I do about it?"
 Understand how the action you are suggesting affects business areas (e.g., does it increase or
decrease costs, or increase or decrease headcount?). Issues regarding costs and headcount are near
and dear to most managers. It will be difficult to get buy-in on your recommendations if you are not on
solid ground.
 Use experts or other resources when needed. Often, others within the organization can help you
create buy-in by using their expertise to prove your point. This could be individuals such as the
compliance officer or data security officer. Also, outside information such as benchmarking and best
practices studies are useful for managers and help create buy-in.
Once the action plans have been set in motion, internal auditors need to step back and evaluate their
performance as consultants. They should solicit their client's feedback. If the feedback is negative, the
auditors should ask for suggestions on how to improve and take actions to do it better the next time. If it's
positive, auditors should ask the client to talk with other managers about the positive experience they just
had with internal auditing. Much like a consultant, internal auditors can then build a portfolio of successful
projects, expanding their influence and improving the positioning of internal auditing within the organization.
To comment on this article, e-mail the author at scott.white@theiia.org.
Internal Auditor
www.internalauditoronline.org

Internal Auditor as Consultant

More Related Content

What's hot (20)

Viewers also liked (7)

Similar to Internal Auditor as Consultant (20)

Internal Auditor as Consultant