Reflections From My Internal Audit Journey: 3 Invaluable Lessons Learnt

This remains one of the greatest misconceptions about internal auditors which I too, was guilty of. This flawed mindset as a young auditor, framed the way I conducted my reviews, much to lacklustre results. Auditees and clients would either be hostile and have their anxiety levels raised, or blindly comply without fully grasping the meaning behind the controls that they are supposed to implement. Both outcomes resulted in recommendations that might not always have been of value to the organisation.

Recalibrating my mindset with the purpose of value-adding to the organisation allowed me to focus on key risks and build rapport with my auditees and clients instead. My communication and people management skills improved greatly. After some time, the preconceived notion that internal audit was cold and impersonal and was there to nit-pick, gradually faded away. There was a more collaborative effort to treat observations as good opportunities to uncover blind spots. With a fresh pair of eyes, auditees and clients were more willing to leverage on internal audit’s independent role to assess the adequacy and effectiveness of controls with the aim of improving corporate governance.

Getting rid of this misconception is not an overnight task; it is an ongoing effort which should be undertaken by current and future internal auditors.

To be able to offer relevant insights and to stay on top of ever-evolving risks, it is pertinent to keep abreast of news and trends. I found that demonstrating a keen understanding of the industry, as well as significant events that could impact the organisation’s strategy and ability to attain its objectives, helped to establish good rapport with auditees and clients. This also made it easier to perform audit scoping.

I have used the following to help me:

• Subscribing to major news outlets and headline alerts.
• Turning on alerts for news and announcements released by my clients’ organisations. This is usually found under the investor relations section of the corporate website.
• Subscribing to content from professional bodies such as IIA Singapore and IIA Global.
• Reading thought leadership articles and publications from professional services firms and industry experts.

In addition, networking sessions and fireside chats with both young and senior internal audit professionals, have helped me learn new and alternative ways to conduct reviews, pick up auditing tools, as well as gain a fuller understanding of the profession. Whether it was to fuel my curiosity on the latest internal audit trends (think Agile Auditing, ESG, cybersecurity in a pandemic era, etc.) or to talk about difficulties faced, it was great to know that I was not alone. With like-minded professionals who were more than willing to share their experiences, these conversations have propelled me to think beyond my comfort zone and challenged the way I work so that I can become a better internal auditor.

At the risk of stating the obvious, the greatest difference between being audited by a robot and a human is Empathy. While this can be a double-edged sword, it can actually be leveraged upon to foster a better relationship with our stakeholders.

As we listen to clients share about their processes and controls, it is more important to pay attention to what is not being said. When we observe their body language, tone, and choice of words, we put ourselves in their shoes, to better appreciate any processes and challenges in implementing the recommended controls. I was once advised to imagine myself at the receiving end of audits that uncover gaps and lapses – how defensively would I react and what communications style would cause me to panic? With an even greater reliance on technology and data analytics, the human touch cannot be abandoned nor replaced. When auditees and clients feel that we genuinely understand and care about their work, obtaining their trust becomes easier.