Out of the box: Accentuate the positive

If someone asks you what internal audit does, it’s a fair bet that “risk” will crop up in the first sentence, in conjunction with “corporate governance” and “assurance”. It’s less likely that people will discuss internal audit’s role in identifying opportunities and suggesting ideas, yet this has always been a core part of the job – what is a report if it is not a tool for identifying potential improvements? Opportunities to make things better must always be the flip side of highlighting issues.

This relative lack of focus on opportunities is understandable given that, historically, the emphasis has always been on spotting problems. However, in recent years there has been a renewed impetus to focus on how internal audit can “add value”. One element of this must be to focus more on ideas for improvements.

A positive outlook may mean being more conscious about the value of the advice presented in reports to address a controls gap, emerging risk or poor practice. However, it can also go further. Internal auditors and internal audit leaders can focus on identifying areas where organisations could be more innovative, less wasteful or more efficient. These observations may not be directly related to failings noted in an official audit report, but could be more useful in the longer term to their organisation (and more appreciated by senior management).

To do this well, internal audit teams need to be aware of, and use to the full, their unique holistic view over all parts of the organisation – and understanding of the ways these interact with each other. No other single team has the same access to all departments and to broader, cross-departmental themes such as company culture. This unique view is likely to provide unique insights for those who look for them.

However, it also requires internal auditors to focus more on the ways they benchmark and understand what others are doing in their sector and beyond. It doesn’t take long to start to believe that the way things have been done in the past is the “right” way to do them. It’s only by finding out what others are doing elsewhere that you spark ideas and, often, start conversations that can be mutually inspiring.

Foresight is as important as insight. Knowing what is going on outside your own organisation is essential because it helps you to prepare to meet emerging challenges and find new ways to respond to disruption and rapidly evolving circumstances. In a volatile geoeconomic environment, internal audit can add real value here.

Informal contacts with peers in other organisations are a good place to start, but to gain a fuller understanding and greater stimulation, internal auditors at all levels should look at opportunities to network and to keep abreast of developments in the wider profession – the Chartered IIA’s forums, training courses, working groups, local events and conferences are a great place to start. All members should also take time to familiarise themselves with the institute’s thought-leadership reports and technical guidance papers. No man (or woman) is an island, but internal auditors, in particular, need to mix widely and listen with an open mind if they are to do their jobs to their maximum potential.

It also involves making all internal auditors conscious of their remit to spot opportunities and how they can use it to improve processes (and increase corporate perceptions of the value of internal audit). People tend to see what they are looking for. If you do not search for opportunities, or do not think it’s part of your remit to identify them, you are unlikely to spot one. Furthermore, you need forums to discuss ideas as well as channels to communicate these to the people who can best appreciate and implement them.

Last, but not least, it’s worth remembering that people usually remember negative comments more than positive ones – so to cultivate a positive image and a reputation for being innovative and for driving beneficial change you need to come up with more positive ideas than criticisms.

Internal auditors often say they strive to be a “critical friend” to their organisations, but “critical” does not have to mean “criticism”. Even findings that indicate failures or weaknesses can sometimes be “spun” in more positive language, not to dilute their meaning but to improve the way they are received and acted upon. This is much easier if the internal auditor can suggest a response that not only mitigates any potential risk, but also improves the overall control environment, speeds up processes or eliminates unnecessary work or resources. Sometimes, the solution is not to highlight a failure to follow guidelines or to implement controls correctly, but to go back to the drawing board and work out an alternative that circumvents the problem and changes the starting point.

This is not always possible, and it certainly should not mean that internal auditors should shy away from calling out problems and highlighting failures when necessary. However, if the focus is on improving controls and on developing and progressing the way in which the organisation performs then there is immediately a positive impetus.

After all, most internal auditors go into the role (and then into work every day) to make a difference and improve the way their organisation operates. An audit function that channels this desire for positive change into a conscious ambition to spot opportunities and to identify and promote improvements is merely creating a stronger framework for the team’s natural inclinations. What’s more, thinking positive has an effect on those who do it – a positive focus and official encouragement to explore ideas beyond the boundaries of the day-to-day job should make everyone’s role more fulfilling, and people who feel more empowered and valued tend to feel happier at work. It’s a positive circle for all involved. 

This article was published in May 2023.