All Things Internal Audit: Advisory Work: How to Consult

In this episode, Mike Levy talks with Mike Jacka about the growing role of advisory services in internal auditing. They discuss how today’s internal auditors are offering strategic insights that go beyond assurance work. They also cover how to balance objectivity with advisory work, how to fit advisory into audit planning, and how to show the value of these services.

Host:

Mike Levy, CIA, CRMA

CEO and managing principal

Guest:

Mike Jacka, CIA, CPA, CPCU, CLU

Chief creative pilot at Flying Pig Audit, Consulting and Training Solutions

Key Points

Introduction [00:00-00:06]
The role of advisory services in internal audit [00:07-00:27]
Balancing objectivity with advisory work [00:28-02:06]
Early engagement and its impact on risk management [02:07-04:49]
Real-world example: social media consulting [04:50-05:56]
Advisory services in small vs. large internal audit functions [05:57-07:06]
Pre-implementation reviews as a key advisory opportunity [07:07-09:32]
Addressing the fear of losing objectivity in advisory work [09:33-10:45]
Demonstrating advisory value to audit committees [10:46-14:08]
Using assurance work to identify advisory opportunities [14:09-17:02]
Developing skill sets for effective advisory work [17:03-19:03]
The impact of strong relationships and trust in internal audit [19:04-22:41]
How the Global Internal Audit Standards support advisory services [22:42-26:06]
Fostering an advisory mindset within audit teams [26:07-28:18]
Strategies for internal auditors to enhance their influence [28:19-30:37]
Final thoughts and advice for internal auditors [30:38-32:00]

The IIA Related Content

Interested in this topic? Visit the links below for more resources:

Learning Solutions: The Advisory Engagement

Visit The IIA's website or YouTube channel for related topics and more.

Resources Mentioned

View More Episodes

Get the Transcript

00:00:02 Speaker 1

The Institute of Internal Auditors presents all things internal audit.

00:00:06 Speaker 1

In this episode, Mike Levy talks with Mike Jaco about the growing role of advisory services in internal auditing.

00:00:13 Speaker 1

They discuss how today's internal auditors are offering strategic insights that go beyond assurance work.

00:00:19 Speaker 1

They also cover how to balance objectivity with advisory work, how to fit advisory and audit planning, and how to show the value of.

00:00:27

This is.

00:00:30 Speaker 2

Welcome.

00:00:31 Speaker 3

I'm glad to be here again.

00:00:33 Speaker 3

Always interesting and fun, we.

00:00:35 Speaker 2

We didn't scare them away after our discussion on soft skills, so.

00:00:38 Speaker 2

I think we'll have to continue.

00:00:40 Speaker 2

So thinking about advisory services, it's one of those things we always talk about. You know, years ago it was trusted advisor.

00:00:46 Speaker 2

Talking about.

00:00:47 Speaker 2

We used to be consulting.

00:00:49 Speaker 2

When we think about internal audit functions, I think historically many of us go to the assurance based model. We have to spotlight issues with management. We report those issues to the Audit Committee and executive management.

00:01:01 Speaker 2

How do you see advisory services really fitting into internal audit?

00:01:04 Speaker 2

So it's a topic we talk about a lot.

00:01:07 Speaker 3

Yeah. And I will warn you to some.

00:01:10 Speaker 3

Well, let me let me go with the theory I have about this whole thing for some reason.

00:01:15 Speaker 3

Auditors seem to think that advisory is a subset of internal audit.

00:01:20 Speaker 3

I would argue it's the other way.

00:01:22 Speaker 3

Advisory is all things.

00:01:24 Speaker 3

Then it.

00:01:25 Speaker 3

The control aspects of the assurance aspect is almost a subset of that.

00:01:30 Speaker 3

So I think internal auditors should already have the tools, have the mindset in working with people.

00:01:37 Speaker 3

To expand into that broader issue of advisory services.

00:01:43 Speaker 2

It's it's well.

00:01:44 Speaker 2

I mean, I think when I think about internal audit and I think about what we're really meant to do, I've heard, you know, we can get into a probably a whole conversation just on the concepts of independence and objectivity. And obviously those are critically important for auditors, however.

00:01:57 Speaker 2

One of my fears with those words is sometimes we.

00:02:00 Speaker 2

Get stuck behind them and we don't focus on what matters within our organizations and how we need to deliver value.

00:02:06 Speaker 2

Can't crossover those lines of objectivity and what we do with in organizations.

00:02:12 Speaker 2

So many times there are opportunities and we're seeing more and more of them as we talk about all of the emerging risk topics.

00:02:19 Speaker 2

Know think AI.

00:02:20 Speaker 2

Think some of the cyber risks that are happening.

00:02:22 Speaker 2

Businesses are very often learning as they go, and they're trying to figure a lot of these things out. And if we wait till they are mature.

00:02:31 Speaker 2

Topics within an organization where we can do audits, we're almost.

00:02:34 Speaker 2

Too late and that that balance becomes really critical and important. And for me some of that kind has come naturally because I started my career in BIG4 consulting and was always focused on how we build that value proposition as a as a consultant coming in. But when.

00:02:51 Speaker 2

The.

00:02:52 Speaker 2

That's not always as apparent, so.

00:02:55 Speaker 2

Mike, just from your experiences in the past, how do you go about developing some of those things from from the ground up?

00:03:01 Speaker 3

When it comes to developing the advisory aspects of it.

00:03:04 Speaker 3

It it unfortunately.

00:03:06 Speaker 3

Becomes almost everything we were talking about.

00:03:07 Speaker 3

Our last.

00:03:08 Speaker 3

It is the soft.

00:03:09 Speaker 3

It's about learning about the people, about being a piece of the people, about being a part of the team. One of the important things you talked about there a second ago was.

00:03:19 Speaker 3

Being there on the front end and I know some of the internal auditors want to sit back and wait.

00:03:23 Speaker 3

Come in.

00:03:23 Speaker 3

I'll use the word.

00:03:24 Speaker 3

They want to come in and judge.

00:03:27 Speaker 3

And if you are a part of the team you are meeting with people. If you're talking to people, you're hearing the new things as they develop, and that's where that comes in.

00:03:37 Speaker 3

We had probably one of our most successful consulting projects was when social media was first kicking off.

00:03:44 Speaker 3

And it was a fascinating 1 because nobody was really looking at it.

00:03:49 Speaker 3

'S really talking about.

00:03:50 Speaker 3

We just had a brand new marketing officer come in who wanted to find out what we were doing in, in the organization.

00:03:57 Speaker 3

At the same time, we had another member of the C squad go.

00:04:00 Speaker 3

Can you do this?

00:04:01 Speaker 3

We don't do audits of.

00:04:02 Speaker 3

We can't do audits of social media, so it was a combination of helping them understand what social media was about and then working with this other person. So what we spent a lot of time talking to the various departments and we had those that report built already.

00:04:18 Speaker 3

That we could talk to them and they would.

00:04:20 Speaker 3

With us.

00:04:21 Speaker 3

What we found was that all the individual departments had very good social media situations set up.

00:04:30 Speaker 3

But there was no over.

00:04:31 Speaker 3

There was no umbrella over at all, and that's what the chief marketing.

00:04:34 Speaker 3

Came in, did.

00:04:35 Speaker 3

So I use that as a success story of how it works, but I also use that look.

00:04:40 Speaker 3

Is where your internal audit work over all those years.

00:04:44 Speaker 3

Should help set that up.

00:04:46 Speaker 3

They were all people we talked to work with, trusted us.

00:04:49 Speaker 3

We were trusted assurance providers, not just trusted advisors.

00:04:52 Speaker 3

And they they trusted.

00:04:53 Speaker 3

They were willing to speak with us because they knew the work we had done in the past.

00:04:56 Speaker 3

So it's that relationship.

00:04:58 Speaker 3

That's gone on and on and on.

00:05:00 Speaker 3

That allows someone to go forward, become an advisory, take on that advisory capacity.

00:05:07 Speaker 2

This is an area where I've actually seen small interonent functions excel at in some, in some ways better than larger audit functions. I've I've been lucky in my career that I've gotten to work with a lot of different departments, and sometimes when you're a small internal audit fun.

00:05:23 Speaker 2

You're tasked with all of these risks that you have to assess and evaluate and think through for the organization, and you don't always know how to how to do it. And I think the agility that you have to have as a small function, this is really where one.

00:05:37 Speaker 2

The places where advisory services can really shine a.

00:05:40 Speaker 2

Really important light in delivering value for your stakeholders.

00:05:43 Speaker 2

For me, when I've been successful at this in the past, I've really thought about it in terms of less in terms of what is the report and what observations do I need to have and really more so how do I get involved early on and and a lot.

00:05:55 Speaker 2

And a lot of times, if you if you're asking yourself where do I get started?

00:05:58 Speaker 2

Think about what technology transformations your organization's.

00:06:01 Speaker 2

And for me, the the low hanging fruit area where we work on advisory services is pre implementation reviews instead of going in after an implementation is done and assessing whether it's successful or failure.

00:06:12 Speaker 2

A success or a failure?

00:06:14 Speaker 2

Go in early on.

00:06:15 Speaker 2

And help them think through controls and risks in the configuration and you know, obviously you can't turn the knobs and actually implement the system. However, sitting in the room and giving that coaching and counseling really does deliver a lot of value to groups at that stage in the.

00:06:29

Process.

00:06:30 Speaker 3

Can you hit the thing that someone in you talked about earlier?

00:06:32 Speaker 3

So many people are afraid of, you know, well, gosh, if there at the beginning, have I become the control? Have I become part of it?

00:06:38 Speaker 3

It's important to remember that all you're doing is you're not teaching them controls.

00:06:44 Speaker 3

Not teaching.

00:06:45 Speaker 3

The aspects of it you're helping them understand how those work.

00:06:51 Speaker 3

Because there's still going to be the ones that know better how to develop it, and you can say, OK, that that makes it to me or have you thought about this aspect of it?

00:07:00 Speaker 3

That's where consulting comes in.

00:07:02 Speaker 3

It's not telling them what to do, just like in internal audit, it's not telling them what to do.

00:07:07 Speaker 3

It's about providing insights in the way these things work so they can come to the decisions that work best in their departments.

00:07:14 Speaker 2

One of the things I often hear chief audit executives who are grappling with this think through is, well, my only committee and my KPI measurements are really all about how how many findings I have and how many, what the resolution looks like.

00:07:27 Speaker 2

You know, how do I demonstrate the value of my function if I'm not delivering audit reports every every quarter and instead I'm spending my time on advisory services so.

00:07:35 Speaker 2

You know, Mike, what would you? What would you say to that in terms of how, how do I talk to my audit committees about advisory services and effectively take credit for the work that I'm doing within business?

00:07:44 Speaker 3

Well, First off, I can rent for hours on KPIs because I have so many problems with so many KPIs that people and I'd say that's where you go.

00:07:52 Speaker 3

What are your KP is and it you can literally establish KP is around advisory services.

00:08:00 Speaker 3

You know who's talking to us?

00:08:01 Speaker 3

Coming to it.

00:08:02 Speaker 3

Know.

00:08:02 Speaker 3

Some people who do have that KPI.

00:08:03 Speaker 3

How many people have come to us with issues?

00:08:05 Speaker 3

Many have come to us with.

00:08:06 Speaker 3

Potential situations.

00:08:08 Speaker 3

So if you have built into your KPIs, you bring that advisor piece into it. Now that does mean potentially educating.

00:08:15 Speaker 3

Gotta they do not understand the advisory aspect of internal audit.

00:08:19 Speaker 3

Then you've got a lot of education at the higher level that has to go on.

00:08:24 Speaker 3

But ultimately I think that's.

00:08:26 Speaker 3

Do they understand what it is internal?

00:08:28 Speaker 3

The value of internal audit.

00:08:30 Speaker 3

Beyond just assurance, and once they understand that then finding the KP is that measure?

00:08:37 Speaker 2

One of the organizations I've worked with in the past when I was serving in a.

00:08:40 Speaker 2

So I do consulting now, but when I was serving in the Chief audit executive role, we got to a point and this was you can't always do this with every organization 'cause you really have to measure the culture of where your business, where the business is and what.

00:08:51 Speaker 2

Can have support to do but.

00:08:53 Speaker 2

We're actually doing more advisory services than we were assurance based services and that doesn't always work that way. And you can't always do it that way. However, in that business, it made a whole lot of sense because there are a lot of really immature processes.

00:09:04 Speaker 2

And it delivered a ton of value for them.

00:09:07 Speaker 2

The other concept I've thought a lot about is when you can sort of dual purpose the assurance and advisory services. And what I mean by that is when does an assurance project turn into an advisory project or when can you?

00:09:19 Speaker 2

Can you identify something from an assurance side of the house?

00:09:23 Speaker 2

And then have it have another project that layers on afterwards.

00:09:27 Speaker 2

Turn into advisory services.

00:09:29 Speaker 2

Have you ever seen that, or have you ever contemplated?

00:09:31 Speaker 2

Have some examples, but curious to get your thoughts.

00:09:34 Speaker 3

Yeah. I would say in general, I I cannot think of.

00:09:37 Speaker 3

I know what happened, but it does speak to the flexibility that needs to be allowed for people. I'll throw this quick story in just a long time ago in an audit department far, far away.

00:09:47 Speaker 3

Where on the annual schedule we were not allowed to change the annual schedule in spite of the fact that risks had changed because they didn't know how to go to the audit committ.

00:09:55 Speaker 3

They were changing it because the fear was that they would look like they didn't know what they were doing. So you have to get beyond that. But I'd be interested in the stories.

00:10:02 Speaker 3

Got where it actually did make those changes.

00:10:05 Speaker 2

I had one time where it was actually an advisory. I mean, it was a financial controls audit.

00:10:09 Speaker 2

We're doing it.

00:10:10 Speaker 2

Sarbanes.

00:10:11 Speaker 2

But it was very it was privately private company that had adopted a lot of the elements of Sarbanes-Oxley.

00:10:18 Speaker 2

We had basically been going through the core financial processes and we we identified a control that passed our financial testing and effectively it was a very basic accounts payable control, right.

00:10:31 Speaker 2

We had something that was.

00:10:33 Speaker 2

The equivalent of check signatures or properly signed by the person with the right authority before.

00:10:38 Speaker 2

For sign off, pass the test it was it was signed.

00:10:41 Speaker 2

We saw a lot of inefficiency in that process and what we looked at and we actually kicked off an advisory project with them where we did a lot of the, you know, risk assessment and worked with the business to really understand where some of the pain points and.

00:10:56 Speaker 2

Were in the process.

00:10:57 Speaker 2

And what that translated to was?

00:11:00 Speaker 2

A very large transformation project that the business didn't generated.

00:11:04 Speaker 2

Seven figures of savings for them in the business because effectively what they had was a legacy, a legacy process where they had an authority matrix with physical signatures on the authority matrix.

00:11:14 Speaker 2

They were.

00:11:15 Speaker 2

They had a team of people that was physically reviewing signatures.

00:11:18 Speaker 2

Against a hand stamp that was on invoices that we looked at that we said well passes the control and it works highly inefficient and doesn't really generate the value that you can within the business.

00:11:28 Speaker 2

For us, we used even something that was the equivalent of a Sarbanes-Oxley.

00:11:32 Speaker 2

Us to identify an opportunity for the business and then we worked with them through a separate advisory project. Those types of things I think are always interesting and you know I've I've talked to audit functions about this and one of the key questions I always get is about.

00:11:46 Speaker 2

The teams that they have in place and how do I how do I develop talent so that we can have?

00:11:51 Speaker 2

Resources on our team that aren't just quote UN quote checking the box, but instead really looking for things from a holistic lens of how you, how do you improve the business.

00:12:00 Speaker 2

What do you think about that side of things in terms of the skill sets that might be required here and do we have them in internal audit functions now or do you think we still need to do a lot of work around?

00:12:10 Speaker 3

We desperately hope we have most of them in internal audit departments.

00:12:13 Speaker 3

I know there's a lot.

00:12:14 Speaker 3

Don't, but flexibility. I was talking about.

00:12:18 Speaker 3

Back in the olden olden days.

00:12:20 Speaker 3

Is we had IC Q's internal control questionnaires.

00:12:22 Speaker 3

Any of you out there? Remember what they were? You know why we hated them?

00:12:25 Speaker 3

Know it was. Yes. No. And you were.

00:12:27 Speaker 3

Well, we've learned to be asked questions that lead to things and we.

00:12:31 Speaker 3

The really good audit work is that work that not only that is not only following the kind of questions that need to be answered, but listening to the answers to see which direction they go. And that's where you start building that.

00:12:44 Speaker 3

Wait a?

00:12:44 Speaker 3

This may not be a control, but this is something important to look at.

00:12:48 Speaker 3

So it's a, it's a developing listing skills. It's developing the interviewing skills. It's developing, you coming back to relationship management.

00:12:54 Speaker 3

People will talk to you.

00:12:55 Speaker 3

That's such a big thing. Even the ones you're talking about. It sounds to me like this was, hey, we talked to people and we found out this was happening.

00:13:02 Speaker 3

Was happening and having a mindset beyond.

00:13:06 Speaker 3

I am just doing.

00:13:07 Speaker 3

Yes, I may be doing insurance audit.

00:13:10 Speaker 3

But that doesn't mean I can't be looking for broader and more impactful things to do.

00:13:15 Speaker 3

I mean, you could be in the middle of an audit and I'd love to come up with an.

00:13:18 Speaker 3

Right now and I can't off the top of my head.

00:13:20 Speaker 3

Could be in the middle of an audit and somebody.

00:13:22 Speaker 3

What am I doing this audit?

00:13:23 Speaker 3

I mean, I'm wasting time at this point because I've got bigger issues in this audit. I've got bigger issues in this department.

00:13:30 Speaker 3

Than this little snapshot of internal audit assurance.

00:13:32 Speaker 3

That I'm doing.

00:13:33 Speaker 3

And so one having the flexibility to listen and make those changes. And two, having the flexibility in the in the higher ups to say good idea, let's do that.

00:13:44 Speaker 3

Cut it. Let's move it.

00:13:45 Speaker 3

And that comes all the way back into.

00:13:48 Speaker 3

Your comment about how you're showing the board value because value is the key to it.

00:13:53 Speaker 3

Assurance is a value we provide, but if we can provide a broader value, something impactful to them that isn't always assurance, then that gives audit executives.

00:14:03 Speaker 3

The opportunity to make the changes they need to which get the auditors, the changes they need.

00:14:08 Speaker 2

All.

00:14:08 Speaker 2

All set and I and I think when I take a step back and I think about all of these things, one of the things.

00:14:13 Speaker 2

Was most excited about in the new standards, right? So that as I probably mentioned, every time I.

00:14:18 Speaker 2

We have a new.

00:14:20 Speaker 2

Of global internal audit standards that were just went live this year.

00:14:24 Speaker 2

With topical requirements that are now officially in in place right, the cyber, the cyber topical requirements just came out in this month. In February, a couple days ago.

00:14:33 Speaker 2

And one of the things that I think the new standards are really supportive on and I was really excited to see this was that there's the concept of advisory services. And I think when we think about internal audit and we thought about our standards and we think about.

00:14:45 Speaker 2

We see the practice of internal auditing going over the next 10 years when we do our visioning.

00:14:52 Speaker 2

I think advisory is really the place where we're going to start delivering value.

00:14:55 Speaker 2

Always talk about.

00:14:57 Speaker 2

We're a group that wants to have a seat at the table and we want management to come to us and bring us problems so that we can help them think through that.

00:15:03 Speaker 2

And this is the place where I see us being able to deliver on that promise within businesses. And I think ultimately when I look at the new standards and I look at how we're starting to assess internal audit functions and the concepts of a advisory services.

00:15:18 Speaker 2

It's very pronounced in the new standards and it's very pronounced in the topical requirements as part of those standards.

00:15:24 Speaker 2

So even when we look at things like the new cybersecurity topical requirements.

00:15:28 Speaker 2

How do we apply them to advisory?

00:15:31 Speaker 2

They're not necessarily required for advisory, but they are written in a way that we can take elements of them and think about the governance process of a of a cybersecurity operation within business or any other information security apparatus.

00:15:44 Speaker 2

As we continue to develop.

00:15:46 Speaker 2

More topical requirements and really continue to evolve our standards to meet the needs of our profession.

00:15:52 Speaker 2

Think you're going to see more and more of that come down the Pike?

00:15:56 Speaker 3

I want to get into.

00:15:57 Speaker 3

Back to the concept of the mindset, and I think you're.

00:16:00 Speaker 3

The standards are allowing us to have a mindset that allows us for more of a change.

00:16:06 Speaker 3

How do auditors get?

00:16:07 Speaker 3

And again, I come back to a mindset and the reason I mentioned mindset is.

00:16:11 Speaker 3

I was very lucky.

00:16:12 Speaker 3

The audit department I came into, we were doing nothing but assurance, but it still had an advisory aspect to it.

00:16:19 Speaker 3

And as we went on more and more, I was learning and I was then.

00:16:24 Speaker 3

My almost had reverse engineer how how I got there? It was not about a control, it was about how things ran better. Now for control helps things run better than. That's what you're looking for.

00:16:37 Speaker 3

We did a lot of I was with farmers insurance.

00:16:39 Speaker 3

Did a lot of audits of our agents.

00:16:41 Speaker 3

I can't even remember thousands of agents every year, and I learned quickly and I trained others quickly.

00:16:47 Speaker 3

Do not tell people you do this because it's a control, especially these.

00:16:50 Speaker 3

Independent contractors. They didn't care what we.

00:16:52 Speaker 3

To say.

00:16:53 Speaker 3

Instead, you had to show them how it made.

00:16:55 Speaker 3

Run their business better.

00:16:57 Speaker 3

That's the mindset, even in an assurance audit that you need to have.

00:17:01 Speaker 3

How are you making them do their job?

00:17:04 Speaker 3

How are they allowing them to get their job done better so that they get more work done more efficiently rather than look got to control, got to control? Got to control yes. Control's a great story.

00:17:14 Speaker 3

But that cannot be the end.

00:17:15 Speaker 3

And be all of it.

00:17:16 Speaker 2

And in a lot of ways, when you think about some of the pain points our stakeholders have with audit through the traditional audit reports that happen with advisory services like, yeah, we could, we could also get into debates about the traffic light colours or the ABC findings or.

00:17:30 Speaker 2

Versus unsatisfactory in all the different terminologies and definitions that.

00:17:34 Speaker 2

Audit departments use one of the nice things about advisory services is it also takes you away from some of the things that the pieces of this that don't deliver as much value.

00:17:44 Speaker 2

For me, I've always been maybe this is, this is my own views, not the I as views, but I've always been a bigger proponent of the issues.

00:17:51 Speaker 2

Matters to me more than the actual rating itself and.

00:17:55 Speaker 2

As long as I use that issue to drive change positive change within my organization, that's really all that matters. And when I think about and I work with chief audit executives about how do we.

00:18:04 Speaker 2

Actuate advisory services within their.

00:18:06 Speaker 2

Apartments. One of the things going back to audit committee reporting and management report.

00:18:11 Speaker 2

Is the way we quote UN quote. Go back to the concept of taking credit for what we're doing with them within the business and reporting we get into more dashboard like views and presentation views and it's less about here's the number of findings we found and more just here.

00:18:25 Speaker 2

Number of conversations we've had with the business and if you want to count AKPI, think about how many times management gets asked you.

00:18:32 Speaker 2

Throughout the year, and if you start tabulating.

00:18:34 Speaker 2

Counting that, it's a pretty impactful statistic if you can go to your audit committee and say, yeah, I responded to 100 inquiries from management this quarter and things like that and how.

00:18:43 Speaker 2

On it, I've seen departments do things like field memorandums. When they start doing an advisory project where they're just writing a memo about what they did to the file and that can report it to the audit committee.

00:18:53 Speaker 2

And there's there's varying natures and extent of this of this and I think you know we're all sort of figuring out the best ways to report on it and how to deliver some of those results.

00:19:03 Speaker 2

One thing I do like.

00:19:04 Speaker 2

We're finding ways to do that in its ways that provide visibility and transparency into the work we're doing, but really it's it goes back to the value we're delivering and that people are seeing it and they're asking the questions.

00:19:16 Speaker 3

That brings up another.

00:19:17 Speaker 3

This is probably getting a little too high and esoteric, but that's too bad.

00:19:21 Speaker 3

You know, they if we sell ourselves, that's wonderful.

00:19:25 Speaker 3

That's what we should be doing.

00:19:27 Speaker 3

It's our customers selling us that really makes a difference. So that if we're in a committee meeting on a committee meeting, I was in one of these one time where actually the bigger advocate was not audit. One of the people sitting on the board saying they've done this.

00:19:40 Speaker 3

Done.

00:19:40 Speaker 3

They've done this.

00:19:42 Speaker 3

That's the kind of thing.

00:19:43 Speaker 3

Need to strive.

00:19:44 Speaker 3

And we only get that by.

00:19:46

Continuing.

00:19:48 Speaker 3

Partnering partnering is probably the best word in the world for this whole thing. We talk about relationship management and all of it. You know, when we do any audit work, are we doing the work or are we working with the client when we do it?

00:20:02 Speaker 3

And that, you know, call it assurance or advisory or whichever 1 you wind up with, you're setting the groundwork for partners working together to make things better. And the minute you become that partner, then that builds throughout the organization and and that grows and that grows. And I.

00:20:15 Speaker 3

I'm tearing up just a little just thinking about.

00:20:17 Speaker 2

Luckily for you, this is an audio only podcast.

00:20:20 Speaker 2

Right. No, no one but me gets.

00:20:21 Speaker 3

To see your tears joking up.

00:20:24 Speaker 2

One of my favorite things to do as a consultant practitioner is eqas.

00:20:29 Speaker 2

So external reviews of internal audit functions and part of why I'd like to do them as you get to understand the inner workings of what's working really well with an internal audit functions of what's not working so well and.

00:20:42 Speaker 2

To your point on advisory services and developing those relationships with management, having them seek you out.

00:20:47 Speaker 2

Know it's a when you go in, you start doing some as part of an eqa process.

00:20:51 Speaker 2

Very commonly will interview key stakeholders within.

00:20:53 Speaker 2

Management that goes one of two ways.

00:20:56 Speaker 2

You know what one way is if they're unhappy with the relationships they develop with internal audit. They use that as an opportunity to tell you all about the problems and.

00:21:03 Speaker 2

Pain points that they have.

00:21:05 Speaker 2

My favorite part of doing Eqas is actually when you go sit down with key members of management and you see a really well functioning internal audit department that's that's really spent the time and has a well respected chief audit executive and a team that is delivering on their.

00:21:19 Speaker 2

To the business.

00:21:20 Speaker 2

You hear it in the voice and the tone that stakeholders talk about the internal audit function.

00:21:25 Speaker 2

I was.

00:21:26 Speaker 2

I was very recently, you know, without sharing any specific names. Obviously very recently out.

00:21:31 Speaker 2

Minnesota, and we were doing, we were doing one of these and the level of positivity and the way that they talked about internal audit was a central part of the process and the team had really spent a lot of time developing key relationships and they they saw them.

00:21:45 Speaker 2

Key stakeholders and time and time again, every single time.

00:21:49 Speaker 2

I spoke to a stakeholder and management. The first thing they would talk about was the value propos.

00:21:55 Speaker 2

Ition of internal audit and how they see us as someone that they wanna bring to the table.

00:22:01 Speaker 2

Because we are delivering value and there's a level of trust and it was talked about in such a such a way of reverence that I I wish I could have heard that at.

00:22:08 Speaker 2

Every function that I that I visit because they weren't executing on advisory services quite well, you'd hear the business say I was going to go put in a new process, but I really don't want to do that until I ran it by internal audit and I talked to.

00:22:20 Speaker 2

About the different, you know, opportunities and risks and controls that needed to be in place.

00:22:24 Speaker 2

Yeah, we had the auditors with us.

00:22:27 Speaker 2

Every step of the way from the IDs ideation stage, all the way through implementation. You know, just hearing some of the words people are using.

00:22:34 Speaker 2

To me, that's an example of a really, you know, highly functioning department. And you know, I think if you kind of work backwards into some of the route, we always do root cause analysis when it's something negative happens. But when something positive like that, you think about the.

00:22:46 Speaker 2

Cause analysis.

00:22:47 Speaker 2

It goes back to the leadership and the style and the the way that they are doing their planning at the end of the day and.

00:22:55 Speaker 2

Question here. I'm just meandering a little bit, but when you think about the planning of an internal audit function and what makes a highly effective CAE and their leadership of the team.

00:23:04 Speaker 2

What do you think? Are you know are the ci es that are here or audit leadership that are listening into this can do to really effectuate some of this change within the group when when thinking about it this way from a relational perspective?

00:23:17 Speaker 3

Yeah, and I'll and I'll go to buzz words right off the bat.

00:23:20 Speaker 3

Your vision.

00:23:21 Speaker 3

I know that's a buzz word and I know we all have our objectives and our visions all kind of.

00:23:24

Stuff.

00:23:25 Speaker 3

Because what you've got to have is something that can be articulated.

00:23:29 Speaker 3

Most audit departments have something that looks like it's 1/2 of the II standard.

00:23:34 Speaker 3

You know, if they just goes on forever, can they quoted. So the point is, have you got something concise and easily understood so that you can you can explain this and live that vision?

00:23:45 Speaker 3

For the rest of the.

00:23:47 Speaker 3

So that then also when the executives happen to be talking to your auditors, what do you do for a living?

00:23:53 Speaker 3

Bam, they've got it.

00:23:54 Speaker 3

It just so happened that farmers insurance, we had a knife, came up with something that just worked for us.

00:23:59 Speaker 3

Solutions to customer.

00:24:01 Speaker 3

And every auditor can tell you who the customer was, what their needs were, what the.

00:24:05 Speaker 3

Were and how we were creative?

00:24:06 Speaker 3

And from that, you know, we're talking basically about having an elevator speech to give to the executive or anyone you talk to so that they understand the value that's being provided and that had to be quick. 'cause our executives were on the third floor.

00:24:19 Speaker 3

That's.

00:24:20 Speaker 3

That's a quick elevator, but in, in other words, does the leader know what the heck the team is trying to do to accomplish and do they have this vision of advisory beyond?

00:24:32 Speaker 3

Can they articulate that?

00:24:33 Speaker 3

Do they live it? And then does it get driven down to the point where the people at all levels can do that same speech to everybody throughout the department throughout the company?

00:24:43 Speaker 2

You've had on a lot of really important parts, but one thing you said that kind.

00:24:48 Speaker 2

Goes back to something I had said earlier too, which is sort of under, you know, it's really understanding our stakeholder needs, right? So you.

00:24:53 Speaker 2

That elevators pitch and the vision of the department, and aligning it to the organizational values and the culture.

00:25:00 Speaker 2

You have to know and develop your taxonomy and the way you talk about things to fit the organization that you are not.

00:25:07 Speaker 2

We can write a book about this and effectively if you said, say these 10 things, it's not going to work within every organization cause different personalities, different cultures exist, and part of how and why we embed, whether you're embedding as a consultant that.

00:25:21 Speaker 2

Consultant coming in or you're an internal in house internal.

00:25:25 Speaker 2

It's all about understanding the people and the culture and.

00:25:29 Speaker 2

Developing your vocabulary in a way that you can say things that influence change within the organization and to me, that's that's ultimately whether we're doing an assurance based project or an advisory project. If I were to summarize as simplistically as I could, what is the purpose of intern?

00:25:44 Speaker 2

Audit it's to really influence positive change within the.

00:25:47 Speaker 2

Now we have to do that in very careful and we.

00:25:50 Speaker 2

Phase and that's why we have standards, however.

00:25:53 Speaker 2

The best practitioners that I have seen, they are masters of influence. At the end of the day we we go into an area that we don't know a ton about always and we have to identify issues and we try to facilitate change happening in those issues without us.

00:26:06 Speaker 2

Having any direct?

00:26:08 Speaker 2

Oversight or control ourselves, and it's all about.

00:26:11 Speaker 2

So the nature and extent of what we're doing on the assurance side goes back to the same thing we're trying to talk about on the advisory side, which is how do you influence a stakeholder to deliver on the commitment to the organization?

00:26:23 Speaker 3

Key one which is alignment with our client's needs.

00:26:26 Speaker 3

And a fascinating thing I cannot over emphasize the need to pass information throughout the department.

00:26:33 Speaker 3

I don't know an auditor out there.

00:26:35 Speaker 3

Who I didn't.

00:26:36 Speaker 3

Know this? Or was this information I needed to know this?

00:26:39 Speaker 3

Wait a?

00:26:39 Speaker 3

And then there's.

00:26:40 Speaker 3

And it happened to me too that, you know, next thing I know, I'm a manager and I'm thinking, oh, they don't need to know all this.

00:26:46 Speaker 3

Oh no, they.

00:26:47 Speaker 3

You know, over inundate people with your auditors, with information about the organization, about the departments and what's going on with.

00:26:55 Speaker 3

If it's.

00:26:55 Speaker 3

Something they don't need in and out.

00:26:58 Speaker 3

It may be something.

00:27:00 Speaker 3

Getting information about the organization is the only way auditors can be effective, and it helps them too. As you mentioned, we go into departments. We don't know what's going on in a lot of them or what's happening and if we walk in just a little too naive and.

00:27:15 Speaker 3

Rossa will get eaten alive.

00:27:18 Speaker 3

Whereas we get at least a background information to understand what they're doing, and we can prove we're going to add value to that. Then it's that much better.

00:27:25 Speaker 2

This was a, you know, maybe it's not a.

00:27:28 Speaker 2

A diplomatic way to say it, but early in my career, when I first started, I was without saying the name. I was at one of the big four public accounting firms in an internal audit Co sourcing practice where we would go into a large internal audit functions and.

00:27:39 Speaker 2

Was.

00:27:40 Speaker 2

A20, you know, 22 year old right out of school. And I didn't know anything beyond what I had learned in class and I had to go into CFOs and Ci OS offices and try to tell them that they were doing or not doing.

00:27:50 Speaker 2

Something correctly and you know there was. There's no way as a even even someone now that.

00:27:55 Speaker 2

Has more than a couple years of experience.

00:27:57 Speaker 2

I won't say how long, but.

00:28:00 Speaker 2

It's it's. No, it's really the technical expertise that we.

00:28:04 Speaker 2

There's obviously a requisite amount of that that you need to have to be successful in your career, but so much of what we're doing in this day and age very similar to what.

00:28:10 Speaker 2

And I talked about when we had the our.

00:28:12 Speaker 2

Webinar on soft skills.

00:28:15 Speaker 2

Much of our success or failure isn't about our technical.

00:28:18 Speaker 2

Skill sets or?

00:28:19 Speaker 2

It's about how we can develop relationships and how we say things in a way that influences influences the decision.

00:28:26 Speaker 2

That's really the critical part here. When you get into advisory services, it becomes more and more important. And if you're a chief audit executive or a leader or early in your career practitioner that's trying to figure out, how do I do this more and get more experiences and.

00:28:40 Speaker 2

Of the things I did early on was I just said yes to a lot of things to be to be honest. And I got a lot of a lot of experiences in a lot of different places both.

00:28:48 Speaker 2

In my day job, I was a volunteer for the IIA early on I.

00:28:53 Speaker 2

I was, you know, looking for every opportunity to get in front of people and all of those interactions on top of developing a network really helped me to craft my story and the way I could talk to people to help advance, advance what we were trying to ADV.

00:29:08 Speaker 3

In the talking people, may we kind of hit this in a couple of different ways, but I'll go back.

00:29:13 Speaker 3

This is where it started.

00:29:15 Speaker 3

We have to go in talking to people, working with people, not like we're auditing.

00:29:20 Speaker 3

We have to go in like we're consulting.

00:29:22 Speaker 3

And your mindset is instantly different when you think I'm consulting with these people now, that doesn't mean you're not doing insurance work, but you're still. It's your mind just works differently when you go.

00:29:32 Speaker 3

I'm consulting with.

00:29:34 Speaker 3

I'm part of the team as as opposed.

00:29:37 Speaker 3

To now you.

00:29:38 Speaker 3

We still have a lot of people out there that think their internal auditors and you know they they're still a lot of cops out there.

00:29:45 Speaker 2

100%.

00:29:46 Speaker 2

So it's well said.

00:29:47 Speaker 2

And you know, the other thing I would just say is if you're a practitioner.

00:29:50 Speaker 2

There there's. If you're a practitioner earlier in your career or see looking for opportunities for your team. Training is always a good opportunity.

00:29:58 Speaker 2

There are.

00:29:58 Speaker 2

Yeah, I for example has a great mentorship program where you can connect.

00:30:02 Speaker 2

You know, connect someone early in their career with someone more senior and it gives them another input and it's really just all about getting more inputs into what you're doing so that you can develop some of those skill sets and you know, look, look to some of the.

00:30:13 Speaker 2

Practice guides that are out there, but talk to your peers.

00:30:16 Speaker 2

About what they're doing from a from an advisory services perspective, because I think you'll find that.

00:30:21 Speaker 2

No2 departments are doing it.

00:30:22 Speaker 2

The same.

00:30:23 Speaker 2

A lot of us are figuring it out.

00:30:25 Speaker 2

There's a lot of best practices that are out there, so as we go to different events and conferences and as we get get in person with people, I mean so much of those interactions is where you know where these ideas formulate and how we how we get better.

00:30:37 Speaker 2

At what we do.

00:30:38 Speaker 3

Melania night this last.

00:30:40 Speaker 3

And this one we've thrown out.

00:30:42 Speaker 3

6012 different ideas, you know. And so when you're hearing this and you're going well, wait a minute. I want more on that.

00:30:48 Speaker 3