Managing Internal Audit – It’s a Brave New World

Things have changed, likely for good.

Managing internal audit remotely was not something that was a matter of routine for most, at least pre-Covid. Granted, the larger and more complex your organization was prior to the pandemic, you may very well have managed elements of a distributed workforce, but rare was the case of a 100% remote workforce. And, add to that, you as the Audit Manager, Audit Director or Chief Audit Executive (CAE) being remote, too. But that world was thrust upon most all of us sometime around March of 2020. That new world has clearly raised some unanticipated opportunities (such as technology adoption and enhanced productivity) and some interesting challenges (such as relationship building, teambuilding and on-boarding new staff).

The year 2020 was, arguably, the toughest year of their lives for most everyone. Working remotely has not been a panacea of liberating freedom for many professionals, as much as it might have been thought to be desirous.

Has it been bumpy if not rather difficult at times? Has it presented unpredictable challenges? Has it increased the amount of time you spend on personnel-related matters? Has it made managing people more complicated? Has it made collaboration and relationship management cumbersome? From all the anecdotal feedback we are hearing talking with countless CAEs, the resounding answers across the board have been “YES, YES, and YES”.

Some have gone so far as to hypothesize that the way we work has changed for good and how we deal with managing, motivating, evaluating, and interacting with the people we are responsible to lead altered permanently as a result. And that new way of working may not even be because of fully embracing a WFA (work from anywhere) practice, but certainly a more modified remote working reality into the foreseeable future.

Some Things That Are Definitely Different

For each topic, let us look at some of the considerations that changed in a remote working environment from the way we might have done them previously:

Co-sourcing –

 Old way: Gain comfort with the individuals on the project though IN PERSON interaction.

 New way: Rely much more on what you hear, and proactively seek out, from your internal clients on how the third-party personnel are performing.

On-boarding –

Old way: You, or a member of your senior staff, meet frequently IN PERSON with the new employee and gauge how they are doing.

 New way: Be much more deliberate with your check-ins, both scheduled and unscheduled, and talk more openly about culture, fit and overall comfort with the intangibles of working in the new company (not just about the work and the work product itself).

Teambuiliding –

Old way: You would work with your staff on some team building exercises, potentially at an off-site location. While some specific audit department things might be programmed and discussed, such as planning, the primary purpose was to allow everyone to get to know each other better as individuals.

New way: Well, it is likely little to no teambuilding sessions, at least one or more days long, have been held with your staff since at least March of 2020. Some real creativity needs to be employed here and may require that a portion of some of your virtual staff meeting have a teambuilding component. Regardless, while it is easy to set this aside, doing teambuilding activities are important to ensuring that people see what they do as being about more than just the work.

Relationship Management –

Old way: You’d walk the halls of the office location, drop in on superiors, colleagues, co-workers. You’d have impromptu chats, even on the way to and from the washroom. You’d say to someone, or they’d say to you, “let’s go to lunch”.

New way: You might have to text someone, send them a Slack note, see if “they could spare a few minutes”, and/or schedule a recurring touch base Zoom call, just to do your best to keep the lines of communication open.

Audit by Walking Around –

Old way: When in an office setting, you could get up from your office, your cube, or your workstation and just walk about. Whether or not you actually talked with anyone, or lots of people, on some of these daily excursions, you learned things … both consciously and subconsciously, from what you heard, saw, and inferred.

New way: Well, too many of those walks might just be around your house or remote work location. Not sure there is a suitable substitute for this one, and that will be to the detriment of internal audit functions into the foreseeable future.

Performance Evaluations (and Coaching Sessions) –

Old way: We’ve all been advised that evaluating performance is much more than an annual performance appraisal review. But, each organization has its own rituals around performance evaluations and how they get inexorably tied to merit increases. Regardless, managing and evaluating performance is something that feels like it should be done in person, face-to-face, as that is the best way to make sure it is a dialogue between two people.

New way: Probably, in many respects, performance evaluations have or will be done virtually, potentially in a video call. While it is better than by phone in that you can see each other, it is not as conducive to a real conversation and does not feel as “personal” as a face-to-face discussion. In these times, frequent and interactive discussions about performance become ever more important, if the “annual review” is going to be done remotely.

Collaboration –

Old way: Focusing on the other risk and compliance functions in the organization, the expectation (rightly so) is that you are collaborating on, and coordinating activities with, areas such as compliance, legal, risk management, and so on. You did this by having periodic meetings that might be scheduled, as well as frequent informal conversations. That way, you were appearing to duplicate efforts, and doing your best to ensure the organization avoided “audit fatigue” in certain areas.

New way: You may still have standing meetings, via video conference, to ensure coordination with these other functions. And many of the colleagues you work with across functions might be in your cell phone speed dial. But it seems like the ability to coordinate and collaborate is harder, or at least takes more work. Certainly, the ability to coordinate and collaborate with ease is based on long-standing relationships that may fade over time, or be completely new with turnover of personnel.

Change Initiatives –

Old way: When you were or your staff were involved in key organizational changes initiative, because you knew that there is always a lot of risk in such projects, there were usually frequent in person meetings of members of the team. And, before these meetings, you could informally interact with the people assembling and discuss things relating to the project. As well, after the meetings, you could walk down the hall with someone else who was leaving the meeting to discuss something that just may not have sounded right to you.

New way: While technology does certainly allow for the ‘sidebar’ chats, they are a little harder to do. And, facial expression and body language, key to picking up on what people truly believe versus what they say, is not as easy to follow in video conference meetings. So, you will need to have more “follow-up”, potentially, with key individuals to discuss things, as well as more structured “pre-meetings” to make sure your concerns are going to be addressed and the risks are appropriately discussed.

New Peer Colleagues –

Old way: The “peers” for the CAE are those people who are at similar level of the organization and might be folks where frequent communication and collaboration is in the best interests of all parties. At a minimum, this would include the heads of compliance, legal, risk management, IS security, and so on. Generally, when having the ability to interact in person with many of these professionals, the relationships are strong and great coordination and collaboration follows suit. If there is a change in personnel with one of these key “allies,” regardless of reason, there is a need to start over with the new person. When you were physically in the office together, drop-bys, lunches, regular meetings, etc. would be relatively easy to do and the in person, face-to-face interaction would do wonders in helping to jump start that new relationship more smoothly.

New way: Perhaps, while working remotely, you had the opportunity to video interview the new incumbent or, even better, they are someone promoted into the role. But, regardless, you must be a lot more proactive in reaching out and establishing a relationship with the new colleague. They will have a lot of anxiety, either because of joining the new organization and having a lot to learn or being promoted into the role and having some possible self-doubt and insecurities. Regardless, now it the time to, as they say, bend over backwards and help this person be a success in the new role. The dividends will be notable, and you will have a new colleague that will never forget the role you are playing in helping them be successful.

Travel –

Old way: If an audit needed to be done at a location where you didn’t have audit staff present, and you weren’t employing external resources exclusively to complete the audit work, you would have staff travel for certain or all aspects of the project (e.g., opening conference, fieldwork, closing conference, etc.). Whether by car or airplane, the cost of travel for audit work in terms of money and time were built into your plans.

New way: As we’ve learned that much of the work, albeit not the best way to make and sustain relationships, can be done remotely, travel for internal audit work will no longer be the “norm”. It will become, more and more likely, the exception. And, quite possibly that goes for training and conference attendance as well.

Interactions with the Audit Committee –

Old way: Generally, at least quarterly (and for many in certain industries and/or publicly traded companies in some countries) you met in person with the Audit Committee (AC). And, unless the logistics were not easily manageable, you met, separately, with AC Chair. So much easier to get a feel for body language and reactions in person, especially with a group of folks that might not always say what they are thinking.

New way: Well, unless it is necessary to come together in person, or the CEO and/or CFO sustain an expectation of in person interaction, many or most (or all?) AC meetings may be done remotely leveraging technology. As the individuals on the AC change, over time, that will introduce all those relationship challenges we’ve already brought forward. So, perhaps, more one-on-one video meetings with at least the AC Chair and, if the situation allows, other members of the AC, individually, may need to become standard practice so that you are forging the relationships that are so important with these critical stakeholders.

Conclusion

If anyone is waiting around for a return to normal, or a new normal, they might have a long wait. What is certain seems to be that the prior state of how we approach our work and how we interact with each other in the workplace has changed forever. And, what we used to consider normal is no longer what will be the case either. Regardless, it will be new, and it will not feel normal. We, as a profession of internal auditors, have adapted to the current state and we will adapt to the new state of things. It will require a level of use of technology, nimbleness, flexibility, and interpersonal interaction that we have never deployed at any time in our careers. But all these changes were always on the horizon. It is just that factors conspired to accelerate those changes. We are ready, willing, and able.