For many internal auditors, the audit committee can often seem elusive. While internal audit teams diligently prepare reports and materials for this important subgroup of the board of directors, what happens behind the closed doors of audit committee meetings remains largely unknown to most. Internal auditors understand that the audit committee takes their work seriously, but the question remains: What does the audit committee really want from internal audit?
Even for experienced internal audit leaders, presenting to the audit committee can be an intimidating experience. Audit committee members are typically seasoned executives, often serving on multiple boards, and they bring a wealth of knowledge and experience to their part-time governance role. They may occasionally raise proactive questions, but most of the time, they react to the information presented to them. This places the responsibility on internal audit leaders to provide the most relevant and valuable information to support the committee’s governance responsibilities.
Finding the right balance between too much detail and ensuring key points are made is a challenge for many internal auditors. The goal is to make the most of the limited time with the audit committee while avoiding overwhelming them with excessive information. So, what exactly does the audit committee expect from internal audit?
What the Audit Committee Doesn’t Want
One of the most common mistakes made in internal audit reporting is overloading the audit committee with too much information. While it may be tempting to showcase the full breadth of the internal audit team’s work, the audit committee is not interested in every detail. The tendency to provide excessive background and unnecessary detail often leads to information overload, diluting the key points that truly matter.
Audit committees rely on internal audit leaders to deliver concise and relevant insights, not an exhaustive account of every project. The focus should be on what the audit committee needs to know to make informed governance decisions, not on showcasing the internal audit team’s full efforts. Clear, succinct communication is essential.
What the Audit Committee Does Want
Through careful observation and analysis, several key themes have emerged regarding what the audit committee expects from internal audit. These insights can guide internal auditors in their interactions with the committee.
1. Get to the Core Message Quickly
Audit committee members are busy, high-level executives, and they value efficiency. They want internal audit to present the essential points clearly and concisely. The focus should be on delivering the “essence” of the matter—what is important, why it is important, and what action is recommended. Superfluous details should be avoided, as the committee’s priority is understanding the critical issues and their implications.
2. Focus on Conclusions, Not Processes
While internal audit teams may spend significant time and effort on audits, the audit committee does not need a detailed account of how conclusions were reached. Instead, they want to know the final conclusions and key takeaways. The process behind reaching those conclusions, while important to internal audit, should be summarized briefly, as the committee’s primary interest is in the results and their impact on the organization.
3. Provide Opinions, Not Just Facts
Internal auditors often focus on presenting data and factual findings, but the audit committee also values professional judgment and informed opinions. Based on the internal audit team’s unique insights and experience within the organization, the committee wants to hear opinions on key issues. Offering well-reasoned insights helps the audit committee make better governance decisions and demonstrates the value of internal audit’s perspective.
4. Raise Concerns—Audited or Not
Even if a particular concern has not been formally audited, the audit committee expects internal auditors to raise any significant issues or risks they have observed. While speculation and unverified theories are unwelcome, top concerns that could have major implications for the organization should be communicated. The audit committee relies on internal audit to highlight potential risks, even when they are outside the immediate scope of an audit.
5. Deliver Meaningful Content in Executive Sessions
During executive sessions, where the internal auditor meets with the audit committee alone, it is essential to bring forward substantive issues. The audit committee does not expect trivial matters to be raised, but it also anticipates that important issues will be addressed in these sessions. Striking the right balance is key—internal audit leaders should ensure that the content discussed in executive sessions is significant and warrants the committee’s attention.
6. Demonstrate Understanding of the Business and Strategic Plan
A common concern among organizational leaders is whether internal audit truly understands the business and its strategic direction. To build trust and credibility, internal audit must demonstrate a strong grasp of the organization’s strategic objectives and ensure that this understanding is reflected in audit priorities and findings. The audit committee needs confidence that internal audit is aligned with the broader goals of the business and can provide insights that support the organization’s success.
7. Align with Second-Line Functions
Internal audit is not an isolated function; it must coordinate and collaborate with other second-line functions such as risk management, compliance, and security. The audit committee expects internal audit to take a proactive role in ensuring these functions are aligned and that the organization’s risk and control activities are integrated. Redundant efforts and disjointed reporting can lead to confusion and inefficiencies, which the audit committee wants to avoid.
8. Exhibit Courage in Raising Difficult Issues
From time to time, internal auditors will encounter challenging situations, such as resistance from audit clients or the need to address sensitive issues like fraud or ethical concerns. In these moments, the audit committee expects internal audit to demonstrate courage and raise these issues, regardless of the potential consequences. Having the strength to address difficult topics is a critical part of internal audit’s role in governance.
9. Understand the Politics, But Stay Objective
Organizational politics are inevitable, and internal auditors must navigate these dynamics carefully. While internal audit should avoid becoming too political, understanding how to manage relationships and communicate effectively within the organization is essential. The audit committee expects internal audit to be politically savvy while maintaining its objectivity and independence.
10. Recognize When Objectivity May Be Impaired
Objectivity is a cornerstone of internal audit, and the audit committee expects internal auditors to be self-aware when their objectivity may be compromised. Whether due to personal biases or external pressures, it is important for internal audit to acknowledge when objectivity could be at risk. Transparent communication about potential conflicts of interest helps maintain the integrity of the audit process and builds trust with the audit committee.
Conclusion: Delivering Value to the Audit Committee
The audit committee relies on internal audit to provide focused, insightful information that supports their governance responsibilities. They expect concise communication, professional opinions, and a deep understanding of the business. By raising significant concerns, collaborating across functions, and navigating organizational politics with integrity, internal audit can deliver the value that the audit committee needs to guide the organization effectively.
Internal audit leaders who meet these expectations not only enhance the effectiveness of the audit committee but also strengthen the organization’s overall governance framework.