Stakeholders influence can be determined by assessing:
Critical – their influence integrity of the business value chain.
Constituency – the importance they represent.
Credible –the views held by others.
Capacity –the resources they have at their disposal.
Control –their power over organisation‘s interest.
Connection –their access to networks and how they can influence them.
A two-way process
Working with stakeholders is a two-way process. Regular face-to-face meetings enable internal auditors to highlight the function’s role in good governance, and explain the value of the independent and objective assurance. Stakeholders on the other hand have an opportunity to talk about internal audit performance and flag risks or issues they would like to see in the internal audit plan.
There may also be external as well as internal stakeholders so the emphasis of key messages may be different depending upon the audience. Here are some simple ideas that might form part of a Stakeholder Engagement Plan or a component part of internal audit strategy:
1. Develop an induction programme for new audit committee members, senior managers and external stakeholders.
2. Organise separate management meetings and earmark sessions during audit committee meetings to provide updates and relevant information. This could include changes in legislation, regulation, risk management and professional internal audit practice and how this might impact the organisation and the delivery of internal audit.
3. Put together an intranet or internet site that contains useful and relevant information making sure it is kept up to update. (This might include, for example, product offerings, information on the service or key information).
4. Prepare and issue an internal audit newsletter or brochure containing information about the service.
5. Prepare short guides relating to the internal audit process, internal audit involvement in projects, internal audit’s role with regard to risk management etc.
6. Schedule periodic meetings with key stakeholders, even when there is no direct engagement activity in their area, to keep alive to business change and the potential for new and emerging risks that might call for a revision to the engagement plan.
Understanding stakeholders needs
Internal audit provides value to the organisation and its stakeholders when it delivers objective and relevant assurance, and contributes to the effectiveness and efficiency of governance, risk management and control processes. To achieve this aim the head of internal audit must have an internal audit plan that reflects the things that are important to stakeholders. In other words a plan that focuses upon the challenges and risks that stand in the way of strategic and other key objectives.
Invest time
You must invest sufficient time in talking to stakeholders to identify and assess priorities. ‘The Chief Audit Executive must communicate the internal audit activity’s plans and resource requirements, including significant interim changes, to senior management and the board for review and approval’. This means doing so in a timely fashion, having consulted and taken account of what stakeholders want.
Know what’s important
Knowing what’s important to stakeholders – learning what is ‘on their mind’ – is therefore critical. In practice there may be competing priorities and pressure to deliver a wide range of assurance with limited resources but proactive engagement with the audit committee and senior executives is the best way to resolve problems. Internal audit’s independence and objectivity can only be enhanced by weighing up the relative importance of stakeholder issues and making difficult decisions about what to audit, when and by whom.
Our simple message is talk to your stakeholders, particularly your audit committee chair and find out what he or she wants from internal audit. This not only includes the focus of the internal audit plan but also internal audit processes, such as:
• expressing opinions,
• reporting styles,
• performance monitoring, and
• quality assessment.
Do this often so that internal audit is in tune with current concerns and have an internal audit plan that is flexible. If need be review and update the plan at the half year point or even quarterly if circumstance dictates.
Continuous process
Working with stakeholders is therefore a continuous process rather than a one-off annual exercise, which requires the involvement of all internal auditors to build and maintain an up to date picture. Collecting and sharing information can take many forms and a planned approach with pooling of information will help, particularly for larger internal audit functions. Design a process that brings information together; share it within the internal audit activity to ensure that all auditors are aware of the main business drivers and risks, analyse it and make planning decisions based upon key risks and issues. One of the most important aspects to think about is the style, frequency and content of communications for each audience so that it is easy for them to get involved. Also consider the balance and benefits of formal and informal protocols. From surveys and interviews we know that audit committee chairs and CEOs like the head of internal audit to be an informal sounding board with whom they can discuss risks and explore practical responses.
