5 Ways Boards Can Support Internal Auditors
May is International Audit Awareness Month. It’s a time for financial institutions to recognize the contributions of the internal auditors who toil behind the scenes, checking everyone’s work to make sure the FI is safe, strong, and following all its policies and procedures.
Need suggestions for how you can recognize these diligent advisors? Here are the five things internal auditors most want from the board.
1. Independence. Internal audit answers to the board, but that doesn’t mean that audit gets its marching orders from the board. Objectivity is critical to the audit function. Auditors are tasked with reviewing records for accuracy—whether that’s financial documents or assurance that compliance policies and procedures were followed.
An auditor should never be told to prove that records are correct. It’s not their job to tell the board what it wants to hear or justify that management is doing a good job. Internal auditors exist to attest to the truth or validity of documents. If they can’t confirm that everything is correct, they need to feel comfortable sharing that information.
2. Recognition that auditors didn’t cause the problem. It’s natural for board members to be frustrated or unhappy when an auditor brings issues to the attention of the board, but remember the old adage: Don’t kill the messenger.
Internal auditors uncover problems and report on them—but they did not create them. They are merely reporting on them so they can be corrected to avoid bigger problems later on. The board doesn’t have to thank an auditor for discovering problems (though thanks are always welcome), but it shouldn’t blame the auditor.
3. Sufficient knowledge, resources, and tools. As risk management grows more integrated with audit, the internal auditor workload has significantly increased. Internal auditors are responsible for a variety of in-depth audits touching nearly every area of the institution.
To keep pace, auditors need ongoing training so they have the knowledge needed to effectively audit an area. They don’t need to be an expert in compliance or other audited areas, but they do need to know enough to understand what they are reviewing.
Auditors also need tools and resources to manage their workload and stay organized. Audit management software helps internal auditors work more efficiently by giving them centralized access to the information they need, saving them hours in board report preparation, workpaper compilation, and communicating findings with those in the position to address them. Certifications are a great way to establish a baseline of knowledge for all audit staff, as well as to help assure that core competencies are being maintained through continuing education requirements. Governing bodies such as the Institute of Internal Auditors (IIA) offer internal audit training, certification, and continuing education.
4. Access to documents. Auditors need access to relevant, well-prepared documents to do a good job. From board minutes to accounting records to risk assessments, auditors can’t verify the effectiveness of a process or financial result if they aren’t provided detailed documents.
5. Findings follow up. Auditors work diligently to find mistakes and oversights that could put a financial institution at risk and offer recommendations for remediating them. There is nothing more frustrating for an auditor than reporting a serious problem and watching as the board and management continue to ignore or forget about the problem.
Auditors don’t want to find the same mistake over and over again. It’s not just personally frustrating—it’s bad business that can create legal, financial, strategic, reputational, and regulatory compliance problems for the financial institution.
The board should actively follow up on audit findings, particularly the significant ones, to ensure they are being promptly remediated. A good findings management solution is a great place to start.
Make sure your financial institution’s internal auditors are getting the support they need to do a great job for your institution.