Sam Abadir (info@lockpath.com) is Vice President of Industry Solutions at Lockpath Inc. in Overland Park, Kansas, USA.
Make the audit department my best friend, you say? That may seem like an awkward proposition if you’ve grown to dread visits from auditors. Auditors have ended up in a category of people we’d rather not spend time with, yet they fill essential roles that keep us on track and away from various disasters. So why don’t we like to see them coming? Typically, it’s because they disrupt our work and provide feedback that we may not agree with.
Changing the dynamics of your relationship with auditors is possible and can establish a fruitful collaboration going forward. To foster this relationship, business units should bring in internal audit on a regular basis so that both groups can get on the same page about goals, processes, regulatory and safety requirements, policies, audit procedures, and dates. This not only makes your life a lot easier when the auditors come knocking, but also makes it possible for internal audit to fulfill its responsibilities with more understanding and context, which in turn will benefit the business in many ways. Sounds like a better cycle than dread, avoid, delay, repeat—doesn’t it?
The value of audit
Leading organizations rely on internal audit to be insightful and objective on a variety of topics related to governance, risk management, business goals, and strategic objectives. When it comes to risk management, there are three distinct defense roles:
-
Operational management, which owns and manages the risks.
-
Risk and compliance function, which supports the first line.
-
Internal audit, which validates and verifies the second line’s risk and control assessments.
Boards and executives focused on risk may see the inherent value of audits, but for business units, the whole process is often an afterthought, viewed as a necessary evil. Audits have a negative connotation for several reasons:
-
Auditors often don’t understand what the business unit is doing.
-
Audits take a lot of the best people’s time, shifting focus away from operational or revenue-generating activities.
-
Audit findings can make the business unit look bad and create more work, often of a tedious or resource-intensive nature.
It doesn’t have to be this way. By following best practices throughout the enterprise and across all governance, risk management, and compliance (GRC) activities, you can build a more effective and efficient audit preparation system, which will improve business and compliance processes overall.
