Internal auditors must take ownership of how we’re perceived

Perceptions of internal audit have evolved over the years. I’ve devoted much of my career to championing this evolution. After all, being seen as compliance-obsessed “corporate police” — a persistent stereotype plaguing the profession — isn’t exactly conducive to building reputations as trusted advisors committed to delivering value to the organization.

Stakeholders define internal audit’s mission, and (like it or not) are the ones who ultimately determine our value. For better or worse, the evolution of how we’re perceived mirrors how stakeholders have assessed our value. That’s why I’m sure many of us didn’t enjoy what we saw in the mirror supplied by certain findings in the Internal Audit Foundation’s (IAF’s) Vision 2035 report.

Vision 2035 asked internal auditors to characterize how they think internal audit is viewed in their organizations. Overall, perceptions were significantly out of alignment with how most internal auditors would prefer to be viewed. For example, nearly half said internal audit is viewed as “police,” and more than half that internal audit is seen as “compliance-focused.”

Nobody likes feeling misunderstood or misjudged. However, correcting these perceptions requires us to move past hand-wringing and hurt feelings to take a hard look at stakeholders’ current perceptions. What can we learn from them? More importantly, how can we use these insights to change how we are viewed?

Exploring the size, shape, and origins of the gap

Evolution is a necessity for every profession. Indeed, since internal audit formally became a profession near the turn of the 20th century, the role has expanded and changed to fit the needs of the organizations it serves. Today, the Global Internal Audit Standards’ definition of internal audit’s purpose reflects a commitment extending far beyond the stereotypical characterizations:

“Internal auditing strengthens the organization’s ability to create, protect, and sustain value by providing the board and management with independent, risk-based, and objective assurance, insight, and foresight.”

The internal auditors I know strive to make good on this noble purpose. That’s why the Vision 2035 findings struck me as enlightening and troubling in equal measure. There is a significant gap between the image we aim to project and the way stakeholders see us.

What are the root causes for this gap? Is the disconnect driven by stakeholders’ inaccurate perceptions, or by genuine shortcomings in internal auditors’ performance? Regardless, internal auditors need to address this gap through word and deed. Defensively saying “you’re wrong” achieves nothing. In the words of Ralph Waldo Emerson, “Your actions speak so loudly, I can’t hear what you’re saying."

We can start by taking a long, hard look in the mirror offered by these findings. Here are the good, the bad, and the ugly as I see them:

• Good:
  • “Independent” was the #2-ranked response — encouraging, given internal audit’s mandate to provide independent, objective assurance and advice.
  • Two in five respondents said they’re viewed as “trusted advisors” and “internal consultants.”
  • Approximately one-third of respondents said they’re seen as “respected,” “collaborative,” and “problem solvers.”
• Bad:
  • By implication, the other two-thirds don’t feel they’re seen as “respected,” “collaborative,” or “problem solvers.”
  • Overall, the top three responses lack positive perceptions. And while “independent” is still a net positive, it can also be seen as setting us apart from our organizations.
  • The five lowest-ranking responses — “strategic,” “holistic thinkers,” “curious learners,” “dynamic,” and “technology experts” — represent increasingly critical characteristics for internal auditors in the era of permacrisis, AI, and ever-increasing risk velocity, volatility, and complexity.
• Ugly:
  • Again, “compliance-focused” and “police” were top-three responses — the very stereotypes the profession has been striving to avoid.
  • Only 28% said they feel “valued,” suggesting 72% don’t.
  • A mere 21% said they’re seen as “change agents.” As I wrote in Agents of Change: Internal Auditors in the Era of Permacrisis (AoC), “To truly impart value to our organizations, we must be catalysts for transformation that creates value within the organizations we serve… we should be influencing positive change that enhances our organizations’ value.”
  • Only one in five said they’re viewed as “good communicators.” By this point, effective communication should be table stakes.

This is not a good look for the profession. Perception is often reality, after all. Even if we think they’re wrong, it doesn’t follow that they are indeed wrong.

Take strategic action to narrow the gap

If there are perception gaps between how internal audit wants to be seen and is seen, it’s up to us to address those gaps. Every internal auditor should take ownership of how internal audit is perceived in their organization.

As the old saying goes: “You can’t control what others think, but you can control what you show them." This is where strategic plans come into play. If we aim to be seen as valued, respected, trusted, collaborative, dynamic strategic advisors and change agents, we must plan and execute actions that prove out these capabilities:

• If stakeholders’ perceptions are misguided (i.e., you are collaborative, but they’re just not seeing it), you need a strategy for creating greater awareness.
• If perceptions are legitimate, your strategy should identify and address the areas where you’re falling short. What value are stakeholders seeking, and what specific actions can you take to provide it? Are you dedicating significant resources to efforts stakeholders don’t value? If such efforts are genuinely unnecessary, how can you recalibrate?

Again, our stakeholders define our mission. Accordingly, it’s vital to periodically ask stakeholders for direct feedback. Delivering value requires us to continually reassess — and adapt to — stakeholders’ evolving needs and expectations.

Seek out targeted guidance

My books, blogs, and articles focus on coaching internal auditors on how they can improve in all the areas highlighted by the Vision 2035 graphic. Of course, you can also find excellent guidance from other thought leaders, the IAF, The Institute of Internal Auditors, Chartered Institute of Internal Auditors, academic publications, and Big Four and other consulting firms. But I know my own work best, so I humbly offer the following non-exhaustive resource list:

• Compliance-focused “police” — AoC Chapters 4 & 11; Blog
• Independent and objective — AoC Chapter 3; Connected Risk: Conquering the Perilous Risk Exposure Gap (CR) Chapter 7; Blog; Blog
• Trusted advisors and internal consultants — Trusted Advisors: Key Attributes of Outstanding Internal Auditors (TA) (all); The Speed of Risk: Lessons Learned on the Audit Trail (SoR) Chapters 2 & 16; Blog
• Respected and valued — TA Chapters 7 & 10; AoC Chapters 7 & 10; SoR Chapters 3–4 & 16; Blog; Blog
• Collaborative — CR Chapters 8–10, 12 & 14; Blog; Blog
• Problem solvers — TA Chapters 4–5; SoR Chapter 7; Blog; Blog
• Change agents — AoC (all); Blog; Video Series
• Boring — TA Chapter 8; Blog; Blog
• Good communicators — SoR Chapter 9; TA Chapter 7; AoC Chapter 7; SoR Chapter 12; Blog; Blog
• Strategic, holistic thinkers — TA Chapters 9–10; AoC Chapters 8–9; SoR Chapters 10–11; Blog; Blog
• Curious learners — TA Chapter 4; SoR Chapters 1 & 11; Blog
• Dynamic — AoC Chapters 2, 4 & 6; CR Chapters 13 & 15; SoR Chapters 6–8; Blog; Blog
• Technology and data experts — CR Chapter 11; AoC Chapter 6; Blog; Blog

Internal auditors can embrace these Vision 2035 findings as a strategic planning punch list. It’s within our power to shape how internal auditors are perceived. Take ownership of how internal audit is perceived in your organization. In the end, if we don’t define ourselves through deed and action, someone else will define us by what they do not see.

About the authors

Richard Chambers, CIA, CRMA, CFE, CGAP, is the CEO of Richard F. Chambers & Associates, a global advisory firm for internal audit professionals, and also serves as Senior Advisor, Risk and Audit at AuditBoard. Previously, he served for over a decade as the president and CEO of The Institute of Internal Auditors (IIA). Connect with Richard on LinkedIn.