Choosing an internal auditor comes with a surprising amount of pressure. Because having a strong control environment minimizes the risk of loss, you need someone who understands the risks common to your industry, who knows your organization inside and out and what controls need to be in place to mitigate and reduce risk.
You don’t want someone who will come in with a standard, check-the-box list and — with little knowledge of your operations, personnel and overall business — fail to audit the right controls and miss certain risks you’re inadvertently taking.
So, when you meet with a potential internal auditor, what specifically should you look for? Here are five key skills of an internal auditor and the areas they should demonstrate expertise in:
1. Your industry
A firm may work with thousands of companies “just like yours,” but are they similar in size and nature? Are they even in your industry? You need an internal auditor with industry experience because they’re more familiar with the risks and can carry over past experience and effective controls they’ve seen at other organizations within your industry.
2. Customization
Even when you do find an auditor with industry experience, it’s important to make sure they customize their process to your organization and its specific risks. Every organization is different. Even your audit from year to year will be different. Your auditor must tailor their audit to your unique risks, the goals of your stakeholders and the regulatory requirements you’re obliged to meet. When you meet with a new auditor, ask them how they tailor their audit to the different organizations they work with.
3. Critical thinking
Critical thinking is one of the most valuable attributes an internal auditor can possess. Internal controls are never one size fits all. Your auditor must be able to break a process apart, identify its weaknesses and recommend where and how it can be improved. Change is constant, and your internal audit should be flexible to match the changes in your control environment. Your auditor needs critical thinking skills to keep up with these changes and identify new risks.
4. Ways to improve
Your auditor is a fantastic resource to help you not only close gaps and reduce risk but also improve your overall operations. Does it take 10 people to complete a process when it should only take five? The right internal auditor should be able to identify this.
You want someone who won’t stop at simply testing your existing environment for risk. You want an internal auditor who will find ways to strengthen the environment — who will provide valuable recommendations.
5. Expectations-setting
Lastly, look for someone who is focused on setting expectations ahead of time. It’s critical for both your organization and the internal auditor to have open and honest communication about expectations. You need to articulate your goals for the audit (which has the added benefit of helping to measure success at the end of it). They need to ask questions, get to know your organization and understand how you can best work together. Without setting expectations, you’re taking the risk of undergoing a subpar audit that doesn’t meet your stakeholders’ goals.
How do you ensure the firm you choose has these qualities?
During your RFP process, you’ll be able to identify promising internal auditors that you can then meet with to hold deeper conversations. Make sure you meet with someone who will actually be on your audit team and run the engagement — not just a business development person who knows all the right things to say but won’t be involved in the day-to-day work.
Don’t be afraid to ask questions. Assess their communication style and practices and whether they’d be a good fit with your organization. Be transparent with your expectations (you certainly don’t want them to repeat the mistakes of a past auditor).
If you’re looking for the right internal auditor, consider working with Wipfli. We bring deep experience in a wide range of industries, and our team embraces a consultative mindset that assesses your true risks and works with you to develop a strong, tailored internal audit plan.
Click here to learn more about our internal audit services.
Sign up to receive additional audit content and information in your inbox, or continue reading on:
Author(s)
