june 2017 28 Internal audItor
I interviewed. I should have been more cautious and said
it was a deal breaker if I didn’t talk to the board. You have
to square all of that up before you start. Once you’re hired,
you don’t have a whole lot of places to go for help.” That
anonymous auditor adds that you should definitely establish
boundaries at the interview and make sure to vet the reporting structure at the place they’re going to work— and to
walk away if you’re not comfortable. If you’re deceived, it’s a
tough place to be. For his part, Patton even advises negotiating a contract that allows the audit department to have its
own outside attorney.
Once on the job, all auditors should build relationships
with the people with whom they work, Memmott advises.
Start by winning over staff, he suggests, to “learn who
they are and get a feel for trends. Meet your colleagues,
understand what they’re working on and the context they’re
working in.” That should be clear from governance documents. Internal auditors should then use that insight to
shore up potentially troublesome relationships and make
sure the governance documents that define the internal
audit function are known to, and understood by, everyone. Don’t assume anyone has read your charter, Memmott warns. “Try to make sure everybody is on the same
page when something happens.” Take a look at past audit
reports, too, he suggests. What do they look like? What
have the responses been? Has there been a high level of
agreement or disagreement? One sign of trouble, he notes,
is terminated audits or bad or no responses to them.
Internal auditors also can improve their chances of
surviving a political challenge by maintaining strong communications with management and showing through their
work that they value being part of the team, says George
McGowan, director, audit services and management support,
for the City of Orlando, Fla. “Internal auditors are just as
much managers over the quality of city services as those in
the operating departments,” he says. “We need to demonstrate this level of care when we interact with managers. They
need to know that we want the city to be successful in delivering its services and we don’t get any pleasure from pointing
out flaws and troubles.” That doesn’t mean shirking duties,
he emphasizes. “In the end, that responsibility does fall to
us,” he notes, “and it is necessary to develop a record of the
conditions we find as well as what can be done to change the
outcome to a positive.”
When crisis arises, and with it the potential for political retaliation against an internal auditor whose revelations
may have sparked it, smart practitioners will keep the lines
of communication open, Peppers comments. Whenever the
CAE sees that there’s going to be an audit that might result
in reputational damage, he or she may err, unwisely, on the
side of nondisclosure, he explains, adding, “But if the CAE
is working with management through all of those times and
keeping people informed throughout the process, that’s going
to help down the line.”
Internal auditors with experience in political challenges offer these additional tips:
» Know what to watch for. “Your first sign of
trouble is when you are not provided freedom
to conduct sensitive work activities,” Houston
Independent School District’s former Board of
Education Chief Audit Executive Richard Patton
says. And an anonymous local school district auditor points to “a lack of communication, such as no
or delayed responses to requests to meet or to
provide documents” as a sign that trouble could
» Watch the tone of a report when drafting it.
“You can change two or three words in the header
and not change the report,” Kip Memmott, audit
director for the Oregon Secretary of State, says.
» Document, document, document. Verify, verify,
verify. George McGowan, City of Orlando’s director of audit services and management support,
urges thoroughly discussing each issue with the
parties involved to understand the root cause.
“Every engagement needs care and feeding,” he
says. “Those being audited need to feel directly
involved in both understanding and then resolving
» Make sure that any time an audit involves
criminal or fraudulent findings the appropriate
authorities are brought in. Indeed, any time a
situation becomes controversial, bring another
auditor to take notes.
» Create a paper trail. This will back up your findings and the way you present them.
» Understand that going to the media has serious
repercussions. Memmott states, “Going to the
media will not protect you. In fact, it will backfire.”
“Try to understand the situation from the many
various perspectives. Be as flexible as you can.”
» Hire a lawyer.
VISIT our Mobile App + InternalAuditor.org to watch a
video on managing risk in the public sector.