Why stories matter for audit professionals

Key headlines

• Businesses are changing and internal auditors are developing a dynamic approach to assessing risks.
• Next generation’ approaches have been slow to develop because they demand new processes, technology and skills.
• Storytelling can help internal audit directors achieve their goals. It can help people understand why internal controls matter and the part everyone plays in protecting a business.
• Empathy and emotional intelligence are also important skills for audit professionals because they focus on the needs of different people across businesses. Storytelling helps develop these skills, and the data collected by internal audit teams, can also be used to tell these stories.
• Leadership and advisory skills, and measuring ‘time well spent’, are equally important. The mindset to ‘start thinking differently’ will be important as the industry evolves.

Introduction and background

The internal audit profession has experienced significant changes over the past few years, which have only accelerated during the Covid-19 pandemic. Chief audit executives (CAEs) and their teams are experiencing the rapid adoption of technology and changing business models. So, they are developing a dynamic approach to risk assessment, as a result.

But, at Protiviti, we have seen that most internal audit groups are just getting started on this journey. In many cases, developing a next-generation internal audit function requires changes to processes, technology, and skills – and these take time to develop.

The vision for internal audit will also change over time as new business objectives, risks and technologies, materialise. For this reason, an effective next-generation function will be adaptable: flexible enough to respond to disruptions that can’t be seen today but will definitely arrive tomorrow.

“Within the CAE Forum, we have looked to reimagine what we do and challenge ourselves to be more adaptable,” said Mark Peters, managing director at Protiviti. “Part of that has been to increase the frequency of our communication and adjust our style, to stay better connected to the people we work with.

“As a profession, we replay stories based on the work we’ve done and develop empathy with people in teams. So, what do stories mean for internal audit and our leadership? And what do they mean for our people and our vision as we move forward?”

Developing stories and why they matter

Scott McArthur is recalling the time he worked as an HR director in the food industry. One night, before Christmas, he’d been out for a few drinks with work colleagues and was asleep in a hotel near the head office.

But at 4am, his phone rang; his boss Jim was on the end of the line. ‘You need to come into the office now, we’ve got a problem,’ said Jim, as Scott began to wake up.

He got out of bed, and into taxi, before arriving on site about half an hour later. Most of his colleagues were already there, and everyone had gathered in the boardroom to see what was wrong. Scott describes his boss Jim as kind and approachable leader, but he looked anything but, on that fateful night.

It turned out they had delivered four lorry loads of salmon to Tesco, just before its busiest time of year. Tesco had ordered pink meat, but the packets contained some brown meat on the fish. Scott, Jim and the team had a problem on their hands. What should they say to the sales director of the supermarket, who was seeking answers?

Jim decided to tell the truth.

On the phone, he apologised for the mistake, which was a manufacturing error. He sent people down to Tesco to add warning stickers to the packets.

The following year, Tesco doubled their order for salmon. The feedback suggested that Jim was one of the only suppliers who had been honest. Because he had played it straight, the relationship went from strength to strength.

“It turns out that Jim’s approach to leadership was not to be a superhero,” said Scott. “His belief was that he could be nice and treat people kindly. He could share his real views with people and act as a ‘gardener’ to help others grow.

“I think it’s quite a powerful way to think about leadership at the moment. Because those leaders who continue to behave like superheroes are not going to be as successful as those who behave like gardeners.”

Scott McArthur shared a number of stories during the forum: they included tales about helping people to develop at their own pace and resisting the ‘fetishising of data’ and key performance indicators (KPIs). He also challenged the audience to think differently about their roles as internal auditors, and to consider how they might use stories at work.

“I’m convinced that storytelling can really help us flourish as we go into the post-Covid world,” he said. “We’re not taught it on MBA programmes, very few leadership development programmes talk about storytelling. But there is something about stories that really works.

“Stories are what I call empathy engines: they start to create empathy with your contacts and your relationships, and you’re the driver,” he added. “When you go back to the office, think about using your own personal stories, and acting as an archeologist to develop them.”

How stories can help internal auditors

The participants at the event responded to Scott’s presentation, sharing stories of their own experience. They talked about the importance of personal stories, how their skills are changing, and the role of empathy for internal audit directors. Stories could also be used, they said, to invite feedback on their projects and bring data to life.

1. Make it personal

“During lockdown, I was chatting to my team one day, and telling them about moving into the study where the light wasn’t very good,” said one internal audit director. “So, I got a new bulb, and a new shade; and then I thought ‘no, I think it’s the switch’.

“I looked online and thought it looked quite easy to do. I also asked my team if any of them had changed a switch. At the next meeting, I was telling them about fixing it, and I felt really proud of myself. That story has become legendary. People know my stories about the mad things I’ve done at the weekend. Stories do help people get to know you; they engage with you more, for sure.”

2. Skillsets are changing

“Because I have come in from a marketing background, storytelling is something I probably do quite naturally,” said the chief of staff to a global head of audit. “In an audit function, there are sometimes people who have been there a long time and have a healthy distrust of change. You have to really dial up the storytelling to bring them with you.

“In addition, the people who have thrived, and the skills we’re seeing more of, are not typical audit skills,” she added. “The skills needed now are more around empathy and emotional intelligence. We need people who can really put themselves in another person’s shoes. And to realise we have to be constantly adapting and changing.”

3. Walking in the customer’s shoes

“When I talk at town hall meetings, the story I tell is about the transformation of the audit function,” said a chief internal auditor. “The most important skills are sympathy and empathy, and to be able to see the world through other people’s eyes.

“In a previous role, I was lucky enough to work with a chief executive, who used to say: ‘We should see the world through our customers eyes, not through our own brand. It’s good to see the world through your customer’s eyes, or in our case, our stakeholders’ eyes.”

4. Inviting feedback

“We’re telling people the story of the audit; we’re telling them the story of how we’ve got from A to B, for example. But we’re giving them the opportunity to feed into that story and help shape the output,” said an associate director.

“Our aim is to make the business more effective, but we recognise there are different ways to do that. For me, it’s about telling the story, and inviting others to be part of it.”

5. Don’t forget the data

“I actually think data is important,” said a head of internal audit, “but it is only the first step, not the last one. What I really like is taking data and then making it into a story that will be useful for people in the business. On its own data might be a good bit of underlying information, but it’s not the story. That’s where the relationship between data and storytelling can work well for our industry.”

What next for internal audit leadership?

Scott McArthur finished the event by building on his gardening analogy from the first story. He suggested that internal auditors, like most professionals, would do well to take soundings from other people and places. Like gardeners take cuttings from different plants, business leaders of the future should embrace ideas from more places.

Despite his discomfort with the increasing reliance on KPIs in business, he also invited participants to explore one KPI he was willing to back: ‘time well spent’. If something is worth doing, then great, he said; if not, do something that is for the benefit of the team and the wider business.

“We’re living in a time of uncertainty, exponential growth and metamorphosis,” said Mark Peters. “We’ve heard about the value of telling the truth and being honest with ourselves as leaders; to not stick with our old ways of thinking and working and changing our mindsets to develop the next generation vision.

“Organisations that can’t rectify mistakes and respond to customers will continue to struggle. Time well spent, focusing on what matters and building the skills of our people, will be important – as will our ability to communicate plans and achievements using stories.”

It starts with commitment, culture and an agile mindset

In Protiviti’s survey and report, The Next Generation of Internal Auditing — Are You Ready?, there is a roadmap for internal audit organisations to begin their next-generation journey.

But the very first step is to establish a mindset and commitment to the following principles:

• To transform the internal audit group’s governance, ways of working and technology in order to address emerging risks and heightened expectations
• To increase the department’s effectiveness and efficiency while fulfilling its core mission to protect the organisation
• To start thinking differently
• To strive to become an agile next-generation profession that embraces the latest thinking

The “assess-design-implement-reassess” approach to internal audit has become dated.

By adopting an iterative approach, remaining flexible, and being prepared to make changes, new priorities can be established, and new approaches can emerge.

Internal audit directors can take small steps, but they can also commit to those quickly, and immediately.

Leadership and communication will be key skills in the future.

Protiviti’s Chief Audit Executive Forum was held on 23 April 2021. The online event, which was hosted by managing director Mark Peters, welcomed more than 30 audit professionals for 90 minutes of discussion on topics that are shaping the profession. The next forum will be held on 18 June.