Persuasion is an important aspect of internal auditing that doesn’t receive enough attention or coverage. Internal auditing is done to verify that conditions and practices are as expected, and to identify opportunities for improvement within organizations. If the internal auditor identifies issues but is unable to convince the relevant stakeholders to take action, how effective is that? From an output perspective, the auditor could be producing many reports, maybe even voluminous ones. But from an outcome perspective, that same auditor could be considered ineffective due to the inability to get the right reaction from the board and management.
The difference is persuasion.
Persuasion is not manipulation. It is the ability to get others to do something that is in their own best interest, but also in the internal auditors’ interest. In this case we are referring to enhancing the organization’s governance, risk management, compliance and operational excellence.
Furthermore, audit testing is generally done to answer some key questions: Are we achieving our mission and objectives? Are the right risks identified and mitigated appropriately? Are controls doing what they are supposed to do? The testing done answers those questions. If all is satisfactory, then there isn’t much more that needs to be done. But if the pursuit of the mission and objectives, or the dynamics surrounding risks and controls can be improved upon, then findings should contain the necessary details, and they should be presented clearly and succinctly so that the recommendation is aligned with what the audit client is most interested in. After all, it is extremely difficult to persuade someone who is not interested in what you’re saying. So, findings and recommendations must be presented in the context of business goals and the entity’s mission if we hope to be convincing and compel management to take remedial action.
Persuasion is accomplished by appealing to:
- Reason: Derived from the Greek, Logos. People generally think they are logical and reasonable.
- Character: Derived from the Greek word Ethos: People are more likely to be persuaded when the presenter (or source of the information) is considered trustworthy, honest, intelligent and credible.
- Emotion: Derived from the Greek, Pathos: The ability to persuade increases when the presenter expresses feelings on a subject, get an emotional reaction, or both.
Internal auditors generally appeal to, and are mostly receptive, to the top two: Reason and Character. But they should not underestimate the power of appealing to the third: Emotion. In fact, the recent efforts within the profession to improve the image of internal auditors, to be more collaborative, to build better relationships with audit clients, and to create an atmosphere where internal auditors are respected more, and feared less, requires an attention to emotion.
We must remember that many audit clients are apprehensive of internal auditors. They also fear the consequences of audit findings, so they say as little as possible and provide as little information as possible. So, when trying to mobilize the organization, internal auditors should consider not only the rationale for the work done, the methodology followed, and the quantitative and qualitative benefits of recommendations. They should leverage their reputation as subject matter experts in the field of governance, risk management, and compliance. But internal auditors should also build up the image of being friendly, caring, and approachable. This does not mean that internal auditors should get into a personality contest. It means that auditors should build rapport, realize that selling a finding should also involve describing the human impact and how poor practices affect employees, customers and vendors emotionally, and not just financially.
Internal auditors also refer often to the main driving force for their work: Determine if the organization is achieving its objectives and if controls are effective mitigating risks. But when writing audit reports, quite often the focus is on the failed controls, without explaining the link between the failed controls, the exposure to the risks if they occur, and the threat to the achievement of the organization’s objectives and possibly, the mission itself. That story should be told. The message that “we’re all in this together” should be conveyed often and consistently.
Displaying confidence is also important. When internal auditors do good work, have evidence and facts to support their position, it is time to embed the emotional element of confidence into the equation. This confidence about the issues and recommendations will project onto the client and persuade them to take action. So, by demonstrating their competence, focusing on the facts, showing that they genuinely care about their clients, and appropriately referring to the emotional impact of errors on the individuals, teams, customers, vendors, and other stakeholders, internal auditors will be able to make their observations, findings, and recommendations more persuasive.
It is also important to show that internal auditors share similar goals with the client: When the organization performs well and succeeds, everyone (including the auditors) succeed. But when the organization performs poorly and fails, the auditors feel that pain too. Conveying this message will result in a healthier and more collaborative relationship with clients and move internal auditors closer to becoming trusted advisors.
Another important aspect of persuasion is promoting a sense of urgency. To compel action, soon, internal auditors must instill a sense of urgency in their clients. Not by fearmongering, but by demonstrating the value lost, the opportunity cost or the increased exposure if action is delayed. If the individuals are not motivated enough to do something immediately, it is unlikely that person will be motivated in the future. But, internal auditors should also act with a sense of urgency in their work, so they lead by example.
Internal auditors usually focus on reason (e.g. logic), character (e.g. credibility) and emotion in that order (with emotion often playing a distant third), but should use a balanced approach whenever possible to appeal more effectively to their stakeholders and persuade them to take the appropriate actions to meet the organization’s governance, risk management and compliance requirements. After all, people are emotional creatures and to persuade them to act we must appeal to their emotional needs too.