Adopting a structured stakeholder engagement approach in Internal Auditing

This article advocates the adoption of a structured stakeholder management approach by internal audit practitioners, leadership and functions. It takes a particular note of the incorporation of stakeholders in the new Global Internal Audit Standards and proposes ways to engage internal and external stakeholders for effective achievement of the purpose of internal auditing.

Context

The fundamentals of internal auditing and the function itself arguably remain. This includes a risk-based approach, providing objective assurance, independence and reporting to the Board. Nevertheless, it is important to also consider the evolving needs of stakeholders to solidify the legitimacy of the internal audit function. This further enables an internal audit function that improves not just governance, risk management and control processes, but also supports an organisation’s achievement of its business objectives and value creation.

The Global Internal Audit Standards

The impact of stakeholder voice has undoubtedly increased globally with new stakeholder groups emerging. The internal audit profession is not left out, as exemplified in the Global Internal Audit Standards which are effective as of 9 January 2025. Specifically, the term ‘stakeholder’ is now added in the glossary of the new standards. The term has also been introduced in the definition of assurance and advisory services which internal auditors provide.

The standards define stakeholders as ‘A party with a direct or indirect interest in an organisation's activities and outcomes. Stakeholders may include the board, management, employees, customers, vendors, shareholders, regulatory agencies, financial institutions, external auditors, the public and others.’

According to the standards, internal auditing strengthens the organisation’s ability to create, protect and sustain value by providing the board and management with independent, risk-based and objective assurance, advice, insight and foresight. However, for internal auditing to fulfil its mandate and achieve the purpose defined above, it should understand the organisation’s objectives, purpose, goals, priorities and strategies. The appropriate source of this information is undoubtedly from the relevant stakeholders - internal and external. Thus, this necessitates a structured and deliberate stakeholder engagement plan to ensure that internal auditing fulfils its purpose, including a strategy to enhance the organisation’s successful achievement of objectives and ability to serve the public interest.

Principle 11 of the standards further supports stakeholder engagement as it stipulates that ‘The chief audit executive must develop an approach for the internal audit function to build relationships and trust with key stakeholders, including the board, senior management, operational management, regulators and internal and external assurance providers and other consultants’.

Stakeholder approach

A structured and effective stakeholder engagement approach begins with identifying the relevant stakeholders. This is followed by a stakeholder profiling and mapping exercise for effective analysis and prioritisation. This exercise further directs how to engage and report to the relevant stakeholders.

There are a few stakeholder analysis and mapping models that internal audit leaders can use for identifying, categorising and prioritising stakeholders, as well as determining the actions to take regarding each stakeholder. An example is the Mendelow’s matrix which considers the power vs interest of stakeholders. The allocation of each stakeholder in the matrix (Figure 1) is useful to direct resources, time and the strategy to communicate with and inform stakeholders. For instance, the matrix below suggests that stakeholders with high power and high interest should be managed very closely.

Accordingly, internal audit functions can adopt various stakeholder engagement methods / actions appropriate for engaging the groups of stakeholders in the various quadrants. This includes meetings, various formats of reports, surveys, workshops, consultations, town hall and joint projects.

Figure 1: Power – Interest Matrix

Other variants of stakeholder mapping models exist, such as power vs impact/interest, impact vs attitude and the stakeholder saliency model based on the attributes of power, urgency and legitimacy. Regardless of the model adopted, an appropriate mechanism should be implemented to obtain feedback from the stakeholders and report back using clear and effective communication.

There are various touchpoints for engaging stakeholders before, during and after audits. Arguably, this is not new to internal audit functions who may already be doing so for some or all of these: risk assessment and audit planning, internal audit and follow-up reviews, audit closure surveys, annual audit summary reporting, audit committee meetings, external quality assessment and internal audit awareness week. Nevertheless, this article proposes a more deliberate, structured and planned approach to doing so and incorporating this mindset in internal auditing.

Beware!

Certain stakeholders may become more or less salient, new stakeholders may emerge and overall stakeholders needs may change / evolve over time. Internal audit practitioners and leaders should also be aware of the conflicts of interest that may arise. This would require active listening, emotional intelligence, relationship building skills and a focus on the common goals / objectives. Nevertheless, the independence of the function should be maintained.

Conclusion

Effective and successful stakeholder engagement requires a well-planned strategy. It is important to identify the stakeholders along with their needs and material issues and to analyse, map and prioritise the stakeholders based on selected parameters, such as interests, power, impact, urgency, legitimacy etc., which thereafter should lead to the development of the engagement plan and actual engagement. Communication and reporting are important in this process and should include feedback from the stakeholders and continuous learning for the internal audit function.

Irrespective of how it is implemented, a structured and proactive stakeholder engagement plan results in various benefits. Effective stakeholder engagement is key in building trust. At the base level, this enables an understanding of the needs of various stakeholders and promotes a consciousness to consider a broad and multi-stakeholder view / approach in internal auditing and reporting. Internal audit and its reports should provide assurance not just for the board and management but other stakeholders such as regulators, investors and consultants, who may look at the reports for information and insights.

How BDO can help

BDO’s risk advisory experts apply the practical experience and knowledge gained from working with clients locally and worldwide.
Please reach out to the relevant partner in your local BDO firm for further information.

Author: Oluwasegun Sonola
Head of Governance, Risk and Compliance, BDO UAE