How Do Internal Auditors Gain Influence?

I have recently attended an IIA webinar "The Evolution of Internal Audit: Assure, Advise, & Anticipate" presented by Deloitte. The first part of the presentation had an interesting theme "Adapt or Disappear"! The message to internal audit was crystal clear: "do not be a dinosaur". The presentation offered the following action plan for internal audit to navigate from present to future:

While there is no surprises in the above four steps, the "gain influence" part caught my attention!

How do Internal Auditors Gain Influence?
In a document that bears the same title (Adapt or Disappear),Deloitte explains how influence is gained as follows:

"Strong leadership from the CAE, a compelling articulation and cultivation of an impactful role, including as a trusted advisor, will help raise the stature of internal audit and gain the CAE a seat at the table with other c-suite executives for greater influence and impact".

I would simplify this by providing my suggested  formula:

Courage + Vision + Charisma + Passion + Effective Communications + Relevant Audits + Practical Advice + Marketing Plan + Real Time learning!

I may also add "Translation" which is a term I borrowed from a Harvard Business Review article. It was explained as: "personally helping decision makers understand complex content".

Now, what is your strategy to gain influence? Please share your thoughts and experience.

The Big Question:Shall I Move from External to Internal Audit?

One of my LinkedIn connections  sent me the following message:

"Dear Wa'el
 hope everything is well. as I see that you are an internal auditor professional, so I would like to ask for you advise. I'm working for Big4 as an external auditor, and recently I have received an offer from international company for an internal auditor position and I am confused if I want to move on or to stay, so as you are an internal experience auditor what do you say? Thanks in advance"

I have replied as follows:
"Dear ....,
Thank you for contacting me. While I am not a career internal auditor (I provide internal audit consultation), I will attempt to address your question as objectively as I can!
1. I have started my professional life with Arthur Andersen in the Middle East and stayed there until I became a partner! Why? Because I loved and enjoyed what I was doing and secondly, my objective from day one was to make it to the partnership level.
 Now ask yourself these questions:
- When you wake up in the morning do you look forward to going to your office or working with   clients?
- Do you really enjoy what you are doing. Do you do it with passion, or is it only a job to you?
- Are your career objectives clear an do you know what you want to be in 10 years?
2. Internal audit comes with its own challenges and limitations! Unlike external audit, internal auditors gain deeper understanding of the business but at the same time their experience may be limited to their company or to the industry it is in! Many professionals join internal audit to gain experience and move out to operations at a later stage. For the fun of it, almost each new internal auditor I talked to in the past wanted to be the CEO of the company in the near future!
3.How the internal audit activity at the company is valued and treated should be a major factor in your decision to move there. Company culture and tone at the top is an essential indicator, so do your homework!
4.If there is no strong and courageous CAE (with a vision & mission) leading the internal audit activity, then the future does not look promising!
 At the end of the day, you are the only one who can take that decision. Take it without pressure and just follow your gut!
Good luck, and please keep me informed of your decision! "


What else would you add to my answer? Have you made the move from external to internal audit? If so, what was your experience?

These are my thoughts,please share yours!

Interesting Takeaways from the IIA - PwC Cybersecurity Session!

It is not a secret that I am not a big fan of the IIA Ottawa Chapter!



I usually avoid its IIAOttawa@Noon training events ,but today I have attended  the event because the topic is of high interest to me.The session was about "Trends in Cybersecurity and Privacy" and was based on PwC 's Global State of Information Security Survey 2016.The presentation was delivered by two PwC partners from the Toronto and Ottawa offices. The full survey is available at the PwC website, so I am not going to repeat any of its contents here, but rather would like to share some of the interesting points discussed during the session:

• Organized crime "as- a -service" is on the rise on the deep web! It is much easier to hire criminals online than ever before!
• Insiders and former insiders remain the biggest risk to cybersecurity and the focus of the cybersecurity experts.
Cybersecurity insurance is gaining momentum in the private sector ,the public sector is still to catch up!

• Cybersecurity and Privacy are business issues, internal auditors should avoid the technology trap when dealing with it.
• More organizations are monitoring the activities of their employees during and after working hours!
• Canada is slow in using the cloud due to fear of the "big brother" eyes!
• Canada is behind when it comes to cloud usage guidance. It did not issue official guidance similar to those issued by the US and the UK.
• Ontario.ca website ,that we Ontarians use to renew our driving licences and health cards,  is hosted by Amazon! The justification is that it provides the highest security  available in light of the daily 2-3  denial-of-service (DoS) attacks it receives.
• And finally compliance with cybersecurity frameworks does not necessary mean security is achieved! 

I must admit that I have enjoyed today's event and found it informative and relevant! I am glad I have attended .
The $20 I paid for parking fees was indeed a good investment!

Can Positive Illusions be the Survival Solution for the Unappreciated Internal Audit Activity?

Let’s imagine this hypothetical scenario:

“you are managing an internal audit activity and working really hard to make it a value-adding function to the organization. But yet, whatever you do go unnoticed and/or unappreciated by management and the Board”

What do you do in this situation?

Call it a quit and leave?
 Or
Hang on and keep trying to win the hearts and minds of management and hoping that one day your hard work will pay off?
 If you choose the second option, how would you be able to mentally and psychologically survive until you achieve your goal?
The answer, according to some psychologists, may be in adopting “positive illusions”!

What are Positive Illusions?

According to Wikipedia:
Positive illusions are a form of self-deception or self-enhancement that feel good, maintain self-esteem or stave off discomfort at least in the short term. There are three broad kinds:
- inflated assessment of one's own abilities,
- unrealistic optimism about the future,
- and an illusion of control.

If you were in the shoes of the internal audit leader in the above mentioned hypothetical situation, which option would you choose? Is there third or more options? Would you adopt positive illusions as a mechanism to survive or would you come with other techniques?

Please share your thoughts!