Home > Risk > Trusted advisors and world-class internal auditors

Trusted advisors and world-class internal auditors

I was recently privileged to receive a signed copy of Richard Chambers’ latest book, Trusted Advisors: Key Attributes of Outstanding Internal Auditors. Richard is the President and CEO of The Institute of Internal Auditors, a veteran of internal audit at the highest level, a friend, and an individual with whom I love to debate the practices of internal auditing and risk management. (I hope I am influencing his views on the imminent update of the COSO ERM Framework.)

I thoroughly recommend the book for any internal auditor, at any level.

Richard covers nine attributes of internal auditors who are seen by their customers in executive and operating management as “trusted advisors”. They are based on the results of a survey of CAEs and are grouped into three categories:


  • Ethical resilience
  • Results focused
  • Intellectually curious
  • Open-mindedness


  • Dynamic communicators
  • Insightful relationships
  • Inspirational leaders


  • Critical thinkers
  • Technical expertise

I will let you purchase the book (now on sale to IIA members) and read it in detail.

It makes an excellent companion to my book, Auditing that matters. I focus on the design and staffing of a world-class internal audit function, with a portion dedicated to the attributes of what I consider ideal members of the team, while Richard focuses the whole book on the latter.

So how do you leap from a trusted advisor to a world-class internal auditor? There are a couple of points that I did not see covered. Maybe I am taking them to the next level.

The first is seeing your purpose, your mission, as helping the organization and its leaders succeed rather than simply avoiding failure.

Pointing out deficiencies, even when you also point out remedies, is insufficient to be world-class. For that, you need to focus on the issues that matter to leadership and then provide them with the assurance, advice, and insights they need, when they need it, in an actionable form that is quickly digested and acted upon. Give them what they need to achieve their objectives and strategies. In other words, help them succeed.

This requires that we have such an understanding and appreciation of the business and what it takes to run it that we are willing to recommend taking risk when that is right for the business. Sometimes, even taking more risk.

The second is related: being able to hold a productive and constructive hour-long conversation about the business with an executive without ever using the words ‘risk’ or ‘control’.

If you are to tackle the issues that matter and add value through your insight, then you need a truly deep understanding of the business and how it is and should be run.

That’s not an easy task!

These are just a couple of attributes of world-class internal auditors, people who stand out to management so much that they are usually offered leadership positions themselves.

What do you think?


  1. Kaya Kwinana
    June 24, 2017 at 3:33 AM

    Internal auditors at any level should focus on being internal auditors. When they do, then they are able to concentrate on what their job is.

    The “trusted advisor” tag is too broad and misleading!

    Advisor on what? What about the assurance mandate of internal auditing. The tag is as inappropriate as the one which focuses solely on the assurance mandate.

    Focusing on being an internal auditor would force internal auditors to concentrate on what they should:

    the nature of internal auditing – helping an organisation to achieve its objectives
    the nature of internal auditing – assurance and consultng, whichever is appropriate for particular circumstances, on the scope of internal audting
    the scope of internal auditing – governance, risk management and control PROCESSES, in other words, internal control.

    Whatever else an internal auditor does, if the above is not done, that internal auditor is not operating as an internal auditor.

  2. June 24, 2017 at 1:41 PM

    Norman, it’s very interesting reading your blog above and then Mike Jacka’s of June 14th on IIAOnline (https://iaonline.theiia.org/blogs/jacka/2017/Pages/The-Sermon-with-the-Soup;-Provide-Real-Value-or-Die.aspx ). We could be looking at two different professions, even though the eventual aim is the same – to ‘add value’.

    But how? I have some sympathy with Kaya. The first priority of internal audit is to do what is is told by the Board/Audit Committee. If the IA manager considers it should, and can, add more value to the organisation then he/she should try to persuade the board to give them the opportunity.

  3. July 10, 2017 at 11:51 AM

    The previous two comments would be well-placed … if the world showed not to change a bit.

    Alas, anything resembling stability is decades behind us. Anyone aiming for stability, and doing less, not changing or shying away from it, may not have that much of a future. The ‘pure’ audit work *will* diminish, due to a number of circumstances at or (much) nearer than the horizon.
    The value-add is *not* (hardly ever was!) is straighforward audit work, but in rising above it, showing helicopter view contribution et al. Think of where the trade (it is no more; do not kid yourself) originated from: Not simple checking the boxes, but the ultimately non-rationisable (sic) end opinion of the lead auditor. Any simple summing up of findings was looked down upon as diminishing the natural authority of the auditor as among the notables. Wrong moonshots were corrected by being found out.
    If now there are forces (since 2001 in particular, one would say, and certainly recognisable among internal auditors) that want to reduce everything to machine-like operations, they reduce the auditors involved to cogs in the wheel, easily exchangable, cheap, which is: of limited value at most.

    Also, study The Trusted Advisor by Maister et al., the surely underrated masterpiece on what advisors should be like, and see that *such* trusted advisors is what organisations need…

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: