Speaker 1: Welcome, I'm Hernan Murdoch. In this episode, we're going to take a look at how project planning relates within what auditors do and what project management is all about. We're also going to take a look at the stakeholders and how they relate to our planning process and then what that preliminary meeting is all about. To help us better understand these subjects, we're going to spend a few moments talking with Kathleen Crawford, who is our subject matter expert on internal auditing. Welcome, Kathleen.

Speaker 2: Hi, Hernan.

Speaker 1: We have some questions about how a project planned for internal audit relates to what project managers will do in a broader sense. Because there are so many projects that are conducted in our world, construction, IT, research and development, and we keep referring to internal auditors and their work as being a project because it has a beginning, it has an end, defined scope, resource that are allocated to it. There's so many characteristics that are parallel. Can you help us map the two, if you will, so that we have a better appreciation for how they relate to each other?

Speaker 2: Most definitely. I have a graphic for that. Let's imagine that this project is an audit, because an audit is a project. We have activities that happen at initiation. We talked previously about risk assessment and pulling together research materials, making sure that we understand what our plan is going to be, who our folks are, all kinds of things of that sort. That then moves into the planning phase, where we are gaining an appreciation for how the system process or functional area works. How are we going to marshal our resources to make a good fieldwork section? Then we execute on the plan. As we execute on the plan, we need to make sure that we're keeping pace with the timelines that we created, that our team members are able to be productive, both from an efficiency standpoint and an effectiveness standpoint. We're going to monitor our progress periodically. Don't just stay down in the woods, but periodically get up and scan the horizon, have an appreciation for how far we've come. So then there are some other things related to control. Are we doing all the things that we said we were going to do when we put our plan together? Because we would have produced what's called an engagement memo, telling the client what they can expect from our work. We would also have had our own planning documentation within our working papers. So is this still the way that we're proceeding, or have we made some substitutions, some changes? So think change management in the context of this part of the graphic. And then finally, closure. Closure will be wrapping up the working papers, making sure that we produce a draft audit report. One thing I neglected to say is that there's likely to be quite a few meetings and conversations with management of the area processor system through all five phases of the project, and we're going to be talking about that shortly as well.

Speaker 1: This is very interesting, because as we think about typical audit, we usually think of it in terms of planning, field work, and reporting. We usually use those three as the phases of an internal audit. But as we're looking at this one, we can see that the initiation and the planning will go together. Then we have the execution, which will be similar to the field work phase. And then we have the closure that will be similar to the reporting phase. And then, of course, control will happen throughout. We want to make sure everything is progressing the way it needs to be. Notice that you mentioned there scope creep, and it's one of those things as well that we got to control, that we need to make sure that we are making sure that we don't do things that are not planned. And if we're going to, that we make the proper adjustments to our outline for the work. So this is all definitely very, very important as we go through. So one of the things you mentioned towards the end there was in terms of the meetings that we have with all the other parties that we're going to interact with, which makes me think about stakeholder management. Is that what you were referring to?

Speaker 2: Yes, very definitely. And stakeholder management has a lot of breadth and depth. So it really is incumbent upon us to think about anyone who has an interest in this work that we're about to do, or are in the middle of doing, or anyone who is affected by it. That is a really good working definition of who a stakeholder is. So let's think about those people inside internal auditing. So we have our audit leadership. Maybe if I'm the project manager, I may report up to a director who's very invested in what I'm doing. But there are also people outside of internal audit who are affected. Oh, I forgot another stakeholder group with inside internal audit. The people who are on your team. The people who are on your team for the audit are also invested because they want to be able to do meaningful work that's going to reflect positively on their abilities. So we need to give them what they need in order to accomplish that. So outside of us, outside of our team, outside of our audit group, we want to make sure we're also keeping in mind the people in the area process or system that we're auditing. And that goes up and down multiple levels because they too are answerable to their leadership. So we want to be mindful of, again, being very broad in our thinking about who is going to be affected by the audit, who has an interest in the audit. So that leads me to say that we have to really think about a communication plan. Our awareness of who our stakeholders are should be as creative and inclusive as we can make it so that we'll have communication plans for all of them. How often will we communicate? And maybe even more important, to bind them to us in terms of that partnership. Are we giving them some options in terms of channels of communication that we will use? Not just sending out emails because it's easy for us, but maybe there are other preferences that different stakeholders might have.

Speaker 1: Yes. So when we're thinking about communication channels, email, like you said, is a go-to for a lot of people, but sometimes they'll rather have a face-to-face and they will want to have a meeting and then we need to make sure that we spend the time with them. They want to know what's happening and want to be kept up to date. And I think we should provide that information to them. So I think that's very important to keep in mind at all times. So following up in terms of communication, I would imagine that there needs to be some kind of communication to them when we're starting because we're still in a planning phase for all intents and purposes. So we're looking at the planning and what happens there, who are the people who are interested in what's going to happen with this engagement. So with that in mind, then we need to provide some kind of a formal notification and communication. Is that correct?

Speaker 2: Absolutely. In fact, there are two deliverables that we'll be talking about in another episode and the engagement memo or the engagement letter is one of those. But if I could pivot to what you were asking about in terms of different kinds of meetings, because we are still in the planning phase here. Scheduling, these are just a few pieces of advice in terms of what to do ahead of the meeting and then what to do during the meeting. We want to make sure to schedule any meetings that we're going to have with these different stakeholders. Do your research. Let's make sure that we don't show up unprepared. It's going to get us off on the wrong foot. So what is this person or this group responsible for in terms of the area processor system and the subject matter of our audit? We want to make sure that we do research on those things that are going to be applicable to this meeting, be it a one-to-one or be it a group. Schedule it well in advance. It will be difficult as we get closer to the audit to find mutually agreeable times on each other's calendars. So let's put these things up and get them ready as placeholders on everyone's calendar that we need it to be.

Speaker 1: Very important, yeah.

Speaker 2: And as we get to the actual meeting, how are we going to conduct it? We want to make sure to spend some time developing rapport. We're not just going to jump in and get to the business end of things, but these may be people we've not met before. These may be people who we have met before and might like to visit a little bit. So let's make an effort to be social before we get into the business end of things, but also recognize that people have a limited amount of time and they've agreed to spend it with us. Although the work of auditing is important, internal auditors are an interruption to business as usual. So let's make sure that we don't overstay our welcome and that we manage our time well in these different meetings and interviews.

Speaker 1: I like to think of internal auditors as guests.

Speaker 2: Yes.

Speaker 1: So you want to make sure that you think of yourself that way and that you behave accordingly as well.

Speaker 2: Yes, I agree, I concur. We are invited into someone's space. We're taking their time. Let us be respectful of that and acknowledge that we are a guest in their area, process, or system. Some other things to think about during the meeting itself is to ask more open-ended questions than closed-ended ones, mainly because, well, one of the reasons is that closed-ended questions can be very, very boring for the person that you've invited or the group that you've invited to this meeting. There will be occasion for them, but this should be more of a dialogue. We've developed rapport so that we can have dialogue with the people that we're meeting with. Listen well and take notes, but don't hide in your laptop. We have to figure out a nice balance of asking a question, listening to the answer, making a note. Maybe you want to have a note-taker so that you can conduct the conversation. These are tactics that work very, very well. Asking for clarification, go ahead.

Speaker 1: Another thing that's helpful as it relates to taking notes is making sure that you keep eye contact with the individual you're talking with. To your point earlier about keeping your face in your laptop, you may be staring down, especially if you're not comfortable typing without looking at your keyboard. You may be so focused on making sure you hit the right key that you're not really connecting, you're not really looking at the person and personalizing that exchange. So we want to be very careful about that as well. It's not just gathering information, it's also working on that relationship. From that perspective, it's something to also keep in mind.

Speaker 2: Well, and to your point, if we've made an attempt and been successful at building rapport early, and then we disrupt that or destroy that because now we get into the business end of things and we're paying them no attention at all, that's a problem.

Speaker 1: Exactly, I agree, I agree. So, yes, go ahead. As we were thinking about this, I was just wondering about what are some of the couple more things that we really need to keep in mind as we are conducting this preliminary meeting just to make sure we get all the information we need because all of this is going to be very helpful and important, if not critical, because the better we plan, the more successful our field work phase is going to be. So we want to make sure we do it right. So any other things we need to keep in mind?

Speaker 2: I would say encourage client input. So give space for their perspective, give space for them to clarify, give them space to offer up different perspectives on things because we will have come to this meeting having done some research, which is referred to in the graphic, but that may not be the whole story. So we don't want to have such a crowded agenda that there's no opportunity for dialogue. So the dialogue is important. That's why we establish rapport. The open-ended questions also encourage rapport and encourage sharing of information. So give room for the client to provide whatever and whenever input they want to. So I would encourage people not to create very, very crammed agendas and always be looking at the clock. We're approaching the minute mark or whatever, and now I have to speed up.

Speaker 1: One other thing that comes to mind as we're thinking about getting the client input is an expression that we commonly use in internal audit, and that is, what keeps you up at night? Or what concerns do you have? Or while we're doing this review, are there any areas or things in particular you would like us to review as well? So that provides an opportunity for them to also contribute to the development of the audit program. We still need to apply the risk-based approach, what we know and understand about the process, and what our objectives are, but providing some space for them to also contribute and give us some suggestions and ideas and share their concerns so that we can also provide some assistance as relates to that. So what keeps you up at night is an interesting question that in invariance to that, that we use in the profession, that's a very helpful thing as well. So thank you very much, Kathleen, because your explanation and your commentary was very insightful and helped us to better understand what we do as auditors planning our engagements relate to classical project management methodology, also how managing those stakeholders and keeping that communication and developing a communication plan. And then lastly, of course, making sure that that preliminary meeting is a successful one. So thank you very much.

Speaker 3: My pleasure. Good to be with you. If you like this series, subscribe to the ACI Learning YouTube channel to enjoy more audit-related content.