Informal Communication: A Path to Success for Internal Auditors Free

The Institute of Internal Auditors (IIA) is widely recognized as the primary source for internal audit (IA) policies, implementation guidance, and certification of IA professionals. The IIA issued global standards in October 2016 that served as the framework for IA activities in both public and private sectors (The Institute of Internal Auditors (IIA) 2016). Communication skills are considered one of the fundamental skills for internal auditors (Buenger and Zamir 1991; Koch and Denner 2022; Messmer 2001; Stein and Holcombe 1994). Although the 2016 standards included guidance for formal communication of specific matters to the board or other stakeholders, they do not mention informal communication. Consistent with this focus on formality, internal auditors in many organizations concentrate on communicating with the board, management, and other stakeholders through formal channels, such as regularly scheduled meetings.

In January 2024, the IIA issued the new Global Internal Audit Standards, which contain significant revisions to the 2016 standards, highlighting the distinction between formal and informal communications and emphasizing the critical role of informal communication in achieving IA objectives (The Institute of Internal Auditors (IIA) 2024). For instance, Standard 8.1 focuses on audit committee (AC) interaction and specifies that the board and chief audit executives (CAEs) should engage in informal discussions outside of formally scheduled meetings, considering the timeliness and significance of ongoing issues. Standard 11.1 provides the CAE is responsible for fostering both formal and informal communication channels with stakeholders. Standard 13.1 instructs internal auditors to adopt effective communication mechanisms when engaging with clients, including both formal written documents and informal discussions. As emphasized in the new standard, internal auditors can gain insights into business operations, risks, and opportunities for collaboration through both formal and informal interactions.

In this study, we examine how internal auditors utilize formal and/or informal communication channels when interacting with ACs. We employ multiple methods, analyzing data collected from interviews, surveys, and AC charters.¹ Our findings suggest that informal communication can help both ACs and internal auditors fulfill their responsibilities, but that there exists a gap between current practice and the IIA guidance on informal communication. In Section VI, we propose steps that internal auditors can take to meet the new standard and actively maintain informal communication channels. We caution that, in pursuing the benefits of informal communication with various stakeholders, internal auditors should take care to preserve their objectivity by continuously disclosing potential conflicts of interest, maintaining consistency in the audit approach, and adhering to professional and ethical standards. This study contributes to the literature by evaluating formal and informal communication between internal auditors and ACs, highlighting areas where practice falls short of the new guidance, and responding to the call for research to improve the understanding of internal auditors’ day-to-day work and bridge the gap between academia and practice (DeFond and Zhang 2014; Kotb, Elbardan, and Halabi 2020; Roussy and Perron 2018).

Informal communication is a relatively new area in IA research. In this section, we highlight a few studies that have examined its importance. Koch and Denner (2022) study the effect of informal communication on employee productivity and job satisfaction in a German company, reporting that informal communication helps employees stay connected and increases their job satisfaction. Turley and Zaman (2007) conduct a case study in the U.K., investigating interactions between ACs and groups they oversee, concluding that the greatest impact of ACs occurs outside of formal channels. Zaman and Sarens (2013) report evidence from a survey of CAEs in the U.K. that ACs and internal auditors do engage in informal interactions, especially when encouraged by more experienced AC chairs. Focusing on U.S. public companies and exploiting a requirement that these companies disclose a charter describing AC duties, Jaggi (2023) finds that financial reporting quality increases when ACs report relatively greater interaction with internal auditors.

This literature provides an incomplete picture of communication, as it relies heavily on reports from non-U.S. companies and, in the case of Jaggi (2023), on data gleaned from AC charters dating prior to 2006. We contribute by providing insights and direct evidence, both qualitative and quantitative, on the different communications that currently occur between ACs and internal auditors in U.S. companies. We highlight that current practice falls short of the new IIA standard and provide actionable guidance for closing this gap.

To motivate our study and to gain deeper insights into the interactions between ACs and internal auditors, we first conducted interviews with AC chairs and CAEs.²Table 1, Panel A presents the demographics of the participants who shared personal accounts of their informal interactions with ACs or CAEs, emphasizing the importance of timely and open informal communication for effective communication.

The AC chairs and CAEs who participated in our interviews recognize that ACs can be a valuable resource to IA, offering support and addressing its various needs. Our interviewees emphasized this collaborative perspective, as represented by this quote:

Although working relationships can be established through formal meetings, they can be strengthened through frequent informal interactions. The AC chairs we interviewed emphasized the importance of fostering supportive relationships with internal auditors:

The AC chairs we interviewed emphasized their responsibility to initiate and promote open communication with their CAEs. CAEs also acknowledged the importance of open communication, recognizing that ACs may expect it:

The ideas expressed in these interview excerpts highlight the critical role of frequent and timely informal communication. Building strong relationships is an ongoing task and investment for both internal auditors and ACs. Both parties must dedicate time and effort to building trust and nurturing relationships through consistent formal and informal conversations. Other recent findings echo these points. Two recent surveys indicate that ACs expect effective communication from both internal and external auditors. The 2023 Global Audit Committee Survey conducted by KPMG reports that 31 percent of ACs globally and 15 percent in the U.S. believe IA can add more value to the AC’s work through better reporting and communication (KPMG 2023). A 2023 PCAOB survey addresses AC preferences for communication with external auditors. Committee chairs consider inconsistent and last-minute communication problematic. In contrast, they appreciate (1) proactive communication, (2) easy-to-digest information, (3) updates and trends in auditing and industry, and (4) educational materials and resources (PCAOB 2023). Building on these studies and our own interviews, we survey internal auditors to further understand how they interact formally and informally with ACs.

We offered our survey to internal auditors who participated in the Sawyer’s Educators’ Symposium at the International Conference of the IIA, held in Anaheim, CA, in 2019, or who attended a joint meeting of IIA chapters in Washington, Oregon, and Alaska in 2021. In total, we collected 35 usable responses, including nine CAE responses. On average, survey respondents possessed 12 years of experience in internal auditing, and their IA functions comprised 14 internal auditors. Of the 35 total survey responses, 40 percent represented internal auditors working for public companies. Table 1, Panel B presents the demographics of the respondents.

In the survey, internal auditors responded to questions related to communication between IA and ACs.³ The results indicate that internal auditors predominantly rely on formal reporting when sharing information with ACs. As Figure 1 shows, internal auditors provide the AC formal updates on summaries of findings (89 percent) and results of internal control audits (83 percent). They are slightly more inclined to engage in informal discussions with ACs when sharing nonaudit-related information, such as reports related to coordination with external auditors (37 percent), summaries of risk assessments (29 percent), and updates on regulatory compliance (23 percent). On the flip side, for ACs sharing information with IA, the survey results suggest that ACs often utilize informal discussions. Our survey results indicate that, during informal discussions with internal auditors, ACs provide feedback on IA performance (63 percent) and assign special tasks to IA (54 percent). The committee also discusses concerns (54 percent) and accounting and reporting issues (54 percent) with internal auditors informally at times.

Figure 2 illustrates the existing communication level between the AC and internal auditors. The results indicate that 83 percent of respondents “Strongly Agree” or “Agree” with the prompt, “You can raise any concern openly to the AC,” whereas 71 percent stated being comfortable reporting management lapses to the AC. Put another way, 17 percent of respondents are reluctant to raise concerns openly to the AC and 29 percent are not comfortable reporting management lapses to the AC. Internal auditors were even less inclined to initiate conversations with AC members (57 percent), even though most respondents acknowledged that their relationship with the AC is built on open and free communication (74 percent). Overall, respondents assert that the AC’s support can help internal auditors better fulfill their duties (94 percent) and increase IA effectiveness (88 percent). The complete survey results are presented in Table 2.

In summary, our survey results provide insights into the status of interactions between internal auditors and ACs. Concerning informal communication, we identify a significant gap between current practice and the guidance in the new IIA standards. Although more than 90 percent of respondents believe that ACs and internal auditors can both function at higher levels when information between the groups flows freely, only 74 percent enjoy an environment of open communication. Although some internal auditors appear to have leveraged informal interactions in their communications, many will yet benefit from actively and informally nurturing strong relationships with their stakeholders, especially AC members. Internal auditors should strive to establish consistent and frequent discussions with ACs in informal settings and to build open and free communication channels. Results from a recent PwC survey of board members and executives corroborate these ideas, indicating that internal auditors need to sharpen their skills in adopting a collaborative approach (22 percent), employing effective communication skills (20 percent), and handling negotiation and dispute resolution (13 percent) during IA activities. Reflecting on the results, PwC encourages internal auditors to “shake up the communication style” and initiate more agile conversations with their stakeholders (PwC 2023).

The SEC requires public companies in the U.S. to post their AC charter on their website. These charters delineate the committee’s composition and responsibilities and make various references to IA, describing ways in which the groups interact. To complement our firsthand data from interviews and surveys, we randomly selected 100 charters obtained from corporate websites in 2023 to analyze.

Through a detailed examination of these charters, we learn that ACs engage with internal auditors in numerous ways. We present a breakdown of the different types of interactions and their frequencies in Figure 3 and Table 3. These AC charters suggest that most ACs consider periodic group meetings (72 percent) and private meetings (67 percent) with IA to be important. Most of the IA references in the charters relate to formal reporting lines between the committee and IA, including discussing IA findings (49 percent), internal controls (39 percent), and management responses to findings (36 percent), to name a few. However, some other IA interactions that are likely to occur in informal communications are not consistently emphasized in the charters; for example, only 22 percent of the charters mention the committee’s commitment to maintaining free and open communication with IA, and only 16 percent indicate that internal auditors can bring any item they wish to the committee for discussion.

Although the AC charters indicate some emphasis on encouraging open and informal communication, there appears to be significant room for ACs to improve their interactions with IA. ACs should continue to utilize IA as a valuable resource for information in conducting their oversight responsibilities. The new IIA standards emphasize the importance of informal communication, stating that ACs should maintain open communications with CAEs, and that CAEs should work to develop a trust and relationship with AC members (IIA Standards 8.1 and 11.1 2024). Our AC charter analysis indicates that current practice is not aligned with these standards.

Taken together, our findings identify a significant gap between current practice and the guidance in the IIA standards concerning informal communications. Our survey of internal auditors indicates a strong belief among respondents that there is a mutual benefit for ACs (91 percent) and internal auditors (94 percent) in promoting free and open communication. However, only 68 percent of internal auditors we surveyed express confidence in initiating conversations with ACs at any time. The AC charters further indicate that only 22 percent of ACs formally state their dedication to free and open communication with IA, and only 16 percent emphasize that IA can freely bring any discussion item to the committee. To narrow this gap and meet the new standards on informal communication, internal auditors and ACs have significant work to do.

For internal auditors, informal communication is not only a new standard but also a tool to help them better fulfill their responsibilities. Internal auditors should be present at various company occasions where they can rub shoulders and interact informally with AC members and management. As one CAE told us, “A lot of what I learn about the company comes from wandering the halls and bumping into other people in the management ranks–just having a conversation about things that are going on and what the company is doing or hoping to do.” We offer the following suggestions to internal auditors:

• Establish a mutual understanding that communication outside of formal meetings is vital.

• Initiate timely conversations on unexpected events and regulatory changes that impact the organization and IA work and resources.

• Provide early informal updates on important information related to risk assessment, audit plans, work progress, findings, recommendations, and other activities.

• Report challenges encountered during audit activities and solicit support when needed.

• Attend organizational meetings and events to create opportunities for informal interactions.

• Make in-person work a priority to allow for spontaneous informal interactions.

AC members should publicly commit to promoting free and open communication with internal auditors in their AC charter. AC chairs especially should make a point to develop strong relationships with internal auditors by (1) providing consistent and frequent opportunities to discuss matters freely in private conversations, (2) modeling and encouraging candid communication, and (3) being available in-person or by phone to internal auditors outside of scheduled meetings.

When building strong relationships with stakeholders who are or might be future auditees of IA, the objectivity or perceived objectivity of internal auditors can become jeopardized (Ahmad and Taylor 2009; Goodwin and Yeo 2001; Stewart and Subramaniam 2010).⁴ To mitigate this significant risk, internal auditors should (1) disclose potential conflicts of interest and refrain from auditing areas where personal relationships might compromise their objectivity, (2) apply audit procedures consistently and treat all stakeholders equally without showing favoritism, (3) set expectations with stakeholders on the boundaries between personal and professional relationships, and (4) participate in regular training and adhere to professional and ethical standards. When engaging stakeholders informally, internal auditors should adhere to established guidance for handling confidential information, documenting significant issues discussed, and preserving a record for follow-up if needed.

This study focuses on the AC as one important stakeholder group. Some questions regarding IA and AC interactions merit further research. For example, what are the reasons that some internal auditors do not feel comfortable initiating conversations with AC members? Overall, how do these ideas bear on the effectiveness of the IA? We encourage future research to further explore the antecedents and implications of interactions between internal auditors and various stakeholders.