The Institute of Internal Auditors presents all things internal audit. In this episode, Mike Levy sits down with Ranya Bijani to discuss what it takes for internal auditors to become strategic business partners from mindset shifts and organizational alignment to building trust and influencing change, Bijani shares transformational insights, grounded in global experience.
The conversation covers the evolving role of internal auditors, essential competencies, and how to earn a seat at the table by becoming a catalyst for strategic value. Just to dive right in, you know, how would you define strategic business partner in the context of internal auditing? The critical point is strategic and partner. So what is strategic? Uh, strategic really is always looking, um, at a long-term perspective.
Strategic is looking to solve problems, uh, is looking to influence and is looking, anticipating needs. Uh, and a partner is very much about working together, about collaboration, about win-win solutions and about engagement. So when it comes to, what does that mean for internal audits to be strategic, uh, partners and strategic business partners, it's very much about taking that view. What is the vision that we want for our internal audit, uh, uh, department?
How does that vision marry to the organizational strategy? Um, and starting from that then to going and thinking about, um, how do we serve best the business, uh, how do we align to the business? Uh, and then really how do we help the, uh, business solve its problems?
So, to answer you slightly differently, when we are talking about strategic business partner, uh, it is really about that a leader and that auditor and that team together that are thinking strategically, that are very much, um, focused on what results they want to deliver for the organization, and how these results, uh, align to the strategy of the business. And how can this internal audit function enable the achievement of the strategic goals of the organizations.
So by that, then there, there is by definition, uh, an element of, uh, not only looking backwards as to the insights of what the past has taught us, but taking a foresight and looking ahead about how can we help the organization? And it is about building that relationship. And when we talk about relationship, we're talking about building that bridge, the trust, the respect, the credibility, and having that collaborative spirit.
And also being strategic business partner is about being a change agent. So it's not just about saying, this is what's wrong, and this is what's right, but it's truly about being a catalyst for positive change in the business. Well said. And I think, and I'd be remiss if I didn't mention this, I think so much of what you just articulated is so closely aligned with the new global internal audit standards that I think this, this topic is very timely.
Uh, you know, for, for many of our listeners, as you, as you likely know, the new global internal audit standards went live in January. And as part of that for the first time, we have documented requirements around strategic planning process within the internal, within internal audit we've talked about, and the, the work of advisory services and advisory within the new standards.
As well. As, you know, in the past, we have always talked about the need for internal audit to be a trusted advisor to the organization. And I'd love to dig into that a little bit more because for what you just articulated, I, I believe is a little bit different than that. What do you see the difference between trusted advisor like we've been talking about, and a strategic partner to the organization? How are those two things different?
Being a trusted advisor is a, somehow a prerequisite to being a, uh, strategic partner. If that, if that makes sense, Mike, you have to go through that. Uh, you know, that step in your journey, uh, so that you can elevate yourself to that, uh, strategic partner. Um, so if we think about it like a Russian doll, the trusted advisor is a, the, the baby one inside, if that makes sense.
Trusted Advisor is about the level of communication and trust that you build, that you can exchange ideas, and the, the, your internal ODT, your internal client would share their concerns, et cetera, knowing that they trust you not to automatically use it against them, right? And that they can come to you with a problem and that they can seek your advice. But that does not necessarily mean that you are being proactive as an internal auditor.
And it does not necessarily mean you are stepping up to see the bigger picture. So, in answering your question, for me, the difference is, it is about stepping up. It is about seeing the business as a whole and a strategic partner.
This is a lot more proactive action on the part of the auditor to take lead in fully understanding what does the business need, what is the strategy, how do I align my strategy to that, and how can I elevate myself and my team and our language and our ways of being to align with the need, the strategic needs of the business. So it's more about bigger picture, it's more about division and the long term. It is more about the, uh, proactiveness.
And so it's bigger and greater and a lot more impactful and influential than the trusted advisor. I think that's really well said, because I think when I, you know, in my, in my role, I've had the opportunity to interact with a lot of practitioners and a lot of chief audit executives. And when you hear them talk, the number one thing everybody articulates beyond, you know, the need to have the right talent to address emerging risks is, I wanna have a seat at the table.
I want my board to call me and my audit committee to call me. I want executive management to come to me when there's an issue. And so many times when we talk about and work with organizations around revamping their audit plans and working through that, that time for this, these types of activities and reporting on them to the board becomes really, um, incrementally important.
And I always say to CAEs that it's honestly a barometer as to whether your function is performing, if you have people seeking you out for some of the strategic guidance and insight. Absolutely, absolutely. Actually, in a recent conference, our speaking and, and this was my point to the audience, like we've worked very hard throughout our careers.
Uh, we want a seat at the table, but that seat as the table doesn't come easily, we have to earn it, and we earn it via the quality of the engagement we have with the board, with the, with the C-suite, with the business. And it is a reflective of the value that we are adding, the insights we are bringing, and how we are supporting them on their mission to run the business.
So with that, when, you know, when I think about the, uh, the first question that comes to mind, if I'm listening, if I'm listening to us talk about this, how do I do that? You know, I really want to, I really want to do that if I'm a practitioner and, you know, I wanna make the shift to a problem solver versus a problem identifier.
And, you know, at, at the end of the day, if you go back and look at internal auditing 20, 30, 40 years ago, one might argue that we were financially driven, you know, all financial statement driven. We were checking boxes. While there's a time and place for compliance requirements, and I think we all know that, how do we do that? How do we make that shift to a problem solver versus an identifier, um, within the organization?
This is a great question, Mike. Um, but for clarification, I was not around 40 years ago, Nor was I, nor was I, if you walk around the internal audit museum in, uh, in Florida, you can see some evidence of these things. Uh, is there an internal audit? There is indeed. Really? Oh, I not know that. I'd love to come and visit that on my next visit. So, uh, you know, first let me clarify. There's a, a lot of good audit teams out there doing a great job, okay?
And they, I know because I, I work at, with, with so many of them, I know how much heart they pour into their, uh, uh, their jobs to deliver the best I can. What we are offering here is a critical mindset shift, because this isn't just about doing more effort, but it's about the intention behind the effort, if that makes sense. So doing that shift is a journey. Uh, it is a transformational journey, and we need to understand it does not happen overnight.
Uh, so the first step is a exercise of awareness. Where do we stand today as internal audit team? If we're being truly objective and auditing ourselves, just like we go ahead and audit so many people, let's start by auditing ourselves. Where do we stand on that barometer? Are we engaging with the right priorities? Are we having the right conversations? Is the, uh, the way we are delivering the work, et cetera, et cetera. So a, a, an honest self-reflection and self-assessment is needed.
Then the other step is an honest and courageous conversation with the board and the C-suite, and particularly, you know, the, the key decision makers. What is it that they would like to see? They don't always know what they want, you know, the board and the C-suite in honesty don't all understand what audit does.
And so we might want to educate them, but we also want to make sure we're asking them that question and engaging them so that we get a clarity between our self-assessment and understanding what they want, and where would we aspire to be in terms of business partner. Then we create a bridge from now to there, and a series of actions would need to be taken. As I said, there is a, a mindset shift that is needed.
It's all about, you know, that change is all about the, uh, behaviors with an internal audit. And so that takes time and it needs to be taught. It's about setting new values for the function. Uh, and then we need to reflect and accompany that with changes in the way we work, what we focus on, how do we deliver, how do we communicate, how do we engage, et cetera, et how do we report what, you know, what documents do we send? What language do we use? How do we behave? All that stuff.
So it is a transformation journey. And on that journey, there will be some challenges. There will be some setbacks, there will be some great wins, and eventually the cumulative effect, the team will gain the experience and will get there. And sometimes if needed, there are experts and mentors, you know, that can help on that journey as well. Absolutely. And I think that's, I think that's really well said.
You know, the other thing that you articulated, and you know, I I think it's spot on, is that boards and audit committees and executive management, they, they don't, they know directionally sometimes what they're looking for. They know where their business objectives and priorities are. Yes. But very commonly, whether it's about reporting or about their focus areas, they really need us to manage upwards in those areas.
I think I, you know, I, I find very that it happens with a significant amount of frequency that if asked directly, you're not getting as clear of an answer as if you had just given some insight into where you think in the focus areas. And, you know, with that said, just to dovetail into another piece of this conversation, a chief auditor is only as good as the team that they surround themselves with.
And when and when we think about strategic advising and that mind, that mindset shift, you know, as someone that, you know, I was, I was a CAE for the better part of a decade before I went out on my own. And I, I would tell you that that is one of the hardest things to recruit for. So when you think about attributes of, you know, what to look for in candidates and what skill sets and competencies that you think you need, how do you do that as a chief audit executive?
How do you find the right people to support this goal? I would agree with you that it is hard. I was a, uh, a, a chief audit, um, executive also for, uh, you know, well, uh, well, you know, well over a decade before I started by myself as well. And what I always recruited for, uh, the way I recruited, I never focused on this, the skills, uh, as in the technical skills. I really focused on the attitude and on the competencies. You know, I wanted someone, uh, that had the flexibility of mind.
Um, the willingness to learn, uh, the curiosity to ask questions and the courage to change. And I personally recommend that we give, as auditors the priority for the attitude and the ways of thinking of our talent, because it's very easy to teach someone, okay, okay. It's not an overnight job, but it's relatively easy to teach someone how to conduct a test or, you know, they can build some specific, uh, technical skills. And, you know, with the right support, they can learn to do x, y, Z task.
But you can't really teach someone willingness, and you cannot really teach someone courage. Uh, you know, they, they, they've got to really want that. You can't teach someone how they wouldn't, you know, you know, the desire to make a change. So, um, I would say it's very important to recruit based on values, and you recruit people who really aspire to be, to make that, to make that change.
Um, you know, there are certain attributes that are needed, uh, in, in that, of course, I'm gonna take it for granted, the technical skills. You know, typically no one's gonna come and apply for an audit job if they didn't have the audit training and the audit experience or the audit interest. So yes, we take that for granted, but then we also want above that, um, the ability to communicate and to communicate very well.
We want someone who's gonna be able to build the relationships in the business. Um, you want someone who's able to debate in a, a constructive way. 'cause there's a, there was a lot of conversations that need to be, had to be had.
And, you know, the, the agility and the confidence, we as auditors in the, you know, when engaging in different things, especially when, you know, problems or different of opinions arise, you know, can come under extreme pressure from the business, uh, you know, to change this or to change that. And sometimes the change is needed, but sometimes there is, uh, no need to change.
And so you need to have someone who can handle those tough conversations, who can be resilient, um, who, uh, can be confident. And I also believe humor is a, is a, is a great factor. Uh, it helps because sometimes we need to learn how to diffuse things without taking it, uh, personally or without taking it too much to heart,
Really well said. I, you know, I, this is very similar to my strategy when I, when I hire, I, I, I have always been of the mindset that yes, you need some baseline level of technical skills, but it's a lot easier to train someone and make them an expert in, if you're doing quality assessments, the standards or a quality program or cyber security auditing, you can train. Those are trainable skills.
Developing emotional intelligence, influence skills, negotiating skills, the person ability of a person. These are things that are a lot harder to, um, it's almost an X factor. And if we take a step back and we think about where our profession is going, and from a practitioner lens what's needed to accomplish our goals, we're in a really difficult position as internal auditing.
It's, it's also what makes it very exciting is that we're in a place where we are looking at the whole business holistically and strategically evaluating things, whether it strategic projects or assurance based projects based on risk. And we have to help influence change within an organization without actually having any direct oversight over that area. When you think about things like the three lines of defense model, we're, we're not a first line person.
We don't have authority to own some of those, some of those areas, but we do have to influence change. And to your point, that those requisite skillsets around the personality traits and humor and all those things that help influence decision making, I mean, it's, it's a very hard thing to train. And if the person doesn't have it, it's takes them a very long time to develop. Absolutely. Um, I've said that many times before, and I'll say it again.
Uh, the audit profession is probably the most misunderstood in the world. Uh, and, uh, perhaps one of the hardest, because to be a successful auditor, one must master a variety of skills that are not always present in the same person. You know, uh, it, it is very important to be obviously analytical and, um, you know, and be able to follow the details through and look at the, those things at the same time. It's very important to be able to see the, to rise above that and see the big picture.
It's, uh, it is, uh, important to, uh, be a great communicator and, uh, you know, articulate thoughts and ideas and issues and, you know, uh, very clearly and confidently. And also, you have to be a problem solver. Uh, and you have to be a negotiator, and you have to be a translator because you gotta translate all those complex, uh, thoughts and concepts into a simple, easy to user friendly reports and conclusions.
And you have to kind of sum up, uh, uh, vast amounts of information you've looked at in the weeks during the audit into like a few pages. And you gotta be a fantastic salesperson because you gotta sell your ideas. And all in all, what we do is about spotting the issue, facilitating a solution, and influencing change. So those, uh, influence communication, dialogue, uh, emotional intelligence, relationship building, are all crucial to that piece of the partnership.
And it helps to know that this is what is expected of us, and to kinda look at how we are performing and look how we can improve. And as a CAE, you know, we acknowledge that not everyone on the team might be the perfect match of this. Realistically, these people are minority, they're not the majority.
And so how, uh, you know, it's about bringing together the different parts of the team to collaborate together on those audits where they can supplement each other skill, but under that umbrella of the influence and the partnership, you know, with the relationship building. Really well said. I, I, one thing listeners always like to hear, to hear are the more tactical, you know, practical things.
And, you know, one thing I was curious about, just 'cause it, it sounds like you've, you've been really successful in your career of implementing these types of changes within audit functions.
Do you have any prac, you know, any real life examples of, you know, when you influenced a strategic decision or helped shape an organization in the direction and maybe like, what it, what that organization looked like before some of these steps were implemented, and then what the outcomes were after, uh, that was put in place? Of course, lots and lots and lots and lots of examples.
I've been, uh, you know, I've been on a, a journey and I've transformed audit into a strategic partner in three different organizations where our CAE and I currently help many of my clients, uh, to do, uh, exactly that. Um, let me give you an example, uh, from my own personal experience and one from a client.
Uh, so, um, you know, when I started my very first CAE role and I arrived in the, you know, in my job, excited about my new job, uh, soon I discovered that the feedback from the business was rather terrible. You know, that, um, you know, I'd go into meeting, introducing myself as the, you know, the, the new leader, uh, and how lovely to meet them, et cetera.
And I was faced with so much, um, resistance things like, uh, you know, the, what is, what is audit for you guys only borrow our watch to tell us the time, uh, I can't believe the company pays money for this, et cetera, et cetera. And then, like there were, uh, reports, you know, three years worth of, uh, audit actions that had not been implemented. There were a lot of, uh, pending reports that had not been issued, et cetera.
And, uh, through a, a very much like I shared with here an exercise of, uh, an honest dialogue with the team and an honest dialogue with the board. And obviously because I was coming new, I was able to be very objective of what's going on there and set, set certain priorities and take the actions in terms of changing the way that we are working with the business, changing what we are focusing on, changing our reports, changing, uh, the approach, um, uh, training the team, et cetera, et cetera.
The transformation was, um, you know, slowly but surely, remarkably different. And we stepped up into, uh, being that, um, uh, trusted and, uh, respected strategic business partner. Uh, within about a a year the CEO would was calling me for, uh, you know, we had a big issue in the supply chain, for example. And it was my internal audit team who was able to pinpoint where was this problem or where exactly is it? And, um, you know, whereas the rest of the business couldn't.
So we had built the credibility and the bridges and, uh, a real depth of the business that we could add value. Pwc, for example, reduced at the time, it was okay to rely on internal audit work. I think the rules have changed since then, but reduced their fees by 25% based on the work that we've done. And then I went on to do that with other businesses, as I said. And, uh, you know, a client about a year ago I was working with them, we're also facing a lot of challenges.
Um, you know, uh, this, uh, gentleman had inherited a function that had a long history of conflict and a perception of being, uh, in a non-value adding team. And slowly but surely, by working on their communication, their approach, their focus, we changed things around. And within a period of few months, he started to see quite a bit of difference. But by about a year, the difference was remarkable. I would like to remind our audience here that first and foremost audit is about people.
I'm very excited about ai, and I'm very excited, you know, about, uh, what AI could bring. And I've always been a huge champion of analytics. I love technology, but I cannot emphasize enough that we cannot just come and layer some form of technology on something that is broken. We've got to get the basics right and the foundations right in an internal audit function. And those foundations revolve around people. We are people, we are working with people, the board are people.
And all the things that happen in day, day to day-to-day life are only kind of amplified in an audit environment because of the inherent nature of our work where we point out, you know, issues, this is our job, you know, to be able to identify the risks that we can help the business evolve. And so it's so important and crucial that we remember. We remember that, and that would be a key ingredient in how do we become a strategic business partner.
And when you think about some of those examples, and I think those are really good tactical and practical things that our audience could take and start deploying, what are some of the things you've heard from management in this part of the process? 'cause I have to imagine executive leadership and the audit committee are crucial, either detractors or advocates in this process.
And, you know, I I would say in my personal experience, in my career, I've encountered two different types of stakeholders, those that are understand the value of internal audit and are very supportive. And then those that are maybe just haven't been, haven't fully understood it and still think of it as a very transactional style of, um, of auditing yet sort of the police mentality.
What, what are some of the barriers that, like, that you encount that you've maybe encountered when you've tried to implement some of these things? And then, um, what are some of the ways that you've overcome them? Sure. Uh, what you said is absolutely spot on. That's my experience too. And actually, there's, uh, as I said, um, a lot of people who still don't understand what internal audit does. So the challenges stem from previous experiences they have had.
Okay? So, you know, uh, in an apple cart, you're gonna get different kind of apples. You're gonna get a, a bad apple in every car, typically, you know, internal audit is a reflection of the wider population. You're gonna have some brilliant, awesome people and less awesome people just like in it or in sales, or in finance or any other profession. And given the nature of what we do.
So if you are not doing a brilliant job at it, you could leave quite an impression, not the impact impression we desire. And so if as a chief audit leader, you are engaging with a, with an executive or with a board member who've had a terrible experience with audit before, they are without a doubt going to resist you. Um, you know, I've, uh, I've seen that time and time again, and, but, but it's so rewarding when you turn the relationship around. But things like you don't add value.
Uh, you know, what is this about? Uh, you, you know, I remember vividly when I was younger, I used to get that a lot. Uh, you know, you are younger than my daughter. Do you think you're gonna tell me how to do business? Uh, so, um, you know, uh, you're not an IT person. Uh, wan does the audit think they know marketing. Uh, I don't think strategy is your area, you know, you got a lot of that, right? And then you get more silent resistance.
You know, like you might not get a budget, uh, or, you know, uh, little games like that, or, you know, they might cancel a meeting. And I know because I do, uh, coach and mentor different, uh, audit professionals that some of them occasionally, I, I, I, I feel grateful I never had that, maybe because I set very healthy boundaries, but I do know that people are getting, um, disrespect and things like that, which is probably a topic for another podcast.
So the resistance is there either in your face or more silent. Now that makes the task, uh, more challenging. But it's also, as I said, a lot more rewarding when you turn it around. Let the quality of your work speak for you. Let your team speak for you. Let the way you present in those, uh, uh, key moments of, uh, truth, uh, when you presenting to management or presenting at the board, speak for you. So there is no point in sitting and like, defunding someone else's actions.
Take full ownership of your own action, rise to the challenge and deliver. Does this resonate or would you like me to be more specific, Mike? No, I think that was well said. And candidly, I think that, I don't think we could end on a better note.
I, you know, that was, that's exactly, you know, when I think about our, the strategies and how we need to be more strategic partners, and if I'm a practitioner looking to deploy some of those things, you know, I think that really gives 'em a tactical roadmap of how to, you know, how to, how to proceed. Well, Ranya, I just wanna say, take a moment and say thank you for, uh, being on the All Things internal audit podcast.
It was a pleasure having you, and we look forward to having you back again soon. My pleasure. The pleasure is all mine, Mike. Hey, audit pros ready to supercharge your skills and connect with the best in the field. You absolutely need to check out the I'S 2025 International Conference happening July 14th through the 16th in Toronto. And virtually this is your chance to dive into emerging risks, cutting edge tech, and global best practices that will elevate your internal audit game.
Don't get left behind and register now@theia.org. If you like this podcast, please subscribe and rate us. You can subscribe wherever you get your podcasts. You can also catch other episodes on YouTube or the I A a.org. That's T-H-E-I-I a.org.