But we’ve also found them to be somewhat counter-intuitive in talking to managers. Facilitate this lifelong relationship between your company and your employees and ex-employees, and you’ll be able to drive a lot more value. Even companies that don’t set up alumni networks, almost certainly their alumni have set up an informal network. We see this all the time in terms of companies that have set up alumni networks.

What is the purpose of an internal audit?

Her new book is Managing Up, and whether you’re managing up or down or just managing yourself, we can help. Thanks so much for sharing this practical advice, and I know that you’ve helped a lot of people see a wider path forward than they maybe saw it before. And what I see is that people focus way too much on what they’ve already done and not enough on the value they can continue bringing to the table if they’re compensated to do that. You deserve to get compensated for what you bring to the table, but how you make that business case is critical.

Leverage AI-powered audit management technology

So much of work is being able to navigate human behavior, understanding what motivates people, how do you get buy-in, how you persuade them to go along with your idea, or how do you avoid someone getting defensive if you need to push back. It’s more so positioning yourself as a thought partner or a trusted advisor to them. It’s no longer just sucking up or ingratiating yourself to your manager. You may have many different bosses, and the way we think about managing up has changed over the last 10, 20 years. How to succeed within such a system, what many people call managing up, is a skill that you can learn and develop with experience, and that effort pays off not just in opportunities and rewards, but also just in your satisfaction in your work day to day. You want to advance in your career from getting things done as an individual contributor to showing you can build and motivate a team to demonstrating ROI and results.

Records should also capture results of audit program reviews, showing how the program evolves over time. Audit program records should include documentation related to individual audits such as audit plans, audit reports, nonconformity reports, corrective and preventive action reports, and follow-up reports when applicable. Program implementation also requires ensuring audit teams have necessary resources including access to relevant documents, appropriate audit tools, adequate time to conduct thorough assessments, and support for addressing identified issues or concerns. For food safety operations, audits might be scheduled around peak production periods or timed to assess seasonal product lines. Larger organizations may need multiple interconnected procedures to manage the complexity of their audit programs.

Organizations must consider multiple resource categories when planning their audit activities. They need skills in resource allocation, team coordination, and stakeholder communication. Tech innovations are driving the rapid evolution of everything humans do, and auditing is no exception.

Don’t wait until you’ve finished data-gathering to start writing; you’ll forget crucial details and nuances that inform rounded audit reports. AI-powered platforms can analyze 100% of transactions rather than samples, flagging anomalies and control failures as they occur rather than months later during scheduled audits. This includes automated control monitoring, exception reporting and regular touchpoints with business units to identify new risks before they materialize into issues. Traditional annual audit cycles create gaps where risks evolve faster than your audit plan addresses them.

Essential Skills Every GMP Internal Auditor Should Develop Scilife

And because they’re lower on sociability, they don’t seem as warm or as friendly. Because of all of this, they don’t operate very well with ambiguity. So, if you’re pitching something to them, it needs to be grounded in, how is this following protocol, precedent? This is the analytical thinker who really loves data, precision, systems. Because of that, they usually need more time to process. How do people feel about the situation?

This article is about STRATEGY

• So we take large amounts of data, needle in the haystack, look for bad behavior, block it when we find it.
• We cannot be the only innovative company in the world.
• But if you do, the risk is that they could do bad things.
• Organizations may establish multiple audit programs depending on their size, complexity, and management system requirements.
• For board and audit committee relationships, provide regular updates on audit activities, risk trends and control effectiveness.

And sometimes it’s going to take a couple of days. The important thing about the “alignment conversation”, quote, unquote, is that it’s two-way. What you’re saying, and what I’ve been observing you do for the past few months, is that the alignment conversation is not a conversation. So, a lot of the conversations I’m having now concern introducing people to our thinking and helping them embrace it, right?

While the audio quality is not great, the conversation is. This episode originally aired on HBR IdeaCast in May 2013. Women at Work’s editorial and production team is Amanda Kersey, Maureen Hoch, Tina Tobey Mack, Hannah Bates, Rob Eckhardt, and Ian Fox. Whenever there’s a change happens, that’s their immediate reaction, is like, This is not good. It’s not me imparting wisdom to you, it’s me sharing the plan and you pushing back or you asking questions. Listening to the objections, it is an incredibly important exercise and it takes time.

ISO 10993-18: A Comprehensive Guide to Chemical Characterization of Medical Devices

But this needs to happen for every company, every entity, every piece of critical infrastructure over the next few years for us to live in a new environment where bad actors are going to move faster and faster. So we take large amounts of data, needle in the haystack, look for bad behavior, block it when we find it. So the whole idea is to make security more real-time. We are connected to every security system that exists in a company.

The audit process is composed by different steps that need to be followed for an efficient management of inspections. These actions are decided and undertaken by the auditee within the agreed timeframe. Obstacles encountered during audits shall be reported, as well as unresolved different opinions with the auditee representative. Audit findings, conclusion and reports shall reflect the activities performed during the audits. The application of this document to other types of audits is possible, provided that special consideration is given to the specific competence needed. Best practice varies by organization size and risk profile, but contemporary approaches emphasize continuous monitoring and risk-based scheduling rather than fixed annual cycles.

• This approach provides faster value delivery and creates opportunities to adjust audit scope as you learn more about the business environment.
• I think the second point of engaging external network intelligence also make some managers a little uneasy until they think about it.
• Turning up once a year, with little forewarning, auditing a department and then disappearing for another 12 months does not help build the necessary bridges between internal audit and the rest of the business.
• Running an effective audit program isn’t just about conducting audits—it’s about building a systematic framework that ensures consistency, efficiency, and continuous improvement.

Send materials to participants at least seven days before meetings to ensure adequate preparation time. Talk about increased efficiency, better processes and the opportunity to do a trial run for an external audit. Don’t forget to convey the benefits of the audit; it’s a process designed to benefit them, not just to fulfill a governance need. According to The Institute of Internal Auditors’ Global Risk in Focus 2025 report, organizations now face rapidly evolving challenges, including cybersecurity threats, digital disruption and complex regulatory requirements.

Establish comprehensive quality assurance and performance management

In some organizations, some of the people I work with, skip level conversations are baked into the culture. Meeting with your skip level can be a little tricky because you don’t want your boss to feel like you’re going around them, you’re cutting them out. They know your name, they know the types of things that you work on because your advancement in the organization, even project assignments may involve and typically will involve other people besides your manager. And sometimes it’s easier just to stay the course, do what you’re doing every day. Some people are fearful of having this conversation because they don’t know how to bring it up without it sounding forced or contrite. And when you’re ready for more podcasts, articles, case studies, books, and videos with the world’s top business and management experts, find it all at HBR.org.

HBR Store

There’s a lot out there and we’ve got a lot of episodes about this too, but how would your advice for that differ from what people have maybe already heard, or know how to advocate for yourself for getting a raise or getting a promotion? That most people play it too safe and will think, “Well, it’s not my place. That matters, and so does presenting a path forward because yes, it’s one thing to identify a problem, you also want to make sure you make it easy for the people around you to say yes or no to your proposal.

Discover how Diligent can help you manage the entire internal audit process while delivering strategic insights that drive business value. The platform offers AI-powered analytics, continuous controls monitoring and automatic risk identification, empowering organizations to monitor enterprise risks in real time with full coverage across business units and subsidiaries. These ten strategies accelerate your internal audit management process from compliance to strategic advantage. Moving beyond sample-based testing to comprehensive data analysis represents one of the most significant opportunities for internal audit transformation. Heat maps showing control effectiveness across business units, trend analyses revealing deteriorating controls, and benchmarking data comparing your organization to peers transform static audit reports into actionable intelligence.

Boost operational efficiency, strengthen internal controls, and surface risk sooner. Elevate your impact with managing an audit risk-based auditing and SOX assurance. Automate across each area of IT risk and compliance management. Visualize and address every risk across your organization. Future-proof your investment with a connected risk platform that aligns efforts across audit, risk, compliance, and more.

Internal audit is how companies evaluate their internal controls, including governance and accounting processes. Additionally, it provides checklists and recommendations for effective audit execution and management. What specific steps could strengthen your audit program’s effectiveness in driving food safety improvements? Performance indicators help track characteristics such as audit team ability to implement audit plans, conformity with audit schedules, and feedback from audit clients, auditees, and auditors themselves. Additionally, records related to audit personnel covering competence evaluations, performance assessments, team selection decisions, and professional development activities should be maintained and properly safeguarded.

I think about it saying, listen, if the bad actor is going to move at this space and we have to analyze things in real time, we have to have a handle on all that’s happening in the organization. There are more than 1000 episodes of IdeaCast and HBR has more podcasts to help you manage your team, your organization, and your career. So I am always recommending that if you have a goal, let’s say you approach your manager and you say, “By the end of this year I would love to expand my team from two to four people, what would you need to see in order to feel comfortable doing that? And that may involve asking people questions about, “Hey, I’d love to hear how it’s going with that product or project management process. How do you recommend people approach this conversation with their manager? ” Is that unpleasant realization that people sometimes have when their boss that they get along with great suddenly disappears?