Raising the bar: how internal audit can deliver more value to the business w/ Tom Edwards & Scott Bamber

Most people don’t come to work in the morning thinking about controls. They think about how to achieve their objectives. Internal audit, says Scott Bamber, needs to start from there.

For this edition of Behind the Controls, I sat down with Scott, formerly Director, European Controller at LKQ, the automotive parts distribution group. His career spans 25 years already: external audit first, then 15 years in internal audit across a series of large multinationals: AkzoNobel in coatings and chemicals, Coca-Cola Hellenic Bottling Company in beverages and FMCG, and LKQ, where he has held a series of progressively senior roles in audit and finance. Originally from the UK, Scott has worked across Asia, Eastern Europe and Western Europe, and travelled extensively along the way to carry out audits.

The last six years have taken him into accounting, shared services and financial control, and that is not irrelevant. It means he’s been on the other side of the table, as the person being audited rather than the one doing the auditing. That dual perspective shapes everything he says about how governance functions can add value to the businesses they serve, and what typically gets in the way.

Start with their goals, not yours

Scott’s starting point for adding value as internal audit is not a framework or a methodology. It’s a question: what is the person in front of you actually trying to achieve?

Value means different things to different people. The only way to understand what it looks like for a specific stakeholder is to understand their goals, both at group level and at the level of their own function. If you don’t know what they’re trying to deliver, you can’t know how to help them deliver it.

"Most people, when they come to work in the morning, they don’t come to work to control things. Auditors and risk management professionals are maybe the exception to this. But everybody else is thinking: how can I achieve my objectives? How can I push the boundaries and develop the area of my expertise to deliver value?"

The practical implication is that every engagement, every conversation, every audit observation should be framed around that question. What is this person trying to get from their daily work? And how can the audit function deliver its mandate in a way that helps rather than hinders that outcome?

Be the catalyst, not the referee

Across his career, Scott puts 30 to 40 per cent of the audit findings he’s come across globally down to one thing: functions not communicating effectively with each other.

The pattern is consistent. A function sets its objectives in line with the group goals. Another function does the same. But the two were set in isolation and, when they meet in practice, they pull against each other.

Scott gives a specific example: commercial teams that refer to finance as the sales prevention department. All jokes aside, it captures a real issue. Both functions aligned to the same strategy on paper, creating friction in practice because nobody has brought them into the same room.

"A strong area to add value as internal audit is being that catalyst between getting functions to talk and align. First of all, on the goals, but also, if you find something that is broken, getting an aligned approach to how to improve it."

Bridge the cultural gap

Communication gaps are not only an interdepartmental problem. Scott spent time in Asia earlier in his career, and it gave him a specific lens on another place they show up: between local management and senior leadership based elsewhere.

"The Western management just couldn’t understand why somebody had done something, and the local management couldn’t understand why they were being asked to do something a certain way."

Neither side is wrong. The challenge is cultural rather than competence. And an audit or governance professional with relationships and credibility on both sides can help close that gap in a way most other functions can’t.

"You can’t live your life with a Western mindset in an Eastern daily life. Both sides need to understand where they’re coming from and where they meet, to meet with the group values and group policies."

Share the tools, don't keep them proprietary

I raised the question of real-time insights: whether audit functions can genuinely provide them, or whether the audit cycle means the function is always looking at history. Scott’s view is that it depends on the maturity of both the business and the audit function, and the two tend to go together.

Where the data infrastructure exists, the opportunity is there. But the mistake he’s seen audit functions make is treating their analytical tools as proprietary. Finding a problem using a tool the business can’t access, and then presenting that finding without offering the business visibility of the same data, is a missed opportunity.

"I've seen audit departments find a problem, and then the local management team say: that feels like you've just trapped me, because you found it using this tool and I don't have visibility of that data. There's a big value add in having the grown-up conversation: I'm not here to catch you out. If I've got tools that could help you, let's partner."

His preference is for audit to build on the same systems the business is developing rather than running parallel infrastructure. If the business is developing AI on a particular platform, could audit use the same system and grow the capability together?

"If both succeed together, there’s something under the surface where you’re respected as a business partner and it will help you in the long term."

Justifying the function in tight times

Budget pressure is a reality for most governance functions right now. I asked Scott how you make the case for internal audit to a CFO, CEO or CHRO who is looking to cut costs.

He uses a simple analogy to make the point. Going to the dentist when something hurts is more expensive and more disruptive than going for a check-up before it does. Cutting the audit function to save money now risks creating larger problems later, the kind that require external audit involvement, regulatory scrutiny, or significant operational headcount to fix.

"You need to make sure you haven’t cut into the bone. Everybody needs to trim off fat in hard times, for sure. But if you’re trimming into the bone, you question whether the mandate will get watered down, whether there will be bigger spots that require larger investment to fix."

Scott also points to practical cost-sharing opportunities between audit, risk and control functions, or between audit and the business, that can reduce cost without reducing capability. The human interpretation and judgement that cannot be automated should be the last thing to go.

The ROI question

Demonstrating return on investment for internal audit is, as Scott readily acknowledges, genuinely hard. Some of the most important things the function does are defined by their absence: problems that did not happen, losses that were not incurred.

"What is your return on investment? You can argue it’s financial from a value perspective, but it’s also stronger controls, fewer problems. It’s like saying: how good was our insurance?"

His recommendation is a balanced scorecard rather than any single metric. Some of the indicators he points to:

• Customer feedback from the business functions audit serves. Are they finding the function useful? Are they reaching common alignment on how to move forward?
• How findings compare to what external auditors are picking up. If they are finding significant problems that internal audit missed, that is a signal.
• Whether a decline in findings reflects genuine improvement in controls or declining rigour. The two look identical on a dashboard.
• Whether speak-up volumes are low because the culture is healthy or because people do not feel safe. A number in isolation tells you nothing.

None of these metrics work in isolation. Each needs to be read alongside the others and alongside an honest assessment of what is happening in the business more broadly.

Talent rotation as a measure of trust

Scott makes a point about talent that doubles as a measure of how well the audit function is doing its job. If business leaders actively want to hire people from audit, that is a good indicator the function is doing something right.

"If you can develop talented people within internal audit to move into business roles, and people want your people, that's a good indicator you're doing something right. It's a virtuous circle."

The flow works both ways. It’s equally a good sign if people from the business want to come in on secondment or permanently. And when they do, it sharpens the audit function's understanding of what actually matters on the ground. They will tell you what’s important, what’s less important, and where the real focus should be. That kind of perspective is hard to develop from the outside.

The problem occurs when business leaders only ever encounter audit professionals in pressured situations, coming in to assess work that people are already stretched to complete. When a hiring decision comes up, the auditor will almost always lose out to someone already embedded in the team, according to Scott.

His view is that the way engagements are conducted is what changes that. Can the fix proposed reduce administrative burden rather than add to it? Can control points be centralised or automated rather than multiplied?

"If you're thinking about how we can both get what we want, then you get picked up on the radar of these people and they want to bring you into their team."

A metric around talent rotation, both in and out, is therefore a useful indicator of whether the audit function is isolated or embedded and trusted.

Empathy without losing the mandate

Scott’s closing thought is a useful counterweight to everything he’s said about listening and partnering with the business. The risk of taking the business partner approach too far is that the function loses what makes it useful in the first place: its objectivity.

"You need to empathise to the point which doesn’t compromise your mandate and independence. You need to stay objective. You’re no use if you just become the same as management. You have a role, you have a function. Don’t dilute it trying to chase business value."

The balance he describes is between genuine empathy, understanding what the person on the other side of the table is actually dealing with, and honest objectivity about what needs to change.

As Scott puts it, you learn a lot more from listening and empathising with a situation, and being honest with yourself when you are trying to fix it, than from telling people what they should do and expecting them to do it.

Over to you

Is your audit or governance function seen as a trusted partner by the business, or is there still distance to close? And what has worked, or not worked, when it comes to demonstrating value?

Drop your thoughts in the comments. I’d be interested to hear what resonates from your own experience.

Want more insights like this?

Subscribe to Behind the Controls to stay ahead of what’s shaping Audit, Risk and Compliance leadership, and how top professionals are navigating it.