“Trusted advisor” is the phrase every audit strategy document uses and almost none of them defines. It usually means the thing the CAE wants: to be invited into decisions before they are made rather than asked to review them afterwards. The phrase hides a mechanism. Stature is not granted by a charter or a strategy slide; it is earned in a specific sequence, over years, through behaviour that management can observe, and it is lost faster than it is built. This guide describes the sequence, the moments where advisory work is done well and the independence tripwires inside each of them, the relationship investment that happens between audits, and the arithmetic of patience that most functions underestimate.
It is written for audit leaders and for the senior auditors and managers who do most of the relationship work in practice. The assurance vs advisory guide explains the two services; this one explains how a function gets asked to provide the second.
In this guide
- What “trusted advisor” actually means
- The credibility sequence: reliability, insight, invitation
- Stage one: reliability, and why it cannot be skipped
- Stage two: insight, the thing management cannot get elsewhere
- Stage three: invitation, and the moments it arrives
- Advisory moments done well, and the independence tripwires
- Relationship investment between audits
- The patience arithmetic
- How to tell whether it is working
- Worked example: Lakeshore Bancorp, four years
- Frequently asked questions
- Related guides
What “trusted advisor” actually means
Strip the phrase to behaviour and it means four observable things. Management asks internal audit for a view before a decision rather than after. Management shares bad news with the function early, voluntarily, because they expect to be helped rather than written up. The committee asks the CAE’s opinion on matters outside the plan. And when the function does write someone up, the finding is accepted as fair by people who did not enjoy it. A function that can point to all four has stature; a function that can point to none has a charter.
| Observable behaviour | Function with stature | Function without it |
|---|---|---|
| Timing of requests | Asked to review the design before the system is built | Asked to audit the system after the go-live incident |
| Flow of bad news | Control owners call when something breaks | Control owners hope audit does not notice |
| Committee behaviour | Chair asks the CAE “what do you think?” on matters outside the pack | Chair asks whether the plan is on schedule |
| Response to findings | Disagreement about remediation dates, not about facts | Disagreement about facts, wording, ratings and whether it is a finding at all |
| Presence in the room | Invited to the steering committee as a standing observer | Receives the minutes |
| Budget conversations | Function asks for capacity; management argues about which engagements, not whether | Function defends its existence annually |
Two misreadings of the phrase cause damage. The first treats trusted advisor as a posture: softer findings, more consulting, fewer ratings. That is not stature, it is capture, and management can tell the difference. The second treats it as a title the function can claim once it has written it into the strategy. The function that announces itself as a trusted advisor before management has experienced it as one has made the next real finding harder to deliver. Stature is a conclusion management reaches, not a claim audit makes.
The credibility sequence: reliability, insight, invitation
Stature is built in a fixed order, and functions that try to skip a stage fall back to the one they skipped. The order is reliability first, insight second, invitation third. Reliability is the function doing exactly what it said it would do, every time, with no surprises. Insight is the function telling management something true that they did not already know and could not easily have found out. Invitation is management asking for the function’s view before acting. Each stage is a precondition for the next, and the time each takes is longer than anyone wants.
| Stage | What management experiences | Typical duration to establish | What destroys it | What it unlocks |
|---|---|---|---|---|
| Reliability | Audit does what it says: scope agreed, dates kept, no surprises in the report, facts right | Two to four engagement cycles with the same stakeholders (12–24 months) | One factual error in a report; one surprise at the closing meeting; one missed commitment | Management stops defending and starts listening |
| Insight | Audit tells them something useful they did not know, in a form they can act on | Twelve to thirty-six months, because insight requires domain fluency that takes engagements to build | A finding that is accurate but trivial; advice that ignores operating constraints | Management starts asking questions outside the engagement |
| Invitation | Audit is asked in before decisions; bad news arrives early | Three to five years for a function; faster for an individual with a strong record | One advisory conversation that later appears as a finding without warning; one leaked confidence | The function’s views shape decisions it would otherwise audit afterwards |
The sequence explains a common frustration: a new CAE with a strong advisory background arrives, announces a trusted-advisor strategy, and finds management unmoved. The CAE has insight and the habit of invitation from a previous organisation; the function does not yet have reliability in this one. The first eighteen months of a CAE’s tenure are spent earning the right to the strategy, which is why the first ninety days as CAE guide spends so much of its time on listening and delivery rather than on vision.
Stage one: reliability, and why it cannot be skipped
Reliability is unglamorous and it is where most functions actually fall short. Management’s working model of internal audit is built from a handful of experiences: the engagement that ran three months late, the report with the wrong number, the finding that appeared at the closing meeting without warning, the auditor who asked for the same document three times. Each of those is a withdrawal from an account that insight cannot refill. The behaviours that build reliability are specific.
- Scope agreed and kept. The opening meeting sets the scope; the engagement does not expand it without a conversation. Scope creep discovered at the closing meeting is the single most common cause of a management view that audit cannot be trusted.
- No surprises, ever. Every finding is discussed with the control owner before it is written; every rating is explained before the report; anything significant reaches the sponsor before the closing meeting. The rule costs nothing and buys most of stage one.
- Facts right the first time. A report with one wrong number is a report management will argue about for a month. The review notes discipline exists for this reason.
- Requests made once. A PBC list issued complete and early, with the reason for each item, signals competence; the PBC survival guide describes the auditee’s side of a badly run request process, which is the side management remembers.
- Dates kept. Report timeliness is the reliability metric management notices most; a function whose reports arrive ten weeks after fieldwork has told management that its own commitments are negotiable.
- Proportionate findings. A function that reports every immaterial exception teaches management that findings are noise. Reliability includes the judgment not to write.
Reliability is also where individual auditors build their own stature, independently of the function. A senior who runs engagements on time, surprises nobody and gets the facts right will be asked for views by control owners long before the function as a whole is, and those individual relationships are the capillaries through which the function’s stature eventually flows. The lead auditor’s playbook describes the engagement rhythm that produces it.
Stage two: insight, the thing management cannot get elsewhere
Insight is the stage most functions believe they are already at and most are not. The test is severe: did the function tell management something true, important and not already known, in a form they could act on? “Controls over vendor master changes need strengthening” fails the test; management knew. “Three of your twelve depots are approving their own overrides, 1,412 times last year, and the reason is a delegation table nobody updated after the 2024 reorganisation; here is the fix and it takes a week” passes it. The difference is domain fluency plus evidence plus a cause management had not seen.
| Source of insight | What it looks like | Why management cannot get it elsewhere | Where the guides cover it |
|---|---|---|---|
| Cross-process visibility | The same root cause appearing in payables, payroll and expenses: one delegation table, three symptoms | Each process owner sees only their symptom | The thematic view in reporting to the audit committee |
| Population-level evidence | Full-population analytics that show the pattern, not a sample that hints at it | Management reports are built on exceptions raised, not on the population | The analytics catalogs and continuous monitoring guide |
| Causal analysis | The reason the control failed, established rather than assumed | Management fixes symptoms because the symptom is what they see | Root cause analysis for findings |
| External criteria | How the organisation compares with the regulator’s expectation or the standard, stated precisely | Line management rarely reads the primary sources | The Topical Requirements and COSO principles guides |
| Pattern across time | The issue that has been “being remediated” for three years under four different action plans | Nobody else keeps the longitudinal record | The life of a finding and issue validation guides |
| The uncomfortable connection | That the acquisition integration risk and the IT access risk are the same risk | Organisational boundaries prevent anyone else from saying it | The strategic risk assessment guide |
Insight is produced by two things the function controls: the engagement mix and the analytics capability. A plan that is 70 percent SOX testing produces reliability and almost no insight, because SOX testing confirms what the control framework already says. A plan with process audits that use full-population analytics and ask why produces insight as a by-product. The function that wants stage two has to build the plan that generates it, which is a point the pigeonhole guide makes from the auditor’s side.
Stage three: invitation, and the moments it arrives
Invitation arrives in recognisable moments, and they are rarely dramatic. A business head asks whether the function would “take a look” at a vendor contract before signature. A transformation program asks for a controls workstream lead. The CFO asks what the function thinks about the proposed close calendar. The committee chair asks the CAE, after the formal agenda, what worries them. Each moment is a test: handled well it leads to the next; handled badly it is the last.
| Invitation moment | What management is really asking | The right response | The wrong response |
|---|---|---|---|
| “Would you take a look at this before we sign?” | Tell us what we have missed, quickly | A short, specific view within the deadline, with the independence boundary stated once | A scope memo, a three-week timeline and a report |
| “Can someone from audit sit on the steering committee?” | Give us early warning; lend us credibility | A standing observer who speaks when asked and once a month when not; written understanding that observation is not approval | A voting member, or a refusal on independence grounds without offering the observer alternative |
| “What do you think of our new control design?” | Help us get it right before you test it | Design advice framed as “the test we would apply is X; your design would pass or fail it because Y” | Designing the control and then auditing it next year |
| “Could you run the investigation?” | We need someone independent and competent | Yes, under the fraud protocol, with counsel engaged and the committee told; see the first 48 hours | Informal fact-finding without the protocol |
| “Off the record, what worries you?” (from the chair) | Give me your judgment, not your pack | A candid, short answer with the basis, and the same answer in the executive session | The pack, repeated |
Two features recur in the right responses: speed and a stated boundary. Management invites the function because it wants a competent view quickly; a function that responds with a process has misunderstood the invitation. And every advisory response carries a one-sentence statement of what the function is and is not doing (“this is our view on the design; it is not a review of the implementation and we will test it next year as planned”). The sentence protects independence without declining the invitation, which is the balance the next section is about.
Advisory moments done well, and the independence tripwires
The Standards permit advisory services and require the function to protect its objectivity while providing them: Domain II, Principle 2 sets the objectivity requirements (Standards 2.1 to 2.3), and the organisational independence standard (7.1) sits behind them. The practical tripwires are more specific than the Standards’ language, and most functions trip at least one in their first year of advisory work.
| Tripwire | How it happens | Consequence | Safeguard |
|---|---|---|---|
| Designing what you will later audit | The function writes the control, then tests it, then cannot find it deficient | Objectivity impaired; the finding never gets written | Advise on the test the function would apply; let management design; rotate the auditor off the later engagement; disclose per Standard 2.3 if unavoidable |
| Advisory that becomes a finding without warning | An informal review surfaces a problem that later appears in a report as if discovered in fieldwork | The invitation is never repeated | State at the start what happens to anything significant found during advisory work; raise it immediately and separately |
| Taking a management decision | The steering committee asks the audit observer to vote or to approve a go-live | The function owns an operational outcome | Observer status in writing; the function’s view is recorded, the decision is management’s |
| Advice without evidence | Pressure to give a view on a question the function has not examined | The view is wrong and the function’s reliability is damaged | “We have not looked at that; here is what we would look at, and how long it would take” |
| Confidentiality drift | Something said in an advisory conversation reaches a third party through the function | Bad news stops flowing | The same confidentiality discipline as fieldwork; nothing leaves the conversation without the speaker knowing |
| Capacity capture | Advisory requests consume the plan; assurance coverage falls | The committee loses the assurance it approved the function for | Advisory capacity budgeted in the plan (Standard 9.4 includes it); requests above the budget go to the committee as plan changes |
| Softening to keep the seat | A finding is downgraded because the control owner is now a friend | Capture; the committee eventually notices | Ratings set by the rule, reviewed by someone outside the relationship |
The safeguard that matters most is the first one. A function that designs controls has, for that control, stopped being an audit function. The workable line is to advise on criteria and tests (“here is how we would evaluate it”) and to leave the design to management, because that is also what preserves the function’s ability to say later that the design failed. The independence and objectivity guide sets out how the impairments arise and how they are disclosed when they cannot be avoided.
Relationship investment between audits
Most of the work of building stature happens when no engagement is running, and most functions do none of it. The engagement is where reliability is demonstrated; the time between engagements is where the relationship is built. The investment is modest and it compounds.
| Investment | Frequency | Who | What it produces |
|---|---|---|---|
| Stakeholder conversation with no agenda | Quarterly with each business head in the universe’s top tier | CAE or audit director | Early sight of change, risk and bad news; the invitation habit |
| Reading the business’s own pack | Monthly | The auditor who owns the relationship | Fluency; the ability to ask a question the business head has not heard from audit before |
| Attending the operating review as an observer | Monthly or quarterly | Audit manager | Context for the next engagement; visibility of decisions in progress |
| Follow-up on findings as a conversation, not a form | At each milestone | The auditor who wrote the finding | Remediation that actually works; see evaluating management responses |
| Sharing something useful with no ask attached | Opportunistically | Anyone | The sense that audit is on the organisation’s side: a regulator’s new guidance, a peer’s incident, a tool |
| Post-engagement feedback request | After every engagement | Audit manager | Reliability data; a signal that the function wants to be told |
The quarterly no-agenda conversation is the highest-return item on the list and the one most CAEs cancel first under time pressure. Its value is not in what is said; it is in the fact that the business head has a relationship with the CAE that is not mediated by a report. The first time bad news arrives early is almost always through a relationship built in those conversations. The presenting to the audit committee guide describes the same logic at committee level: the chair who has a quarterly call with the CAE asks different questions from the one who meets them four times a year across a table.
The patience arithmetic
Stature compounds slowly and collapses quickly, and the asymmetry is the reason most functions never get there. A working model: each reliable engagement with a stakeholder adds a small increment to their trust; each insight adds a larger one; each surprise, factual error or breach of confidence subtracts a multiple of either. Over a typical cycle, a business head experiences two or three engagements a year from the function. At that rate, reliability is established in about two years and insight in three to four, which puts invitation in year four or five for a function starting from scratch.
| Year | Stakeholder’s accumulated experience | Realistic stature | The risk that resets the clock |
|---|---|---|---|
| 1 | Two or three engagements; first impressions | None; the function is being evaluated | A late report or a surprise finding becomes the stakeholder’s working model for three years |
| 2 | Five or six engagements; pattern established | Reliability, if every engagement delivered | One factual error in a high-profile report |
| 3 | Insight delivered at least once; analytics visible | Early insight; questions start arriving outside engagements | Insight that ignored operating constraints and read as naïve |
| 4 | A pattern of useful views; one advisory request handled well | Invitation begins with individual stakeholders | An advisory conversation that resurfaced as a finding |
| 5+ | The function is part of how decisions get made | Stature at the function level | A change of CAE that resets the relationships; a capture episode that the committee notices |
Three implications follow. Stature is held by people, not by the function, so turnover of CAEs and relationship owners resets the clock more than most boards realise; a new CAE inherits the plan, not the trust. The marginal value of avoiding one bad engagement exceeds the value of several good ones, which argues for the no-surprises rule even when it slows a report. And a function that is three years into the sequence should not change its strategy because invitation has not yet arrived; it should check whether reliability and insight are actually in place, which is what the measures in the next section are for.
How to tell whether it is working
Stature is measurable, imperfectly, through proxies that the internal audit KPIs guide lists among its stakeholder measures. Six are worth tracking for a function pursuing the sequence deliberately.
- Unsolicited requests per quarter: advisory requests, invitations to observe, questions from business heads outside engagements. The count should rise from zero to a steady handful by year three.
- Self-reported issues as a share of all issues: the proportion of findings that management raised before audit found them. Rising share means bad news is flowing.
- Days from incident to audit awareness: how quickly the function hears about control failures from the business rather than from the report.
- Fact disputes per report: disagreements about what happened, as opposed to about remediation. Should fall towards zero.
- Committee questions outside the pack: a count kept by the CAE after each meeting.
- Stakeholder survey score on “audit understands our business”: the single survey item that tracks insight.
None of these is precise and all of them can be gamed; the point is to watch the direction. A function that has been pursuing a trusted-advisor strategy for three years with no movement on any of the six has either not established reliability or is producing findings without insight, and the fix is in the plan and the engagement discipline, not in the strategy slide.
Worked example: Lakeshore Bancorp, four years
Lakeshore Bancorp is a $9 billion regional bank holding company with a national-bank subsidiary, a 22-person internal audit function and a 126-entity audit universe. In FY23 the function had a reputation problem that the audit committee chair described, in the CAE’s first executive session, as “accurate and unhelpful”: reports were factually sound, late, and received by management as attacks. The incoming CAE did not announce a trusted-advisor strategy. She set three operating rules and told the committee she would report on them.
The rules were the reliability stage: no finding reaches a report without the control owner having seen the facts; no report is issued more than thirty days after fieldwork ends; every engagement opens with a scope the sponsor has signed. Report timeliness fell from a median of 71 days to 26 within the first year. Fact disputes, which the function started counting, fell from an average of four per report to under one. Nothing else changed in year one, and the chair’s assessment at the end of it was “better, still not useful”.
Insight arrived in year two through the plan. The function added full-population analytics to its process audits and rebuilt its reporting around the four committee questions. The wire operations audit found that $4.2 million of wires had been self-approved through a platform access gap that the first and second lines had each assumed the other was monitoring; the year-end journal entry run surfaced 14 self-approvals and a $1.1 million post-close reclassification. Both findings told the CFO something true and important that nobody in the bank had assembled, and both came with the cause established and the fix specified. The CFO’s behaviour changed within a quarter: he began sending the function the close calendar for comment and asked for a view on the proposed CECL model upgrade before it was commissioned.
Invitation arrived in year three, and the function nearly lost it. The head of operational risk, rebuilding the RCSA after the operational risk audit, asked the function to “help design” the new scoring scale. The CAE declined the design role and offered the test instead: the function wrote a one-page note on how it would evaluate any scale (consistency across units, link to appetite, evidence of use in decisions) and reviewed the second line’s draft against it. The scale was management’s; the function tested it in FY27 and reported two weaknesses without impairment. In the same year the function was asked to sit on the core-banking replacement steering committee; it accepted as a non-voting observer, in writing, and reported its observations to the committee quarterly. By year four the function was receiving six to ten unsolicited requests a quarter, 31 percent of issues in the tracker were self-identified by management (from 9 percent in FY23), and the chair’s question in the executive session had changed from “are you on schedule?” to “what are we not seeing?” The strategy document was written afterwards, and it described what had already happened.
Frequently asked questions
What does “trusted advisor” mean for an internal audit function?
Four observable behaviours: management asks for audit’s view before decisions rather than after; bad news reaches audit early and voluntarily; the committee asks the CAE’s opinion on matters outside the plan; and findings are accepted as fair by people who did not enjoy them. It is a conclusion management reaches, not a claim the function makes.
How long does it take an internal audit function to build stature?
Three to five years from a standing start, in a fixed sequence: reliability (one to two years of engagements with no surprises and no factual errors), insight (another one to two years, built through analytics and domain fluency), then invitation. Individuals can move faster than functions; turnover resets the clock.
Can internal audit give advice without losing independence?
Yes, with safeguards. Advise on the criteria and tests the function would apply rather than designing the control; keep decisions with management; state the boundary in every advisory response; budget advisory capacity in the plan; rotate auditors off engagements covering work they advised on; disclose impairments that cannot be avoided, as the Standards require.
What destroys audit stature fastest?
A surprise at the closing meeting, a factual error in a report, an advisory conversation that resurfaces as a finding without warning, and a breach of confidence. Each subtracts a multiple of what a good engagement adds, which is why the no-surprises rule is worth more than any strategy.
Is being a trusted advisor compatible with hard findings?
It depends on them. Stature is built by being right and fair, not by being soft; a function that downgrades findings to keep a seat has been captured, and management can tell. Findings are set by the rating rule and delivered without surprise; that combination is what earns the invitation.
How do we measure whether the strategy is working?
Track unsolicited requests per quarter, the share of issues self-identified by management, days from incident to audit awareness, fact disputes per report, committee questions outside the pack, and the stakeholder survey item on understanding the business. Watch the direction over years, not the level in any quarter.
Related guides
- Assurance vs advisory — internal audit’s two services explained.
- Independence and objectivity in internal audit — what they mean and how they break.
- Getting recommendations adopted — the psychology of yes in audit.
- The escalation ladder — when and how to go over someone’s head.
- The CFO and internal audit — a working-relationship guide for both sides.
- Your first 90 days as chief audit executive — listening tour, health check and report.
- Presenting to the audit committee — ten minutes that define your function.
- Internal audit KPIs — 30 metrics that show whether the function works.
- The audit closing meeting playbook — no surprises, no ambushes, no retreat.
Leave a Reply