June 2009

From the very first day I became an internal auditor, the word “independence” took on particular significance. As a young auditor in government, we were taught from the beginning that “independence” was the foun​dation upon which internal auditing’s credibility and effectiveness was based. Over the years, our audit standards were strengthened to mandate reporting relationships that fostered independence. Yet, even when I first assumed the role of a chief audit executive (CAE) in the late 1980s, I was vaguely uncomfortable with touting “independence” when I was clearly employed by the organization in which I worked. I watched way too many “independent” CAEs meet an untimely professional demise for being a bit too “assertive” to assume that I was totally independent.​…

During my travels over the past five years, I have had the opportunity to speak with many audit committee chairmen of leading corporations in the United States and Europe. One of the questions I invariably posed during my conversations was: “what is your foremost expectation out of internal auditing?” With amazing regularity, the response came back: “no surprises.” By “no surprises,” the chairmen (in reflecting the views of themselves and their fellow audit committee members) were suggesting that internal auditing should identify issues before they became a major problem for the company — and by extension — the audit committee.

At first glance, an expectation of no surprises might seem like a reasonable expectation.…