Over the past two years, I have heard executives complaining with increasing frequency that “internal auditors just don’t understand the business.” My sense is that some of these complaints are legitimate while others originate from business unit managers who simply don’t want internal auditors probing around in their areas of operation.
As I have observed before, many internal auditors were brought into their organizations in recent years to help with enhanced internal audit coverage of financial controls. Many who made up this new generation of internal auditors had little background in their company or its industry. They were proficient in Sarbanes-Oxley related audit support, but had little — if any — experience in auditing operational risks.…