2013

As the year draws to a close, I find myself engaged in the familiar practice of looking back on the year and reflecting upon the major news stories and pivotal moments of 2013 — those that are shaping the internal audit profession and undoubtedly will have a lasting effect on the way internal auditing is practiced in the future. Not only is it interesting to see how the profession has evolved and how far we’ve come in just a 12-month timespan, but recapping the year also is a beneficial exercise in that each of these stories holds important lessons for us all.…

In a speech that I delivered last spring, I discussed the various roles that an internal auditor can play across what I called the “ethics continuum.” I noted that on rare occasions, when internal auditors become embroiled in a fraud or conduct, they are an “accomplice.” On other occasions, I noted, the internal auditor isn’t an accomplice. Instead, he or she simply sits on the sidelines and does not call out inefficiency, waste, fraud, or mismanagement. I called these internal auditors the “spectators.”

I also noted that from my experience, the most frequent role that internal auditors play is that of a “referee.”…

I started this year with a blog post detailing what I thought auditors should be focused on in 2013. As the year draws to a close, I wanted to focus on the year ahead — the outlook for internal auditing and what’s on the radar for chief audit executives (CAEs), as measured by the Audit Executive Center’s recent North American Pulse of the Profession report, “Defining Our Role in a Changing Landscape” (PDF). While I recognize that this survey is somewhat North America-centric, my recent global travels lead me to believe that many of these trends will be observed around the world.…

A lot has been said and written over the past couple of years about the Three Lines of Defense Model — a tool that is often used to illustrate the interrelationship and roles/responsibilities of the board, management, internal oversight functions, and internal audit in ensuring that risks are adequately assessed and effective controls are in place. The IIA published a position paper on the model earlier this year that outlines the roles and responsibilities of each player — with emphasis on internal audit.  

Theoretically, if all players execute their role correctly, there should never be a complete failure of all three lines of defense.…

For years, investors, global regulators, the media, and others have been clamoring for greater transparency in the corporate sector. Following the global financial crisis in 2008, the chorus reached a crescendo. It was argued that lack of corporate transparency (particularly in the financial sector) was a direct factor in the crisis, and that failure to ensure greater transparency in the future would doom the global economy to further disasters. While the message was pretty clear a couple of years ago, today the noise around transparency is becoming a bit more muddled. Some still favor greater transparency, and others think the current requirements are already too great.…

I often have commented in this blog on how vital talent is to the effectiveness of an internal audit function. Not only is it important for internal audit to have seasoned staff to assess risks and controls, but it is becoming increasingly important to infuse the department with fresh technology skills, analytical thinking, and other competencies that stretch beyond the accounting skills for which auditors traditionally have been known.

Following up on my recent blog on retention, I wanted to expand the discussion to recruiting new talent for our organizations. Specifically, what are we doing well, and what else could we be doing to attract the best and the brightest to the internal audit profession?…

After taking the opportunity with my last blog to focus on acquiring and retaining internal audit talent, I return in this blog with the final installment in a three-part series on the core attributes of an internal auditor. In each of these blogs, I have examined some of our attribute standards that we all proactively abide by.

While many, including The IIA, have made numerous efforts to distinguish between the terms, there remains a lot of confusion around the words “independence” and “objectivity” as it relates to a practicing internal auditor. These words are not synonymous, nor are they interchangeable.…

The global economy continues to improve, and there’s plenty of evidence that organizations are investing in stronger risk management and internal control infrastructure, including internal audit functions. In fact, early indications are that almost one-third of U.S. Fortune 500 companies plan to add new internal audit staff positions in 2014.

 As hard as it may be for CAEs to attract the right talent, recruitment will not be the most significant personnel challenge. It’s convincing the best and brightest internal audit stars to stay with the department when there are attractive opportunities to transition into a business unit or a service firm.…

In my last blog, I observed that internal auditors are expected to demonstrate a number of core attributes. I went on to explore the concept of “professional proficiency” and what that means for internal auditors.

Another attribute that often receives light treatment in internal audit manuals and textbooks is “due professional care.” It goes without saying that internal auditors should exercise due professional care in undertaking their work, but what does that really mean?

The IIA’s Standard 1220: Due Professional Care states: “Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor.”

So what is reasonable and competent?…

As professionals, internal auditors are expected to possess a number of core attributes. An overarching attribute that is not the subject of very much discussion is “professional proficiency.” Most of us understand that professional proficiency is an expectation, but what does it really mean?

IIA Standard 1210: Professional Proficiency requires internal auditors to possess the “knowledge, skills, and other competencies required to perform their individual responsibilities.” I fear that many assume that one automatically demonstrates his or her proficiency by obtaining appropriate professional certifications and qualifications, such as the Certified Internal Auditor (CIA) or Certification in Risk Management Assurance (CRMA) offered by The IIA.…