May 2014

One of the most frustrating events in my career was one of the first times an internal audit client firmly and repeatedly said “no” to one of my recommendations. It was an important point and I tried to explain my reasoning. Management agreed with the finding, but believed corrective action would be too time consuming and resource intensive. My supervisor also supported me, and we believed the risks of not implementing corrective action would be very high for the enterprise. But neither of us could persuade management to implement the recommendation or even find an acceptable alternative course of action.

When management says no and refuses to budge, you realize that it makes no difference how valid your recommendations are, or how hard you worked on the audit.…

One of the features that makes internal auditing so valuable to modern enterprises is that we serve multiple stakeholders, including the board, various levels of management, and even external auditors and regulators. One of the challenges is that these stakeholder groups often have very different expectations of us, and very different perspectives on how we add value.

Differences of opinions among internal audit stakeholders are not uncommon, but it can become particularly problematic if the disagreement is between the audit committee and management. In such cases, the chief audit executive (CAE) can feel caught between two very powerful forces.

I have heard CAEs taking sides in these debates, based not on the particular issue at hand but on whose opinion should take precedence.…

Most of us in internal audit leadership roles naturally assume that board members and management fully understand our capabilities and appreciate the value that internal audit can deliver. But do they really understand? And if they don’t, whose fault is that?

Advocating for the internal audit profession is one of The IIA’s top priorities year-round. But each May, we join our members in turning up the volume a bit in telling our story. As part of International Internal Audit Awareness Month, we seek recognition and proclamations from government officials, we reach out to youth, we get out into the community, we engage through social media, and we participate in myriad other activities to promote awareness and support.…

It seems that internal auditors are increasingly hearing from stakeholders who are concerned about a duplication of efforts between internal audit and other oversight functions within an organization. No matter how meticulously roles and responsibilities are assigned and documented, issues inevitably come up that fall into a gray area between internal audit and other monitoring activities, such as compliance or risk management. And where responsibility is not clearly defined, things can go awry.

A surprising number of internal audit recommendations spring from these “Who’s on first?” quandaries. That’s one of the reasons we spend so much time preparing flowcharts and narratives aimed at delineating responsibilities.…