When there’s a serious breakdown in controls, sooner or later someone will pose the inevitable question of “where were the internal auditors?” It’s not just a blame game. After any audit failure, the CAE must re-evaluate and learn from possible mistakes to prevent similar gaps in the future.
In the past, whenever a calamity occurred in an organization, reviewing the CAE’s role was often cut and dried. Perhaps the internal audit function had insufficient independence and authority to address the risk that eventually blew up. Or its risk assessments didn’t cover all parts of the organization. Maybe internal auditors hadn’t immediately identified and reported on an issue, or they failed to follow up in a timely manner to ensure management had taken action.…