There has been no shortage recently of corporate scandals born from ineffective corporate governance, poor risk management, and toxic cultures. In each case, I inevitably hear the question, “Where was internal audit?” There is never a simple answer to that question. As with all things as complex as modern business, there is rarely an easy explanation when things go horribly awry.
In each instance, media reports, regulatory filings, or company statements — even the occasional congressional hearing — give us a glimpse into a piece of what may have led the organization astray. But to suggest a failure by internal audit is a conclusion that should be drawn only when the facts are known.…