2016

The vast majority of my blogs are focused on the strategies and practices that internal auditors can deploy to generate value and succeed as professionals. However, it is important to occasionally step back and discuss actions or mistakes that can prevent or derail success. Everyone makes mistakes, but some should be avoided at all costs.

Success in internal auditing rarely happens overnight, and it’s never guaranteed. It can take years to develop the requisite knowledge, skills, and expertise, and even then the process of learning and improving never really ends. But the most carefully planned internal audit career can come crashing down in a moment over a serious mistake.…

The recently completed IIA International Conference in New York brought together more than 2,500 internal audit practitioners to share knowledge, network professionally, strengthen old friendships, and create new ones. It also offered the opportunity for the kind of interactions that can draw out insights into the profession.

One discussion I was made aware of involved a longtime chief audit executive (CAE) who was lamenting the growing use of the rotational CAE model in his industry. The number of firms turning to the model, including some of the largest within that industry, is alarming, the executive confided.

I have written in the past about my apprehensions about the rotational CAE model.…

A recent blog I read raised serious questions about the health of a well-known online enterprise. The thrust of the article was that the enterprise had seen significant turnover in its internal audit function twice in little more than two years. The auditor cited speculation that the most recent departure of key internal audit personnel was an ominous sign and that the enterprise was headed for major trouble.

While I’m not one to encourage speculation, especially about something as significant as the overall health of a company, I’ve concluded that sudden or unexplainable turbulence in an internal audit function can serve as the “canary in the coal mine.”…

In a blog last January, I shared​ “5 Resolutions for Every Internal Auditor in 2016.” At the outset of the year, I urged members of the profession to:

• Be attuned to upcoming regulatory changes
• Advocate for mandatory internal audit in publicly traded companies
• Be wary of internal auditing’s expanding scope of work
• Invest in talent management
• Step out of their “comfort zones”​

As we enter the second half of 2016, I still believe these are initiatives worth th​e pursuit of everyone in our profession. However, the events of the first half of the year have also highlighted some ongoing and emerging trends that warrant our continuous focus.…

The father of modern internal auditing, Larry Sawyer, once observed:

“Employee and management fraud is a poisonous weed that flourishes in a permissive climate where the seeds of fraud are helped and even invited to grow and mature.”

While Sawyer might have been a bit melodramatic in describing the risks related to fraud, there is no question that fraud risks have been around much longer than the internal audit profession itself. And, while the emphasis on fraud ebbs and flows, the risk of fraud itself never goes away.

There are many factors that influence the priorities of 21^st century internal auditors.…

Two investor groups issued recommendations last week urging rejection of the upcoming vote of confidence in VW’s management board. The messages from investor advisory groups PIRC and Institutional Shareholder Services (ISS) are stunning in their frank and damning assessment of the troubled automaker’s governance practices.

The recommendations, while significant in their implications for investors and VW management, also carry an important message that should not be overlooked about the value of internal audit.

At the heart of the PIRC and ISS recommendations is that they believe VW has not done enough to fix a variety of corporate governance weaknesses, according to published reports.…

I know from experience how frustrating it can be as a chief audit executive (CAE) or member of the internal audit staff when management does not value the contributions you can make to enhanced risk management, internal controls, or governance in the organization. The signs are often evident:

• Few if any audit requests come your way throughout the year.
• Minimal input is received during internal audit’s annual risk assessment process.
• You are not invited to meetings where business strategy is discussed or formulated.
• Recipients of our reports are indifferent or resistant to conclusions or recommendations.
• When a significant risk is identified, management doesn’t call you – they seek a consultant.

Each year internal auditors around the world make a concerted effort to raise awareness of our profession during May. Internal Audit Awareness Month has become a celebration of the great value internal auditors bring to their organizations, from providing assurance on compliance and governance issues to advising on emerging risks and business strategies.

Indeed, for 2016, participation in Internal Audit Awareness Month was as extensive as ever. From Malawi to Mexico, through conferences and social media posts, discussions long and short expounded on the pride practitioners have in our esteemed profession.

But this outpouring of pride and awareness should not focus only on what internal audit does for organizations today.…