April 2018
I recently spent two days in Paris participating and speaking at the Organisation for Economic Co-operation and Development’s (OECD’s) annual Global Anti-Corruption and Integrity Forum. Surrounded by world leaders, anti-corruption experts, and transparency activists, one couldn’t help but become invigorated by the participants’ passion and drive for battling corruption. I was especially proud of the recognition and respect shown for internal audit’s role in this worthy battle.
There is little argument that dedicating resources to fighting corruption is necessary to sound risk management, but it’s still shocking to consider how much is lost to it annually. The World Economic Forum estimates corruption adds 10 percent to the cost of doing business.…
It is a safe assumption that every profession will change dramatically the deeper we go into the 21st century. Technological innovations, the rapid evolution of artificial intelligence, and geopolitical and macroeconomic pressures virtually guarantee it.
In most cases, the changes will redefine how professions deliver value. In others, change will diminish or eliminate professions altogether. For the internal audit profession, I believe the next 20 years will offer a great opportunity for transformation that will bring us closer to becoming indispensable to effective risk, control, and governance.
I recently blogged that internal audit will have to undergo a radical mindset change to achieve this goal.…
For more than two years, I have been writing about toxic cultures and internal audit’s role in identifying how they can impact organizations’ performance. Examples abound of corporate scandals caused or enabled by toxic or misaligned cultures, including Equifax, Uber, and Wells Fargo. Certainly, the #MeToo movement is being fed by a long and shameful history of noxious corporate attitudes toward women in the workplace.
It’s not hard to spot signs of toxic cultures. You’ll often find that the ends justify the means and there are different standards for different people in such organizations. They generally have poor communications, as well as distracted and unproductive employees, and there tends to be a lot of finger-pointing and blame games when things go wrong.…
The unraveling of the United Kingdom’s second-largest builder created a firestorm of controversy over warning signs that were missed or ignored. Few associated with the downfall of construction behemoth Carillion have escaped criticism, including its directors and auditors, as well as government overseers, from the Financial Reporting Council to The Pensions Regulator.
As Parliament and others seek accountability for Carillion’s demise, their inquiries offer a sobering look into internal audit’s role in the disaster.
Carillion’s internal audit services were fully outsourced to Deloitte, while KPMG was the financial statement auditor. A February hearing before a pair of House of Commons committees put representatives from both firms on the hot seat.…
Last summer, internal auditors for the city of Atlanta warned officials that their IT systems could be easily compromised if they weren’t fixed immediately. The audit report minced no words, calling out the lack of resources (tools and people) available to address the “thousands of vulnerabilities” and characterizing the situation as a “significant level of preventable risk exposure,” according to media reports.
The city apparently began to implement certain security measures, but it was a classic case of too little, too late. A ransomware attack — essentially digital extortion — crippled the city’s computer network and took many departments nearly into the dark ages of pen and paper.…