May 2018

In a few days, I will celebrate a personal milestone. It was August 1975 when I graduated from college and took my first job as an internal auditor at Trust Company of Georgia, a major regional bank in Atlanta. It is hard to believe it has been 40 years. In some ways, it seems like only yesterday. Looking back over four decades of service in and for our profession, I think about the key moments that defined my career. I also realize that there are a handful of moments in every internal audit career that will define the experience for the professional who lives them.…

I’m always gratified when one of my blog posts solicits a strong response, whether the reaction agrees with my views or contradicts them. Chambers on the Profession is intended to be a sounding board for professional internal auditors, and their varied views are always welcome.

Last week’s post, C-Suite Owes More Than Simple Awareness of Internal Audit Reports, is one of those that drew numerous comments, many of which questioned the blog post’s premise.

The post made the case that management must do more than simply acknowledge internal audit reports. Management should act on those reports, especially when there is a clear and present risk to the organization.…

An unfortunate truth about our profession is that risk and control failures can and do happen despite internal audit’s often heroic efforts. This reality is highlighted by several recent public- and private-sector incidents.

Last month, I wrote about Atlanta’s cyber breach and how the city’s internal auditors had warned officials that their IT systems could be easily compromised. Those officials’ failure to act promptly to correct the deficiencies left the city susceptible to a ransomware attack that crippled its computer network.

Meanwhile, the California state auditor reported that the University of California (UC) president’s office had amassed $175 million for preferred projects but did not disclose it in its public budgets.…

Once again, we are celebrating International Internal Audit Awareness Month. Awareness is defined as “knowledge or perception of a situation or fact.” From my experience in traveling around the world, awareness about internal audit is not binary; it falls along a continuum. Some non-internal auditors are very familiar with internal audit and how it adds value, while others are clueless. The most common response I receive from the latter is: “Oh, you guys do taxes — right?”

The vast majority of people have a vague notion of what we do. In other words, they possess limited awareness about internal audit. A few years ago, I authored a blog titled “Five Classic Myths About Internal Auditing.”…