2018

As a profession, internal auditors have cultivated a long and respected legacy as purveyors of hindsight. Almost all of us are adept at looking at last year’s data and telling management where past mistakes were made. While hindsight is a necessary part of internal auditing, 20/20 hindsight is one of our least valuable skills. Often, our clients are already aware of past mistakes.​

With the advent of operational auditing and, ultimately, the introduction of consulting/advice into our portfolio of services, we also became purveyors of insight. Insight is generally seen as more valuable than hindsight to our beleaguered stakeholders, but it too suffers from limitations in an era when risks emerge at warp speed.…

The best internal auditors know that there are times when we need to “break the rules” for conducting client interviews. Few skills are more essential for internal auditors than knowing how to ask the right questions. With effective questioning skills, we can build rapport, strengthen understanding, and encourage openness. Without these skills, we can damage working relationships or overlook essential information.

Even the world’s best analytical skills are useless if we fail to uncover the information we need because of faulty questioning techniques. That’s why most internal auditors receive formal training on how to conduct internal audit interviews. Training is essential because it can provide important rules regarding how to interview people.…

One of the most important things internal auditors can do to meet stakeholder expectations is to ensure internal audit priorities align with those of the board and executive management. Risks that “keep our stakeholders up at night” should be keeping internal auditors busy during the day.

If that sounds like common sense, consider that while the National Association of Corporate Directors (NACD) 2017-18 Public Company Governance survey lists significant industry change, business model disruption, and technology disruption as the mostly likely trends over the next year, the 2018 North American Pulse of Internal Audit found only 45 percent of chief audit executives consider their internal audit functions to be very or extremely agile — that is, able to quickly and efficiently handle whatever disruptions come their way.…

Early in my career, I took for granted that internal auditing existed simply because it was necessary. Very rarely did anyone use terms like customers or stakeholders. I don’t remember ever hearing those terms during my first decade in the business.

I knew that regulations of the U.S. Army, where I worked at the time, required that every activity have an internal audit function, so I assumed we were there simply because we had to be. Resources were plentiful, and no one was really scrutinizing the value that we delivered, which isn’t surprising. People generally don’t begin to question the value of something until it becomes difficult to pay for it.…

The Equifax debacle, which left the personal data of nearly half of the U.S. population exposed, continues to offer lessons for internal audit practitioners, other risk management players, and organizational stakeholders. 

The recent settlement between Equifax and eight states, which brought suit following the credit reporting agency’s massive data breach, signals the end to those legal proceedings. But I believe its details also reflect a bold statement about the importance of internal audit: A strong system of risk management and internal controls must include an independent, well-resourced internal audit function that addresses the full portfolio of an organization’s risks.

Indeed, scandals from Volkswagen to Wells Fargo to Equifax have heightened awareness that all players in risk management must work collectively and equally to succeed.…

Job growth for auditors has been very strong for much of the past decade. That has made internal auditing a great option for those entering the workforce or considering a career change. However, picking a job and flourishing in it is about more than opportunity alone. Is the position a right fit for you, and are you the right fit for the company or organization? I first explored this question in a 2014 blog, and took a much deeper dive into the attributes of those who succeed in internal audit in my 2017 book, Trusted Advisors: Key Attributes of Outstanding Internal Auditors.…

There are times when internal audit clients and others have unrealistic expectations about our profession. It’s not surprising, then, that there may be confusion about our role. After all, internal auditors wear many hats. We are analysts, controls experts, consultants, teachers, business partners, watchdogs, financial advisers, compliance experts, and more. We truly can audit almost anything. While some risks clearly require additional expertise to audit, as I wrote in a 2014 blog post, “you don’t have to be a clown to audit the circus.” However, as I noted then, while we might be able to audit anything, we c​an’t audit everyt​hing. …

The IIA is in the midst of the most extraordinary transformation project in its history. Over the next two years, service to members will be elevated through deployment of new systems for certification candidate management, e-commerce, and association management, and a crucial evolution in our website, driven by member needs. When fully deployed, the digital transformation project will make the organization more efficient and more accountable to its members. 

Throughout much of The IIA’s storied history, its motto has been “Progress Through Sharing.” The IIA’s role as the profession’s champion includes sharing with its members the tools and resources they need to deliver on stakeholder expectations of protecting and enhancing value in their organizations.…

I have written several blog posts on high-profile risk, control, and governance failures over the past few years, from Volkswagen to Toshiba to Wells Fargo. Some posts looked at lessons learned while others explored internal audit’s role or absence in those corporate stumbles.

Public scandal makes easy fodder for critics, and pundits have made an industry of commenting on failure. But I’d like to focus on the thoughts of one of the most quoted and inspirational leaders of the 20^th century, Winston Churchill. The U.K. prime minister, celebrated as bold, brave, resolute, and tireless in his leadership during World War II, also had his share of political and military failures.…

One of the enduring challenges for internal auditors is how to sustain trusting relationships if they are frequently called upon to assist in investigations of executive and employee misconduct. As I observed in a 2014 blog post, the reality is that many internal auditors are asked to assume responsibilitie​​s related to corporate investigations.​

More than 80 percent of respondents to The IIA’s 2015 Common Body of Knowledge survey indicated that their internal audit function had some degree of responsibility for detecting fraud within their organizations. That number changed little in the past three years. Current data from IIA members s​​​how 73 percent of CAEs report having fraud auditing as part of their responsibilities.…