2018

In a few days, I will celebrate a personal milestone. It was August 1975 when I graduated from college and took my first job as an internal auditor at Trust Company of Georgia, a major regional bank in Atlanta. It is hard to believe it has been 40 years. In some ways, it seems like only yesterday. Looking back over four decades of service in and for our profession, I think about the key moments that defined my career. I also realize that there are a handful of moments in every internal audit career that will define the experience for the professional who lives them.…

I’m always gratified when one of my blog posts solicits a strong response, whether the reaction agrees with my views or contradicts them. Chambers on the Profession is intended to be a sounding board for professional internal auditors, and their varied views are always welcome.

Last week’s post, C-Suite Owes More Than Simple Awareness of Internal Audit Reports, is one of those that drew numerous comments, many of which questioned the blog post’s premise.

The post made the case that management must do more than simply acknowledge internal audit reports. Management should act on those reports, especially when there is a clear and present risk to the organization.…

An unfortunate truth about our profession is that risk and control failures can and do happen despite internal audit’s often heroic efforts. This reality is highlighted by several recent public- and private-sector incidents.

Last month, I wrote about Atlanta’s cyber breach and how the city’s internal auditors had warned officials that their IT systems could be easily compromised. Those officials’ failure to act promptly to correct the deficiencies left the city susceptible to a ransomware attack that crippled its computer network.

Meanwhile, the California state auditor reported that the University of California (UC) president’s office had amassed $175 million for preferred projects but did not disclose it in its public budgets.…

Once again, we are celebrating International Internal Audit Awareness Month. Awareness is defined as “knowledge or perception of a situation or fact.” From my experience in traveling around the world, awareness about internal audit is not binary; it falls along a continuum. Some non-internal auditors are very familiar with internal audit and how it adds value, while others are clueless. The most common response I receive from the latter is: “Oh, you guys do taxes — right?”

The vast majority of people have a vague notion of what we do. In other words, they possess limited awareness about internal audit. A few years ago, I authored a blog titled “Five Classic Myths About Internal Auditing.”…

I recently spent two days in Paris participating and speaking at the Organisation for Economic Co-operation and Development’s (OECD’s) annual Global Anti-Corruption and Integrity Forum. Surrounded by world leaders, anti-corruption experts, and transparency activists, one couldn’t help but become invigorated by the participants’ passion and drive for battling corruption. I was especially proud of the recognition and respect shown for internal audit’s role in this worthy battle.

There is little argument that dedicating resources to fighting corruption is necessary to sound risk management, but it’s still shocking to consider how much is lost to it annually. The World Economic Forum estimates corruption adds 10 percent to the cost of doing business.…

It is a safe assumption that every profession will change dramatically the deeper we go into the 21^st century. Technological innovations, the rapid evolution of artificial intelligence, and geopolitical and macroeconomic pressures virtually guarantee it.

In most cases, the changes will redefine how professions deliver value. In others, change will diminish or eliminate professions altogether. For the internal audit profession, I believe the next 20 years will offer a great opportunity for transformation that will bring us closer to becoming indispensable to effective risk, control, and governance.

I recently blogged that internal audit will have to undergo a radical mindset change to achieve this goal.…

For more than two years, I have been writing about toxic cultures and internal audit’s role in identifying how they can impact organizations’ performance. Examples abound of corporate scandals caused or enabled by toxic or misaligned cultures, including Equifax, Uber, and Wells Fargo. Certainly, the #MeToo movement is being fed by a long and shameful history of noxious corporate attitudes toward women in the workplace.

It’s not hard to spot signs of toxic cultures. You’ll often find that the ends justify the means and there are different standards for different people in such organizations. They generally have poor communications, as well as distracted and unproductive employees, and there tends to be a lot of finger-pointing and blame games when things go wrong.…

The unraveling of the United Kingdom’s second-largest builder created a firestorm of controversy over warning signs that were missed or ignored. Few associated with the downfall of construction behemoth Carillion have escaped criticism, including its directors and auditors, as well as government overseers, from the Financial Reporting Council to The Pensions Regulator.

As Parliament and others seek accountability for Carillion’s demise, their inquiries offer a sobering look into internal audit’s role in the disaster.

Carillion’s internal audit services were fully outsourced to Deloitte, while KPMG was the financial statement auditor. A February hearing before a pair of House of Commons committees put representatives from both firms on the hot seat.…

Last summer, internal auditors for the city of Atlanta warned officials that their IT systems could be easily compromised if they weren’t fixed immediately. The audit report minced no words, calling out the lack of resources (tools and people) available to address the “thousands of vulnerabilities” and characterizing the situation as a “significant level of preventable risk exposure,” according to media reports.

The city apparently began to implement certain security measures, but it was a classic case of too little, too late. A ransomware attack — essentially digital extortion — crippled the city’s computer network and took many departments nearly into the dark ages of pen and paper.…

This year, I am admonishing internal auditors to focus on the future, as the profession responds to rapidly changing stakeholder expectations. Disruptive technology and an increasingly dynamic risk landscape are driving the profession toward transformation, and we must take bold steps to ensure we successfully pivot to new demands.

Recruiting and retaining staff is one of the toughest challenges we face in achieving this transformation.

The IIA’s 2018 North American Pulse of Internal Audit​ and the 2018 Global Risk Report each cite survey data that reflect the growing struggle for talent. Seventy-two percent of chief audit executives (CAEs) report they have talent gaps to fill to carry out their audit plans, according to the Pulse.…