2019

August 10, 2019

How Do You Know When It’s Time to Go?

A recent CNBC report by business journalist and former Harvard Business Review editor Suzy Welch offered 4 signs it’s definitely time to quit your job. This brought to mind one of my blog posts in 2015 that addressed the same question for internal audit practitioners. The observations I made then still hold true today.  

One of the most rewarding aspects of my job as president and CEO of The IIA is the opportunity to meet young professionals just starting their careers in internal audit. These interactions remind me of the reasons I joined the profession, and they never fail to reinvigorate my own passion for what we do.…

August 5, 2019

​Are Companies Capitulating on Cybersecurity Risks?

The latest cyber breach is raising awareness about vulnerabilities involving cloud services, insider threats, and third-party risks, reflecting how complex and intertwined cybersecurity risks can be. It behooves all organizations to have a deep understanding of cyber risks across the enterprise, including understanding their cyber cultures.

In this blog post from 2018, I revisit the importance of internal audit’s relationship with IT leaders and the value in understanding cyber culture.

In the past dozen years or so, cybersecurity has gone from being a mysterious IT concern best left to chief security officers (CSOs) and chief information security officers (CISOs) to a top priority for boards and executive management.…

July 29, 2019

​Internal Audit Must Monitor Ethics in the Corner Office, Too

In a recent review of PwC’s annual Strategy & CEO Success Study, I was stunned by one revealing statistic. In 2018, more CEOs lost their jobs because of ethical lapses than for poor financial performance or battles with their boards. This has never happened before in the study’s 19-year history.

Frankly, I found the results of the PwC study to be very troubling. After all, I have echoed The IIA’s view for years that internal audit should report administratively to CEOs. If these same CEOs are now being fired for ethical misconduct in record numbers, what does that mean for internal audit’s prospects to carry out its important work free of interference?…

July 22, 2019

​When Culture Is the Culprit: Lessons From Toshiba, Hertz, and FIFA

Over the past four years, I have written and spoken extensively about corporate culture, its influence on good governance, and internal audit’s role in monitoring and understanding it. My experiences over four decades as an internal auditor taught me that corporate culture plays a significant role in an organization’s success or failure. In my latest book, The Speed of Risk: Lessons Learned on the Audit Trail, 2ndEdition, I lament that the lesson has been a long time coming for the profession.

When I launched my internal audit career, the idea of auditing the “softer” side of an organization’s culture was anathema to the profession.

July 15, 2019

​Internal Audit May Work for the Wrong Individuals — But Not the Wrong “People”

My role as the head of a global organization offers me the opportunity to interact with people who enjoy a certain amount of celebrity and fame. Serving as president and CEO of The IIA has afforded me the opportunity to meet the heads of states, members of the U.S. Congress, the secretary-general of the United Nations, and assorted diplomats, scholars, and actors.

While their knowledge of and excellence in their respective fields helped elevate them to the status of celebrity, their knowledge and appreciation for internal auditing is generally limited. One notable and refreshing exception is American Academy Award-winning actor Richard Dreyfuss, the keynote speaker at the recently completed 2019 IIA International Conference.…

July 9, 2019

​California’s Earthquakes and Europe’s Heat Wave: The Latest Gray Swans

Last week, I arrived in California early to prepare for The IIA’s 2019 International Conference. While relaxing a bit outside my hotel on July 4, I was jolted by a magnitude 6.4 earthquake centered more than 100 miles away. After the shaking stopped, I asked myself, “Why didn’t I think about an earthquake when I was considering all of the risks related to our upcoming conference?”

The next evening, an even stronger, magnitude 7.1 earthquake struck the region while I was dining with my family near our conference site. As all of us in the restaurant regained our composure following the quake, one of the restaurant employees confessed that the business used to undertake earthquake drills, but hadn’t done so in years.…

July 1, 2019

Exposing Internal Audit’s Work: Too Much of a Good Thing?

The CPA Journal recently published a provocative article, “The Benefits of Internal Audit Disclosures,” which examined research into what investors know about internal audit functions, how they might view disclosure of internal audit work, and how such disclosures might improve corporate governance transparency.

The initial research by Deborah S. Archambeault, F. Todd DeZoort, and Travis P. Holt presents a positive picture of the value of such disclosures. Indeed, according to the article, the researchers identified three benefits of public exposure of internal audit’s workings based on a review of internal audit research and a series of interviews with financial analysts, audit committee members, internal auditors, and policymakers.…

June 27, 2019

7 Characteristics of the Virtuous Internal Auditor

As part of unofficial “Internal Audit Self-awareness Month,” I am featuring blog posts from the past that focus on looking inward. This theme is just as vital as any effort to build awareness about our profession. We must take a realistic and hard look at what we do, how we do it, and how we are viewed by those outside of the internal audit function. In this final blog post of the series, I end on a positive note by exploring the virtues that can lead to professional success for any internal auditor.

In my previous blog post, I offered 7 Deadly Internal Audit Sins that have the potential to ruin an otherwise bright internal audit career.…

June 24, 2019

​7 Deadly Internal Audit Sins

As part of unofficial “Internal Audit Self-awareness Month,” I am featuring blog posts from the past that focus on looking inward. This theme is just as vital as any effort to build awareness about our profession. We must take a realistic and hard look at what we do, how we do it, and how we are viewed by those outside of the internal audit function. This week, I’m featuring a previous post on what internal auditors must never do.

The vast majority of my blog posts focus on the strategies and practices that internal auditors can deploy to generate value and succeed as professionals.…

June 17, 2019

Writing an Impactful Audit Report: 6 Tips for Being More Persuasive

As part of unofficial “Internal Audit Self-awareness Month,” I am featuring blog posts from the past that focus on looking inward. This theme is just as vital as any effort to build awareness about our profession. We must take a realistic and hard look at what we do, how we do it, and how we are viewed by those outside of the internal audit function. This week, I’m featuring a previous post on the art of persuasion.

If you ask internal auditors why they write internal audit reports, some might answer that it’s to communicate an engagement’s objectives, scope, and results.…