September 2020
From the early days of my career, I was told that internal auditors should not simply accept what we are told, that we should always take the extra steps to double-check the information. En route to the answers, it was important to build reliable sources by creating open, productive working relationships. In this way, we could establish trust. But we also should ensure that trust was earned.
Trust but verify.
The Anti-Fraud Collaboration, of which The IIA is one of four sponsoring organizations, is releasing new thought leadership that cuts to the core of the notion “trust but verify.” In examining methods for detecting and deterring financial statement fraud — or, for that matter, any type of fraud — the paper focuses on the importance of practicing skepticism, or refusing to accept information and practices we observe with blind faith.…
“We are here to help you!” That phrase seems so innocent, but those six little words are sometimes referred to as “the biggest lie of the internal audit profession.” As the old joke continues, the second biggest lie is management’s response: “We are glad you are here!”
I have written several blogs this year about how internal audit should be helping their organizations navigate the COVID-19 pandemic. Surveys continue to indicate that internal audit’s support is being genuinely welcomed in a great many organizations. As management fends off the threats from the COVID-induced health and economic crises, they often welcome help from any trusted source available.…
Readers of my blog know that, in recent years, I have constantly emphasized the importance of internal auditors anticipating future risks for our organizations. As I observed in a 2018 blog post:
As a profession, internal auditors have cultivated a long and respected legacy as purveyors of hindsight. Almost all of us are adept at looking at last year’s data and telling management where past mistakes were made. While hindsight is a necessary part of internal auditing, 20/20 hindsight is one of our least valuable skills. Often, our clients are already aware of past mistakes.
With the advent of operational auditing and, ultimately, the introduction of consulting/advice into our portfolio of services, we also became purveyors of insight.…
As a young internal auditor, I took very seriously the painstaking art of documenting the results of my internal audit work in workpapers. I believed that well-organized, comprehensive workpapers were critical to demonstrating the quality of my efforts, and were the basis for the audit report I would write at the conclusion of the audit.
I understood that the workpapers needed to include documentation of evidence I examined, and that the evidence needed to be relevant, reliable, sufficient, and useful. I adapted to the culture of the profession of the time. And I came to believe that internal audit workpapers were good, and more workpapers were better.…