2022

April 11, 2022

Drive-by Auditing: 5 Signs of a “Hit-and-Run”

This year marks the 20th anniversary of The IIA’s adoption of risk-based audit standards. I chaired The IIA’s Internal Audit Standards Board at the time, and we all recognized what an important milestone the new standards would reflect. Not only were internal audit’s (annual) audit plans to be developed on the basis of enterprise risks (IIA Standard 2010), but individual internal audit engagement plans were to be formulated on the basis of risks in the area, program, or function where the audit was to be undertaken (IIA Standard 2200). Prior to 2002, many internal audit departments undertook cyclical audit plans (e.g.,…

April 6, 2022

New Surveys Raise Alarm Bells for Internal Audit

I have been avidly monitoring the health of the internal audit profession for the past two decades. During my initial tenure at the IIA, later at PwC, and throughout my 12 years as IIA President and CEO, I was either initiating research/surveys or reviewing those of others to gauge the profession’s progress (or lack thereof).

Several reports in recent months paint a picture of a profession that is agile enough to pivot in the face of risk-induced disruption from the pandemic, and one that can be resilient in terms of its resources. However, upon closer look, many of these reports also reveal storm clouds building on the horizon.

March 28, 2022

​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​“Where Was Internal Audit?” It’s Easier Asked Than Answered

I have recently been speaking again with members of the press seeking my perspectives on internal audit, risk management and governance in the post-COVID era. While I am not the spokesman for the profession any longer, I am always happy to share my views. It is not uncommon for the interviewer to note that internal audit has taken some criticism for missing red flags or even fraudulent activity in a fresh corporate scandal. I have responded to those questions so many times over the years that they rarely come as a surprise.

Over the past decade, there has been no shortage of corporate scandals born from ineffective corporate governance, poor risk management, and toxic cultures.…

March 20, 2022

Internal Auditors Must Detect Changing Weather Patterns Before the Storms

In speaking to an audience recently, I observed that the past year has been the most tumultuous I can ever remember when it comes to risk velocity and volatility. In the past 12 months alone, we have witnessed an awesome stream of risk-induced disruptive events including:

  • Brazen cyber-attacks on infrastructure targets
  • COVID-induced supply chain disruptions
  • The COVID Delta Variant
  • The “great resignation”
  • A surge in inflation to the highest levels in 40 years
  • The COVID Omicron variant
  • War in Europe for the first time in 70-years
  • Record fuel prices

There was a time when one of these events in a year would have been noteworthy.…

March 14, 2022

New IIA Pulse Report Shines a Bright Light on the State of Internal Audit!

For the 14th year in a row, The IIA is using its extraordinary reach to survey the internal audit profession in North America, and once again, the results shine a bright light on key trends, emerging risks and important opportunities for the profession. The 2022 North American Pulse of Internal Audit report has just been released, and it doesn’t disappoint!

This year, The IIA surveyed more than 500 senior internal audit leaders – more than 85% of whom are CAEs. Respondents were primarily from organizations headquartered in the United States (83%) and Canada (10%). As in past years, audit leaders were surveyed on key resource trends and internal audit’s plans and priorities.…

March 7, 2022

5 Signs Your Last Internal Audit Made a Big Impact!

It is no secret that I consider internal auditing one of the most rewarding jobs on the planet. I make no apology for being a champion of this profession. But let’s face it, no matter how good you are at your job, it’s likely that people don’t drop by your office or schedule a Zoom call just to tell you how much they love your ​last audit. As I have been exploring in recent blog posts, audit reports are too often met with frustration or even indifference by those on the receiving end. As a young auditor, it used to bother me that my audits were not embraced the way I thought they should be.…

March 2, 2022

New IIA-UK Report Takes a Fresh Look at Auditing Culture

The Chartered Institute of Internal Auditors in the United Kingdom and Ireland (IIA-UK) is a pioneer in advocating internal audit’s role in auditing corporate culture. So, it’s no surprise that the body has stepped up again to provide a fresh perspective on the topic in a new report: “Cultivating a healthy culture: Why internal audit and boards must take corporate culture more seriously in a post-Covid world.” The research was undertaken with the support of AuditBoard and the London Business School’s Leadership Institute. I was honored to add my voice, along with IIA-UK CEO John Wood, to the foreword of this important work.…

February 27, 2022

War in Europe: Why Geopolitical Risks Should Always Be on Internal Audit’s Radar

Following weeks of ominous intelligence reports, the world once again finds itself grappling with a destabilizing geopolitical event – this time on the European continent itself. When Russian forces rolled into Ukraine on Feb. 24, it was not totally unexpected. Yet, when 2022 risk assessments were being compiled in recent months, this was a risk few saw coming. The World Economic Forum’s 2022 Global Risk Report, published a little over six weeks ago, acknowledged increased tensions but did not include armed conflict between nation states or geoeconomic confrontation among its top 10 global risks in the next two years. And geoeconomic confrontation barely made the top 10 list for the decade ahead.…

February 20, 2022

Internal Auditors Must Draw a Line Between Skepticism and Suspicion

I have always enjoyed working with new internal auditors, in part because they so often see the world in black and white. “Should we do an audit?” “Should we issue a finding?” “Am I maintaining a healthy degree of professional skepticism?” For many new internal auditors, each of those questions points unerringly to a single yes-or-no answer. 

With experience, internal auditors’ horizons expand, and they start to see repercussions of our actions. The issue is not merely whether we should perform an audit, but whether there is enough risk to warrant one, how extensive an audit is justified, and how soon it is needed.…

February 16, 2022

When Friction Erupts: 5 Ways Internal Auditors Can Mend Broken Fences

My recent blog, “Five Things Not to Say When You Are Starting an Internal Audit,” was far and away the most popular I have written in years. The overwhelming response provided reassurance that most internal auditors strive for constructive relationships with their clients. They realize that internal audit’s value depends heavily on how our audit results are received by the intended audience. If there is friction between internal audit and the client, our ability to persuade is negatively impacted.

As my blog pointed out, the opening meeting can generate unintended tension. But I suspect many of you will agree that a much more likely source of friction is the final audit results.…