Ten years ago this week, I published my first book: Lessons Learned on the Audit Trail. I had been writing a blog for more than five years, sharing imperatives that I believed internal auditors needed to address. Sometimes, they were strategic. Sometimes, they were tactical. Many of the blog posts before and since are drawn from my experiences as an internal auditor and chief audit executive. In 2014, I took a big step and assimilated the lessons I had learned throughout my career into the book.

Merriam-Webster defines audit trail as “a record of a sequence of events from which a history may be reconstructed.” As I prepared to write the book, I reflected upon my own career, contemplating the sequence of events that culminated in my appointment as President and CEO of The IIA. More important than the events themselves, however, were the lessons I had learned along my personal audit trail.

The book was well received by the profession and was ultimately translated into five languages. It was the first of three books I authored (the other two being Trusted Advisors: Key Attributes of Outstanding Internal Auditors in 2017 and Agents of Change: Internal Auditors in an Era of Disruption in 2021). I would eventually update my first book and republish it as The Speed of Risk: Lessons Learned on the Audit Trail 2^nd Edition in 2019. 

While I drew on my personal and professional experiences for the book, it was the “lessons learned” listed throughout that proved to be most popular with readers. Those lessons ranged from what a young internal auditor should know about managing career expectations to what a CAE must understand about attaining and retaining the elusive seat at the table.

As I contemplate my nearly 50-year journey on the audit trail and mark the 10^th anniversary of the book, I’m reminded that the lessons I shared in the book remain highly relevant. That’s why I’d like to single out 10 for those who strive to succeed in the profession. These lessons, and relevant passages from the book, include:

1. Outstanding internal auditors share common traits. Be willing to commit yourself to absolute excellence. Don’t settle for simply being good; pursue greatness in everything you do.
2. Relationship acumen is essential to success. If you truly expect to contribute meaningfully in an organization, you have to cultivate relationships based on genuineness of character so that others are confident that you are truly trying to help them – not just yourself.
3. Without stakeholders, we have no mission. Your key stakeholders have the last word on whether you are doing your job well. And they judge an internal audit function not by how well-run it is, but by the value it generates for them.
4. When in doubt, follow the risk, but remember that it is a moving target. Establish risk-based criteria for prioritizing your audit coverage. Without that, you won’t know where to start.
5. Communication is vital and must be continuous. Effective internal auditors must do more than develop important information and insights. They must communicate the information and insights effectively and continuously.
6. Timeliness must be a critical part of our value proposition. Our stakeholders live in a Google era, with an answer to almost any question available with only a few keystrokes. They no longer consider two months, or even two weeks, timely. This has created an expectation gap that is not often discussed in internal auditing.
7. Innovation drives greatness. As internal auditors, we cannot be so paralyzed by a fear of failure that we are unwilling to innovate.
8. Small stones can cause the biggest waves. Occasionally, the facts we communicate in our reports draw attention or spark the imagination in ways we do not anticipate.  . . . I call this phenomenon the “small stone effect,” when something with the financial significance of a rounding error starts out as a ripple . . .  but grows into a tsunami of overreaction or negative publicity as it spreads outward.
9. No one is immune to ethical lapses. Recognize the risk that unethical behavior poses to the internal audit profession, and work hard to prevent the kinds of activities that discredit us individually and the profession at large.
10. Internal audit needs a seat at the table. The process of earning a seat at the table begins long before you can pull up your chair. It starts with you building a trusting relationship with the organization’s board and management.

I recognize some of these lessons might sound like themes I continue to explore in blog posts. That is because many are enduring, and they continue to inspire us long after we recognize their relevance.

I welcome your thoughts via LinkedIn or X, and encourage you to share with me lessons you have learned on the audit trail.