In one of my early memories as an internal auditor, I recall a senior executive in my organization telling me that it was our job to “catch the bad guys.” Meanwhile, another executive observed that we were there to keep him “out of jail.” While both meant well, the message was clear: internal auditors were there to identify villains. Today, almost 50-years later, 48% of internal auditors still report that they are seen as the “police” in their organizations – ready at a moment’s notice to nab villains who break the rules or steal from the organization. But, we should have clearly outgrown the notion that to be successful, we need to slay villains.

There’s a well-known storytelling axiom: “Every hero needs a villain.” It’s a trope that’s played out in countless movies, books, and television shows. From Batman and the Joker to Harry Potter and Voldemort, the logic is simple—heroes prove their worth by vanquishing villains. But when it comes to internal auditing, we must reject this outdated notion. The simple fact is that we don’t need villains to be heroes. We don’t achieve success because others fail—we succeed when we help others succeed.

Unfortunately, there’s a lingering misperception that internal auditors thrive on failure. To some, our value is measured by how many weaknesses we uncover or how many deficiencies we flag. It’s as though the more faults we find, the more heroic our role. But that’s not how I see it—and I hope that’s not how you see it either.

In truth, the best internal auditors don’t rise by exposing others’ shortcomings; they rise by enabling progress, strengthening controls, identifying opportunities, and building bridges. In a world besieged by risk and disruption, the organizations we serve need heroes—just not the kind with capes and adversaries. They need heroes who work with others, not against them.

The Misunderstood Role of the Internal Auditor

Throughout my career, I’ve heard some version of this complaint countless times: “Here come the auditors—ready to tell us everything we did wrong.” That perception isn’t entirely unfounded. For decades, traditional assurance engagements have focused on identifying breakdowns, non-compliance, and control failures. The very nature of our work is retrospective—we audit what has happened, and often that means uncovering mistakes.

But just because we highlight problems doesn’t mean we should wish for them. And just because we identify failures doesn’t mean we hope for them.

As I have said countless times, great internal auditors are not “gotcha” professionals lurking in the shadows. We don’t revel in others’ missteps. On the contrary, our role is to bring transparency, to promote resilience, and—most importantly—to help our organizations perform better. In that sense, our success is most powerful when it uplifts, not condemns.

Shifting from Policing to Partnering

In organizations where internal audit operates as organizational watchdogs, there’s a risk that we’re seen as enforcers rather than enablers. While independence and objectivity remain sacred, that doesn’t mean we must be adversarial.

We’re most effective when we’re:

• Proactive, not punitive
• Collaborative, not combative
• Forward-looking, not just backward-scanning
• Trusted advisors, not mere compliance monitors

That’s why advisory services are seen as such an important component of our mission. While assurance engagements often ask, “What went wrong?”, advisory engagements focus on “What can be improved?”

Even before I wrote the book, I believed that internal auditors should be agents of change—not because we expose villains, but because we help organizations overcome barriers. In many cases, we offer insight that improves processes, reduces waste, strengthens governance, or identifies emerging risks before they morph into crises.

When we do that, we don’t need a villain to be a hero. We don’t need a scandal to seem smart. We simply need to be present, engaged, and focused on helping our organizations succeed.

Dispelling the “Internal Auditor as Adversary” Myth

To thrive in the modern era, internal audit must shake off the old myths that portray us as adversaries. We must actively rewrite the narrative. Yes, we will always be expected to shine a light on weaknesses—that’s part of our DNA. But we must also be seen as trusted advisors, insightful partners, and catalysts for improvement.

How can we do that? Here are five ways to move from myth to mission:

1. Frame findings constructively.
   Even when we uncover issues, we can present them with a tone that focuses on solutions and future performance—not just point fingers over past failures.
2. Offer recommendations that empower.
   Don’t just highlight problems—propose thoughtful, pragmatic ways to address them that align with organizational goals.
3. Balance assurance with advisory.
   Allocate time and talent toward advisory engagements that enhance risk awareness, process design, and strategic decision-making.
4. Celebrate success stories.
   Share examples of how internal audit contributed to positive outcomes—especially when no crisis occurred. Preventative wins deserve applause, too.
5. Build relationships grounded in trust.
   The more trust you build with stakeholders, the more they will see you as a partner—not a policeman.

The Hero’s Journey: A Different Arc

In literature, the hero’s journey often begins with a call to adventure, proceeds through trials, and culminates in a final confrontation. But internal audit’s hero’s journey is different. Ours begins with a call to serve, proceeds through insight and influence, and culminates in improved performance, enhanced trust, and stronger governance.

We’re not here to slay villains. We’re here to light the way.

If you’re like me, you didn’t choose internal audit because you wanted to play the role of antagonist in someone else’s story. You chose it because you believe in making things better. You believe in guarding value. You believe in progress.

So the next time someone says, “Auditors are just looking for what’s wrong,” remind them: we’re also looking for what’s possible.

We don’t need chaos to prove our worth. We need curiosity, courage, and a commitment to collaboration. Those are the tools of modern audit heroism—and with them, we can elevate both our profession and the organizations we serve.