In my role as president and CEO of The IIA, I meet and converse with internal auditors around the world. It’s gratifying to hear about their successes, and important to learn about their challenges. In this week’s blog post, I want to share with you some of the things I’ve heard when internal audits go bad. My hope is that, by talking about our mistakes, we can correct our course and prevent future problems.
In general, most issues that arise when the wheels come off during internal audits stem from a single root cause: inadequate engagement planning. It can be tempting to cut engagement planning short, especially when we’re still trying to wrap up the last audit. But when we resort to shortcuts, the results can be disastrous. In the words of Benjamin Franklin, “By failing to prepare, you are preparing to fail.”
Here are just a few examples of how things can go south when internal auditors fail to adequately plan:
Each of these situations reflected poorly on internal audit, frustrated the internal auditors and the clients, and illustrated the type of inefficiency and ineffectiveness that internal auditors are supposed to prevent, not foster. But, in some cases, we may not be aware of the extent to which poor audit planning damages our reputation and our ability to add value.
One of the senior staff members in The IIA’s Quality Services department recalled an internal audit function that did not include a planning phase in its audit engagements. The internal auditors had used the same work programs for years, basically repeating the same audits over and over with little client interaction. The internal auditors were good at staying on schedule, but because their audit reports always read the same, they did not address specific client concerns. So, most of the findings involved relatively minor errors or oversights. The outcome? The clients had a very low opinion of the internal audit function and stated that they did not believe it added value.
Audit planning is an investment, but it is an investment that can pay big dividends in terms of improved credibility and relationships with our stakeholders. It is also our best opportunity for improving audit effectiveness. That’s why world-class internal audit functions plan, plan – and then plan some more.
These are just a few of the things that can go wrong when internal audits are not properly planned. I’m sure you have other examples. Keeping in mind that The IIA’s motto is “Progress Through Sharing,” I’d welcome your comments.