In the 1980s, I worked for one of the most ineffectual managers of all time. Everyone who served on his audit team struggled to understand why executive management never took action to address his failures. Over time I learned that part of the reason was that some executives assumed the department functioned effectively. Audit reports never included any significant issues, so they thought internal audit must be doing a great job. The experience taught me a valuable and interesting lesson about audit departments.
When executives do not have a clear understanding of the role and impact of an effective internal audit function, those executives often believe that a successful audit team is one that causes no problems. There are no waves, no headaches, no imbroglios, no brouhahas — so internal audit must be doing its job.
But there is something even more insidious within this perception. Without an understanding of what an effective audit function does, stakeholders will not recognize how internal audit’s failure to warn them appropriately might hasten organizational harm.
Internal audit is the canary in the organizational coal mine. Just as miners used canaries to provide early detection of lethal conditions, internal audit provides stakeholders with early warnings of an organization’s potentially lethal actions. But the canary is only effective when the miner knows what to expect. And when stakeholders are not educated — when the negative impacts of an ineffective audit department are unknown — those stakeholders will go blithely forward with a false sense of security.
It seems that, when a failure occurs, more people are asking “Where were the auditors?” That is a good start. But the question should be asked after every single incident. The inquiry alone reveals an increased understanding of our impact and potential.
The profession has made great strides since my experiences in the 1980s. Internal audit is seen by many organizations as an integral part of the governance structure. (As evidence of how far we’ve come, the word governance was seldom bandied about in the 1980s.) And most executives who now deal with internal auditors understand the importance and impact they can have on the success of the organization. But we are not quite there yet.
When internal audit has a strong presence in the organization and provides executives with valuable insights, those executives appreciate the input. But when internal audit drops off the radar, executives become overwhelmed by everything else on their busy agendas, losing sight of internal audit’s important role.
Miners felt the absence. If a canary wasn’t around, they knew they needed to find one. Do executives look around for that security when internal audit doesn’t seem to be present? Or to put it another way, would they know they should miss you if you were gone?