Internal audit's professionalization is largely the result of codified activities. Established, credible paraphernalia of professional practice, including comprehensive standards, practical guidance, rigorous certification requirements, and a code of ethics, form the foundation of internal auditing. Steadily increasing public recognition and respect for internal auditing surely exists in part due to this robust structure. Nonetheless, as the profession continues to mature, we have reason to be cautious. Once a critical mass of standards and advisory material has been reached — and it may perhaps already have been reached — we should pause to avoid being stifled by instructions, bureaucracy, and over-codification.
To a large extent, unspoken assumptions bind internal audit professionals together in their common endeavors. Arguably, a large part of a profession's wisdom arises from experience and knowledge that are too deep to be articulated. Codified guidance cannot capture the full range of professional activity that involves wisdom and sensitivity.
Explicit instructions and bureaucratic literalism can create the illusion that what really matters in professional activity can be captured entirely in written form. Moreover, it implies that professional practice must be based solely on this established guidance. The distinguishing features of many professions — a physician's bedside manner, an architect's aesthetic sensitivity, and the acerbic rhetoric of a courtroom lawyer — cannot be codified in rational blueprints.
We may distinguish for our purposes among three types of knowledge: knowledge that, knowledge how, and knowledge what. The auditor may know that a procurement process aims at an optimal decision on expenditure, and he or she may know how the details of the process unfurl. The auditor's professionalism becomes truly apparent, however, with the third level of knowledge: he or she knows (through observation, logic, and judgment) what to conclude on the status of the risks and risk-mitigating internal controls observed. Attainment of this third type of knowledge is easier to recognize than to define, and it is founded on education, practical experience, and wisdom.
Sometimes the internal audit profession, like a silkworm, appears to be spinning around itself a cocoon of instructions and codified practices. If the focus of internal auditing shifts further from knowledge and experience to compliance with instructions, the outcome might be a subordination of the search for truth to the satisfaction of methodological demands. Furthermore, there is something eerie in the notion that the accumulated knowledge of internal auditors can be adequately preserved in a code of established practice. Creativity may be dismissed as infidelity to codified instructions. Professional guidance needs to set out the essentials while providing space for our practical judgment to flourish. Otherwise, we may be perceived as a profession characterized by box-ticking compliance, rather than by wisdom.