While it has served the profession well for the last two decades, the definition of internal auditing needs an update. The current definition states: “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”
In many ways this description fails to provide management and stakeholders with an accurate picture of the profession, lacking clarity in several important areas.
First, internal auditing is a service, not an activity — the word activity diminishes its purpose and focus. Playing baseball is an activity. Cutting the grass is an activity. Service is what we do for the good of others. It is a higher calling than an activity and connotes greater importance.
When internal auditors perform their services, they inherently add value and bring about improvements — otherwise they shouldn’t be in the organization. Saying the profession is “designed to add value and improve an organization’s operations” implies the possibility of not achieving these aims. Internal auditors add value whenever they do their job correctly, even if the organization does not accept their recommendations.
Moreover, auditors shouldn’t need to specify a detachment from the organization for all types of engagements. Independence and objectivity are necessary for audit services, but not for consulting services. Consulting clients determine the scope of consulting services. Hence, objectivity and independence for these types of engagements do not present a problem — instead, competence is the key.
Lastly, the definition makes no reference to the importance of internal audit as an internal function. Organizational change can significantly affect the systems and controls that auditors help management assess. Change and its effects should be reviewed proactively, before implementation. If the organization does not maintain an audit presence internally, the chances for proactive review decline significantly and the associated risks increase significantly. Internal audit’s relationships with clients, fostered by in-person interactions, are essential to ensuring practitioners are called upon when the organization contemplates change.
With these considerations in mind, I propose a revised and expanded definition: “Internal auditing is a service that performs both auditing and consulting work to add value and improve the organization’s operations. It accomplishes these objectives using a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Internal audit works closely with the individuals it services to build long-term relationships so together, change is reviewed proactively for the good of the organization.” I hope this revision will mark the beginning of a dialogue on how our profession should be defined.