Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​Redefining Internal Auditing

The time has come to revisit how the profession defines itself.

Comments Views

​While it has served the profession well for the last two decades, the definition of internal auditing needs an update. The current definition states: “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”

In many ways this description fails to provide management and stakeholders with an accurate picture of the profession, lacking clarity in several important areas.

First, internal auditing is a service, not an activity — the word activity diminishes its purpose and focus. Playing baseball is an activity. Cutting the grass is an activity. Service is what we do for the good of others. It is a higher calling than an activity and connotes greater importance.

When internal auditors perform their services, they inherently add value and bring about improvements — otherwise they shouldn’t be in the organization. Saying the profession is “designed to add value and improve an organization’s operations” implies the possibility of not achieving these aims. Internal auditors add value whenever they do their job correctly, even if the organization does not accept their recommendations.

Moreover, auditors shouldn’t need to specify a detachment from the organization for all types of engagements. Independence and objectivity are necessary for audit services, but not for consulting services. Consulting clients determine the scope of consulting services. Hence, objectivity and independence for these types of engagements do not present a problem — instead, competence is the key.

Lastly, the definition makes no reference to the importance of internal audit as an internal function. Organizational change can significantly affect the systems and controls that auditors help management assess. Change and its effects should be reviewed proactively, before implementation. If the organization does not maintain an audit presence internally, the chances for proactive review decline significantly and the associated risks increase significantly. Internal audit’s relationships with clients, fostered by in-person interactions, are essential to ensuring practitioners are called upon when the organization contemplates change.

With these considerations in mind, I propose a revised and expanded definition: “Internal auditing is a service that performs both auditing and consulting work to add value and improve the organization’s operations. It accomplishes these objectives using a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Internal audit works closely with the individuals it services to build long-term relationships so together, change is reviewed proactively for the good of the organization.” I hope this revision will mark the beginning of a dialogue on how our profession should be defined.

Stephen Zwelling
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Stephen N. ZwellingStephen N. Zwelling<p>Stephen N. Zwelling, CIA, CPA, CISA, is owner of KISS in Lewis Center, Ohio.​</p>


Comment on this article

comments powered by Disqus
  • GEICO_September 2019_Premium 1__
  • Chartered Prof Acct Canada_Sept2019_Preimum 2
  • IIA CERT CIA_September 2019_Premium 3