There has been a welcome movement among leading internal audit functions to provide opinions, not only in individual audits of the adequacy of controls over enterprise risks, but of the overall adequacy of internal control over the more significant risks to the organization.
I have seen surveys indicating that worldwide approaching half of internal audit functions now provide an overall assessment.
This has been driven, at least in part, by requirements in governance codes that internal audit assess the adequacy of internal control and risk management.
But is this sufficient?
This is from The IIA:
The Mission of Internal Audit articulates what internal audit aspires to accomplish within an organization….
"To enhance and protect organizational value by providing stakeholders with risk-based, objective and reliable assurance, advice, and insight."
Certainly, the opinion that internal auditors provide in their audit reports and in their annual report on the condition of internal control, provides assurance. The recommendations we include in our reports provide advice. But what about that third valuable service: insight?
Insight talks to the fact that internal auditors have more to say: more than can be contained in the audit opinion, often more than what should or could be put in a formal form of writing. Internal auditors are objective and their professional insights can have great value to management.
For example, how often do we have opinions on one or more of these?
- The capabilities of the managers of an operation.
- Whether there are sufficient staff to perform the controls, manage risk, and generally operate the business.
- Whether there is a culture of teamwork and shared objectives.
- The existence of harmful politics.
- The management style of managers and supervisors.
- The culture of a unit, location, or division when it comes to ethics, risk, or other behavior.
- Whether people in the unit are customer-focused.
- Whether those operating the business have confidence in local or corporate management.
- Opportunities to embrace new technologies or other innovations.
There are some that will say they are unwilling to share their judgments because:
- It wasn't part of the scope of the audit.
- It is not our job.
- We don't have evidence to support our judgment.
I reject all of these excuses.
Our job is to help the organization succeed, not just to perform audits. There are times where our insights are more valuable than the opinion expressed in an audit.
For example, if we can inform management that politics or management style are a significant negative influence on a team, that may have a direct effect on the ability of that group, team, or unit to perform at desired levels — requiring prompt action by senior management.
Internal auditors are professionals. As such, they are entitled to a professional opinion — in the same way as doctors.
Don't be afraid of sitting down with management and sharing your insights, your professional opinion. In my experience, that is not only welcome and valued, but will significantly enhance respect from management.
What do you think?
Please share your insights and experiences.
Join the conversation by clicking Subscribe, below