This last week, I was in a discussion about aligning board (audit committee) expectations and internal audit activities. Frankly, I have seen a lot of guidance that says that the internal audit leadership should seek to understand board and top management expectations, and act accordingly.
I don't think this is right.
In fact, I think it is deathly wrong.
Too many boards and top management members do not understand what internal audit is capable of delivering. They are used to internal audit functions that focus on financial controls, fraud, compliance, and some operational and value-add projects. They do not appreciate the value we can bring by providing assurance over risk management and governance processes, or performing other value-add services (such as in the case of M&A activity).
If we simply meet these limited expectations, we are not delivering to the level of which we are capable.
Instead, we should seek to explain and persuade the board and top management that we are able to provide far more. We should educate them and raise their expectations. Then, if course, we need to deliver.
1. Do you agree?
2. Can you share how you have achieved this?