​Pillars of Resilience

Internal Auditor’s latest winning scholarship essay discusses two key ways internal audit can help make the organization more resilient to crisis.

Comments Views
Laura Weiler

​Organizational resilience is essential in today’s world where brands are defined by their actions during a crisis. There are no shortages of crisis and brand shaming in today’s internet-based media as seen in United Airlines “re-accommodation,” Pepsi’s protest advertisement, and The White House press secretary’s recent statements about Hitler. The damage resulting from these missteps have included lost credibility, lower stock values, and potential lost sales.

There are many ways organizations can increase their overall resilience, and two in particular involve an internal auditor’s ability to provide independent, objective assurance and consulting activities designed to add value and improve an organization’s operations. The two key ways internal auditors can contribute to creating organizations resilient to crisis are: developing crisis management plans and evaluating success post-crisis.

Crisis Management Plan

In crisis plan development, internal auditors can provide insights from prior audits and/or enterprise risk assessments. Showing threats in financial terms highlights risky areas of the organization, and can be used to create the crisis plan and training simulations.

Internal auditors should support the creation of an expert network, so during a crisis the best individuals to provide information have already been identified. These individuals may be on the front-line, as they are well positioned to see the start of an emerging crisis. Part of their work may require exploring strategic threats, opportunities and developing new ideas to combat and take advantage of each. This front-line strategic exploration work provides resilience and a chance to mitigate risks. Similarly, a process should be established so employees can report potential crisis situations.

Internal auditors can encourage a crisis plan written in clear language, with outcomes that are specific, measureable, assignable, realistic, and time-related to support evaluation post-crisis.

Post-crisis Evaluation

Following a crisis, internal auditors can compare management’s actions to the crisis management plan and comment on how key decisions were viewed by the public. In addition, there are six specific areas of improvement internal auditors can explore after a crisis:

1. Were all stakeholders identified?

a. Was the importance of each stakeholder correctly assigned? Were they treated accordingly?

2. Reasserting or reshaping organizational mission and values.

a. Did any broad social or cultural expectations contribute to crisis?

3. Recognizing vulnerabilities.

a. These include inaccurate assumptions.

4. Become an industry leader in risk area.

a. Work to prevent similar situations internally and in the industry.

5. Renovating underlying organizational structures.

a. A post-crisis environment can be most open to change.

6. Better understanding the wholeness of organizational life.

Internal auditors are highly skilled professionals who bring a systematic, disciplined approach to evaluating and improving the effectiveness of risk management. Using their knowledge of the business as a whole, combined with their unique skill set, auditors help nurture organizational resilience and accomplish strategic objectives.


Boin, A., & McConnell, A. (2007). Preparing for Critical Infrastructure Breakdowns: The Limits of Crisis Management and the Need for Resilience. Journal of Contingencies and Crisis Management, 15: 50–59.

Doran, G. T. (1981). There's a S.M.A.R.T. way to write management's goals and objectives. AMA FORUM, 70 (11): 35–36.

Dufresne, R., & Clair, J. (2008). Moving Beyond Media Feast and Frenzy: Imagining Possibilities for Hyper-Resilience Arising From Scandalous Organizational Crisis. Law and Contemporary Problems, 71(4), 201–214.

Fandos, N., & Landler, M. (2017, April 11). Sean Spicer Raises Outcry With Talk of Hitler, Assad and Poison Gas. Retrieved April 20, 2017, from The New York Times: https://www.nytimes.com/2017/04/11/us/politics/sean-spicer-hitler-gas-holocaust-center.html

Jacka, J. M. (2017, April). Resilience Through Crisis. Internal Auditor, pp. 26–31.

The Institute of Internal Auditors. (2017). Frequently Asked Questions. Retrieved April 20, 2017, from The Institute of Internal Auditors: https://na.theiia.org/about-us/about-ia/Pages/frequently-asked-questions.aspx

Välikangas, L., & Merlyn, P. (2005). Strategic resilience: staying ahead of a crisis. Handbook of Business Strategy, 55–58.

Victor, D., & Stevens, M. (2017, April 10). United Airlines Passenger Is Dragged From an Overbooked Flight. Retrieved April 20, 2017, from The New York Times: https://www.nytimes.com/2017/04/10/business/united-flight-passenger-dragged.html?_r=0

Winston, A. (2017, April 12). Pepsi, United, and the Speed of Corporate Shame. Retrieved April 20, 2017, from Harvard Business Review: https://hbr.org/2017/04/pepsi-united-and-the-speed-of-corporate-shame

Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

Comment on this article

comments powered by Disqus
  • AuditBoard_Pandemic_May 2020_Premium 1_
  • Galvanize_May 2020_Premium 2
  • IIA CERT-Online Proctering_May 2020_Premium 3