​​The Rock Stars of Internal Audit Were at The IIA's GAM Conference

Comments Views

​This was no ordinary, staid conference of internal auditors. Not when Larry Harrington — a highly respected chief internal auditor — is calling internal auditors "rock stars."

Larry led off the conference (after the normal routine opening greetings) with the energy and passion that typifies the man. He challenged everybody to "Lead or become Irrelevant." In particular, he demanded that internal auditors:

  • Must think and act as business owners.
  • Recognize complacency is our enemy.
  • Rethink our [internal audit] business models.
  • Change personally.​​

He said that "Our failure to identify, align to, and support our organization's key initiatives will lead to diminished value and respect." Internal audit must adapt. Larry referred to an IBM study to urge internal audit leaders to:

  • Hunger for change.
  • Innovate beyond customer expectations — yes, even auditors can innovate.
  • Become disruptive by nature, challenge the traditional way of conducting business and drive change.

Larry referred to a number of areas that I have a personal interest in and have been emphasized by Protiviti and others:

  • Move to a risk-based instead of transaction-based (or even controls-based) style of auditing.
  • Allocate resources to address risks to the business, with more resources on higher areas, etc.
  • Provide opinions, not just on individual audits, but overall opinions to your board.
  • Make smarter use of technology, including continuous auditing and data analytics.
  • Understand GRC and help your organization improve its governance, risk management, and compliance processes.
  • Integrate fraud prevention and detection into routine audit activities.

He ended on a resounding note, to a standing ovation!

Larry certainly got us going in the right direction, and there were several themes that continued through the conference:

  1. Change and re-align the internal audit model to meet your potential.
  2. Improve your use of technology.
  3. Focus on and understand risk. Be part of the solution as organizations implement risk management.
  4. Be aware of changes in governance standards and contribute to best-in-class governance processes.
  5. Add value — and communicate.

Perhaps my favorite session was also the last one I attended. The incomparable Mike Jacka (of blogging fame) kept us laughing not only at his asides and comments but also at the banana skins of social media. If you are not familiar with how inappropriate and uncontrolled use of social media might be for your organization, just think about how destructive kindergarten-age kids can be if unsupervised. We can be the hall monitors as companies start to play with the social media toys.

I also enjoyed a truly "graduate leve" class on risk assessment challenges from Paul Sobel. Paul really thinks through his internal audit model and shared with a packed room some of the challenges in running risk management, and stimulated some interesting thinking. I admit that I really enjoy speakers who make you think!

Another notable presentation, again to a packed house, was by the one-and-only Jennifer Hambert on continuous auditing. Now, while I disagree with her on how to use the technique (I advocate a top risk-based approach that supports the assessment of risk management and related controls), nobody has more passion and energy than Jennifer.

Other rock stars seen at GAM included (apologies in advance if I forget anybody):

  • Richard Chambers
  • Rod Winters
  • Melvin Flowers
  • Steve Goepfert
  • Richard Anderson
  • Don Robitaille
  • Alan Siegfried
  • Kiko Harvey
  • Tim Leech (maybe more "punk" than rock — smile, Tim)
  • Patty Miller
  • Larry Rittenberg
  • Joe Atkinson
  • Brian Brown

... and, last but not least, Warren Hersh. As he said: "Internal Auditors are rock stars now. This is their day in the sun."

Warren gives credit for the above quote to the then-chief financial officer of Pitney Bowes, in 2004. But I suspect this 2001 article in Inter​nal Auditor by yours truly might have had some influence.

By the way, what do you think of that article, now nearly ten years old?



Comment on this article

comments powered by Disqus
  • CRMA-Launch-October-2021-Blog-1
  • All-Star-Conference-October-2021-Blog-2
  • IT-General-Controls-October-2021-Blog-3