Recently, The IIA proposed enhancements to its International Professional Practices Framework (IPPF) that, in my opinion, do an excellent job of providing guidance on what internal audit is all about. While putting together my comments on the proposal, I found myself asking some fundamental questions about what makes our profession unique.
These questions actually began forming during conversations I had with various internal auditors about independence and how it relates to our profession. One group asserted that independence is a negative — an approach that puts us in adversarial relationships with our customers. The second group argued that independence would never be obtained. I quote: “Get over it. ... You are not independent; you are objective.”
There is more wrong with both these positions than I have time to dispute. But it all seems based on a misunderstanding of independence as it relates to internal audit. Independence does not mean we have declared independence and broken away. It does not mean we cannot be partners. It means (per The IIA) “the freedom ... to carry out [our] responsibilities in an unbiased manner” (emphasis added). It is nothing more; it is nothing less.
What kept me up at night (and what I was reminded of as I looked at the enhancements to the IPPF) was that these individuals could so blithely throw out one of the most fundamental, foundational, and unique aspects of our profession. In fact, if you look closely — dig into the literature, read the Standards, talk to the experts — there isn’t much that makes our profession unique.
We provide assurance, but so do other assurance functions. We provide consulting services, but so does anyone who can ask a question and write a report. We add value and improve the organization’s operations, though name one part of the organization that doesn’t do that. We focus on risk management (so does the chief risk officer), controls (so do management and anyone involved in regulatory compliance), and governance (so does the board and executive management).
Only two little words truly separate us from the rest of the business, make us unique, and establish our raison d’être — “independent” and “objective.” We bring to the table an unbiased approach that avoids conflicts of interest. No one else — no other department, no other entity, no other profession — offers that unique service.
Independence and objectivity mean we are not just risk managers, not just consultants, not just accountants, not just process engineers, and not just another cog in the business. They mean we are specialists providing unbiased insights and evaluations in an environment free from conflicts of interest. They mean we provide unique value to the organization, and they are the only reason anyone should keep us around.