What is the role of Internal Audit?
INTERNAL AUDIT
Sometimes, understanding the role of Internal Audit can feel like waiting until the end of one of those old films about the hard boiled detective trying to figure out what’s really going on. The one where the mysterious stranger comes in to hire the detective, but doesn’t quite share the whole story. The audience has to wait until the end of the movie to figure out what’s really happening.
Over the last few years we have had recurring conversations which inevitably included the phrase, “rearranging deck chairs on the titanic.” A common phrase invoked when you want to point out that the actions taken will have little to no impact on the overall effectiveness of an individual, team, or organization. For better or worse, we realized that it often happens in the course of describing the role of Internal Audit.
According to the Institute of Internal Auditors (IIA), the definition of Internal Auditing is:
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
Source: Institute of Internal Auditors Website
Many people will tell you that the job of internal auditors is to test internal controls in an effort to reduce risks. This is where that phrase about the deck chairs begins to pop up. If you are testing the fact that the deck chairs need to be neatly arranged and spaced in the minutes before and after the Titanic’s impact with an iceberg, are you actually adding value? Our first inclination was to postulate that in Fortune 500 companies — generally mature businesses operating at scale — perhaps the process of internal auditing was more about testing controls versus that of smaller, start-up oriented companies and organizations.
But then we thought about Kodak. You remember them, right? At one point in their history Kodak had over 145,000 employees across the world (Source: New York Times). Today it has a little more than 4,000 employees with approximately $1Billion in annual revenues.
Midway through the movie our detective is still stumped. What is the real mystery and who is behind it all? Is that mysterious stranger helping or up to something more sinister? And what’s with that Cruella de Vil cigarette?
At their peak, was it the job of Internal Audit at Kodak to test the controls of their manufacturing plants? Or to start taking a long look at the impact that digital photography could have on their core business? Was the former a form of rearranging deck chairs on the Titanic? The only answer we could come up with was, yes … pretty much. Which brought us back to the question, what is the role of internal audit?
Thankfully, the answer has been baked right into the definition from the IIA:
“It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”
Important to note that you don’t see the words, “to test controls.”
As we thought about the future of the audit profession, we began to see the potential for what Internal Audit could be. More than that, actually. We can see a world where Internal Audit plays an important, if not the most important, role within an organization. One where Internal Audit can help an organization accomplish its objectives.
In this day and age, and given the events of the last three years, we can’t afford to wait until the end of this film to find out that it was the mysterious stranger all along.
As Internal Auditors we are here to challenge what you know, and perhaps educate those who know very little, about the important - no, CRITICAL - role that Internal Audit needs to play within organizations moving forward. We are officially here to challenge the status quo and present a new vision for what internal audit can be and how it can do what it needs to do.
And maybe we can rewrite the script by living happily ever after in wildly successful companies that can adapt to whatever comes next.