I am becoming increasingly convinced that there are very significantly different models of internal audit. I notice this most when I recruit staff, which I need to do shortly. In my experience you tend to get what are advertised by themselves or recruitment agencies as ‘experienced auditors’. These tend to come in two types. First, the experienced auditor (who is also often a qualified or part qualified accountant). After the first two questions you realise that they have very little knowledge and experience of internal audit and in fact assume internal audit to be that ‘systems’ stuff that they did as a first year in their accountancy firm. Second you have the internal audit ‘lifer’. Typically public sector, typically older and typically worked their way up through an internal audit function. Now my issue with both is that modern internal audit requires in my view, and primarily, the ability to think. Financial accountants have lots of guidance, rules and precedent to prevent them from ever needing to think, certainly not creatively. People with lots of low level audit experience from the public sector tend, in my experience, to have never needed to think, but for a different reason. Now this links to my internal audit type point.
Internal audit is increasingly being delivered on what I call a ‘scope of work’ model. That is you scope the work you will do and issue an opinion. What is missing under this model is the scope of the opinion. I have heard the argument, ‘we did the scope of work we could do in the days’. What if this does not deliver the right answer or is woefully short of addressing the real issue or question at hand? Does internal audit restrict the questions it asks? Not terribly risk based, but practical. The balancing figure should always be the work, not the opinion, in my view.
As questions in business, and answering them, becomes more and more complex I think this is fundamentally the wrong approach. Surely the question should be scoped? If the work required to answer the question is manifestly too big e.g. what is the meaning of life?, then break the question down into its constituent parts. For example, I cannot answer the question, is this business unit going to achieve its strategy and manage all of its risks?, but I can say, let’s look at the processes it undertakes to assess, evaluate and address its market position, let’s look at its product portfolio and development etc.
So here’s the rub. Where are the broad-based, bright, intelligent, free-thinking internal auditors coming from? In my view the IIA (globally) should be much clearer that this high-value, less compliance and ticking focused model is the way forward and that the internal auditor should take their place alongside marketing, finance, HR and others as a core business function that any successful business cannot do without. For without this proximate, yet independent, challenge internal audit becomes another rule and process-based refuge for the non-creative and non-free thinking that so many other professions are at risk of condemning themselves to already.