So here’s an interesting blog post on the global Institute of Internal Auditors’ website: https://iaonline.theiia.org/internal-audit-is-in-the-midst-of-a-great-war
It’s about internal audit fighting a turf war for its space in the corporate world, with compliance, legal and other corporate functions. I’ve had this at various points in my career. Various parties that claim to be better at providing assurance, or better at understanding the management team and providing advice.
Who are these parties? Well, external audit, who I’ve often seen to be treated with greater respect than the internal audit function. Usually by chairs of audit committees that have come from that background, or who have never really been internal auditors or worked with a good internal function before. It always surprises me that internal audit, who are the audit committee’s and senior management’s eyes and ears, are not respected or used as much as they could be.
The other are advisors. Normally from external companies, who reject the detailed and context-specific knowledge that internal auditors bring to the table. I suspect because although they may have context independent knowledge, they know they really lack knowledge of the business. I have, however, worked well with firms that can use internal audit to get a good result from their work.
Second line control functions have also challenged. They often have a remit for control, but without the truly independent function remit and the discipline of internal audit, they lack the structure to really make a difference.
The most challenging are management functions, often those slightly detailed from the front line business, often based in finance, HR, IT or other support function, who think internal audit ‘knows nothing’.
Yet all of these challenges have come to nothing. Why? Well because they lack the core attributes of internal audit, independence and objectivity. I also think they lack discipline of good internal audit. It is the systematised and organised, risk-based, consideration of the business. Good internal audit is used to working at the edge of its ignorance, can apply basic principles and common sense, and put the findings in a knowledgeable, context-dependent, context. It is also used to understanding things quickly and effectively and picking up what matters.
Now clearly a weak internal audit function will play second fiddle to other corporate compliance functions. In my view, however, a good audit function will always find suitable corporate space in which to work. Internal audit has a unique value proposition and this should, all things being equal, win through.
So are you or your function facing a turf war? If so, don’t engage, just be good. Just be better. Just be an excellent internal audit function. For excellence in internal audit can make a significant difference to any organisation and if the organisation doesn’t recognise it, it doesn’t deserve its auditors!