Internal auditors do not have the right to remain silent!
Sorry, but I feel a rant coming!
Try this. Take your head of internal audit out for coffee (if you are the CAE, look yourself in the eye) and ask him/her about the organization’s governance, risk management, and related controls. Are they in great condition?
- How effective is the board? Do they get complete, timely, and reliable information on which they can base their decisions and assessments?
- How effective is the audit committee? Do they really understand the company, its risks, and its controls?
- Do you have a great CEO? How about the CFO? Have they built a world-class team that delivers optimized performance?
- What about the rest of the leadership team: the general counsel, head of operations, etc?
- How effective is the management of risk? Does the management team have a reliable and timely view of risk across the enterprise? Is risk being managed as part of daily decision-making and embedded across the organization?
- Does IT provide the business with a competitive edge? Do managers have the best tools; reliable and timely information; instant response time and always-on availability? Is the cost of IT appropriate to the business?
- How effective are the sales team, the procurement function, manufacturing, etc? Are safety and quality optimized everywhere?
- Is sufficient attention paid to compliance? Are resources and expertise sufficient?
- Are the organization’s values embraced by all employees at every location?
- Where is the organization most at risk?
Now ask whether the audit committee and management appreciate all the concerns of the CAE.
In my experience, CAEs are often unwilling to go beyond the results of their audits and share how they really feel. Surely, the board should know if the CEO creates a culture of confrontation, or if the CFO punishes all bearers of bad financial results.
It is true that we should use caution when sharing bad news, especially when top management is at fault. We need to be prepared with evidence, ensure we appear objective, and should find allies where possible.
But, remaining silent when we have a concern of significance is not an option.