Home > Risk > Internal auditors do not have the right to remain silent!

Internal auditors do not have the right to remain silent!

October 11, 2010 Leave a comment Go to comments

Sorry, but I feel a rant coming!

Try this. Take your head of internal audit out for coffee (if you are the CAE, look yourself in the eye) and ask him/her about the organization’s governance, risk management, and related controls. Are they in great condition?

For example:

  • How effective is the board? Do they get complete, timely, and reliable information on which they can base their decisions and assessments?
  • How effective is the audit committee? Do they really understand the company, its risks, and its controls?
  • Do you have a great CEO? How about the CFO? Have they built a world-class team that delivers optimized performance?
  • What about the rest of the leadership team: the general counsel, head of operations, etc?
  • How effective is the management of risk? Does the management team have a reliable and timely view of risk across the enterprise? Is risk being managed as part of daily decision-making and embedded across the organization?
  • Does IT provide the business with a competitive edge? Do managers have the best tools; reliable and timely information; instant response time and always-on availability? Is the cost of IT appropriate to the business?
  • How effective are the sales team, the procurement function, manufacturing, etc? Are safety and quality optimized everywhere?
  • Is sufficient attention paid to compliance? Are resources and expertise sufficient?
  • Are the organization’s values embraced by all employees at every location?
  • Where is the organization most at risk?

Now ask whether the audit committee and management appreciate all the concerns of the CAE.

In my experience, CAEs are often unwilling to go beyond the results of their audits and share how they really feel. Surely, the board should know if the CEO creates a culture of confrontation, or if the CFO punishes all bearers of bad financial results.

It is true that we should use caution when sharing bad news, especially when top management is at fault. We need to be prepared with evidence, ensure we appear objective, and should find allies where possible.

But, remaining silent when we have a concern of significance is not an option.

  1. October 11, 2010 at 5:11 PM


    Let us rant together, this upsets me too. I think IA/CAE are not talking about the real issues, and are just interested in maintining status quo. I took an opposite view in an article a couple of months back- Independence of Internal Auditors- An Oxymoron. It might interest you. Then we can share our frustration together.


  2. Michael Corcoran
    October 13, 2010 at 8:16 AM

    Sharing with the BOD = My experience is that Audit Committee executive sessions provide a forum for candid dialogue with the BOD.


  1. October 11, 2010 at 2:00 PM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: