Home > Audit, Compliance, COSO, Governance, GRC, IIA, Risk, Sarbanes, SOX > Where is internal audit world-class?

Where is internal audit world-class?

A conversation I just had with Michael Corcoran left me wondering which companies have now or in the past had what one might consider “world-class” internal audit departments?

My personal view is that the CAE is the last person to say his or her internal audit department should be considered world-class.

Instead, that should only be awarded by members of the audit committee or top executives (although I am not sure I would give as much credence to the opinion of a CFO who wants IA to focus on financial and compliance risks).

I would allow members of the audit team to make the award based on what they hear from senior operational executives.

As a former CAE, I am going to hold to my word and not name any of my prior teams. If they want, they can speak for themselves.

So, please use the comments to identify the IA departments you think are world-class and why.

  1. Tom
    August 17, 2014 at 4:20 PM

    Norman – interesting question and I look forward to the responses.

    From the perspective of leading an audit team at a competitor in the mid 2000’s I always thought that the internal audit team at Australia’s largest telecommunications company, Telstra, under the leadership of Andrew Dix, filled many (if not all) of the criteria that one would expect to see in a world class internal audit organisation.

    A world class internal audit function is not only one that has the respect of those within its domain but equally it has the admiration of its peers.

    Additionally a world class Chief Audit Executive is someone that freely gives of their time for the betterment of the profession. The modern generation of Australian (and – even if they don’t realise it, global) internal auditors will long be in Andrew’s debt.

    They also had the best mantra of any internal audit team – Seen. Sought. Heard.


  2. Mike Corcoran
    August 17, 2014 at 4:22 PM

    Norman with all due respect that is exactly what you did in a previous blog about yourself.

  3. Mike Corcoran
    August 17, 2014 at 5:21 PM

    Norman you start out with the self proclamation that I have never seen in my 30 plus years in the profession. Headline is “Over the years, I have had the privilege of leading world-class internal auditors – world-class people who deliver world-class internal audit services to our customers on the board and in management.” Well some of us in CT at the time of some of these claims disagree.

  4. Mike Corcoran
    August 17, 2014 at 5:49 PM

    That is the point. It is your view. You write matter of factly about your staffs when others in the metro NYC market competing for talent knew differently. The firms you mentioned I have no direct association with other than in IIA circles and they said nothing about you or Tosco.

  5. August 17, 2014 at 9:51 PM

    The better question may be “where is internal audit?” – Talking your question, in my humble view “world-class” needs to be clearly defined. How does that look like? I suspect that world-class organizations nurture world-class internal audit, so the organization may be an enabling or limiting factor. More importantly, is it clear what the purpose of internal audit is and who the key stakeholder/s is/are? There may still be some confusion in the corporate world, maybe less among internal auditors themselves. What do you think?

    • Deb
      August 19, 2014 at 10:18 PM

      ‘…world-class organizations nurture world-class internal audit, so the organization may be an enabling or limiting factor’ – Touche. Nothing better can perhaps be said on how to at least start on the way to being ‘world-class’, whatever that means!

  6. Martin Patton
    August 18, 2014 at 12:15 AM

    I will be bluntly Mike Corcoran sounds like a typical East Coast asshole with his head up his ass that I had the privilege of working with over my 15 years in New York and New Jersey!

    • Michael Corcoran
      August 19, 2014 at 5:52 AM

      I am sorry Martin you had such a terrible time with your east coast boss. I served on the Board of the Westchester NY Fairfield CT Chapter of the IIA for several years and got to know most of the companies in the area. I have lived in Atlanta for 10 years now so I guess I am a Southeast ***

    • Mike Corcoran
      August 19, 2014 at 5:15 PM

      Martin, That must have been Norman at Tosco and Solectron per your LinkedIn profile. Do no see any other companies.

  7. rameshiyer
    August 18, 2014 at 1:03 AM

    Obviously, the internal auditors cannot and would not call themselves world class. it is the process owners who avail services of internal auditors call them as world class. It could be on account of two reasons – (1) the process owners are not equipped enough to know what is happening around and they get this information only through internal auditors or (2) the process owners know what is happening around but do not want to stain their hands and hence they use internal auditors to get their work done and give credit to internal auditors saying that they are world class. If there was some thing called ” world class”” and it was available off the shelf, then every organisation would just acquire those talents and call their internal auditors as world class.

  8. Charl
    August 18, 2014 at 11:19 PM

    Try Nedbank in South Africa – contact person Dion Pillay (Operations Officer – Internal Audit)


    South Africa is consistently among the top 3 countries in Auditing globally.

  9. Sunil
    August 19, 2014 at 6:13 AM

    although it is very subjective, perhaps a world-class internal audit could be measured along the three areas (put together – but measured individually):

    – Efficiency
    – Effectiveness
    – Efficacy

    Most internal audit functions(at least for the Fortune 500), if not all, try to objectivize these measures and attempt to surpass them. For example:

    Ensuring attaining a minimum number of audits every year / per auditor
    Achieving maximum output (audit plan) however keeping the internal audit department’s cost to the minimum.

    Does the internal audit department helps realize the Board to take the organization to next level of risk maturity?
    Does it cover all risk areas to give more than “adequate” assurance?
    Does it surpass the vision and mission it has set as a goal?
    Does it surpass the benchmarks on process maturity in terms of timeliness, quality assurance, training, producing leaders for the organization etc.
    Does the internal audit has detailed documented policies and procedures for managing its own affairs?

    Does the internal audit surpass ratings from its stakeholders consistently?
    Does the department proactively engage, recommend and guide the management to fulfill their responsibilities?

    • Bob R
      August 21, 2014 at 10:36 AM

      I have always viewed the number of audits — and its close relative, the percentage of the audit plan completed — as the worst measures of internal audit success. What value is the number of audits, or the number of audits per auditor, if IA audit is not doing the right audits? This would clearly be the opposite of being effective. Likewise, the oft mentioned measure of success being completion of the audit plan, to me, means that IA is inflexible in changing direction to meet the changing needs of the organization. BTW, in my 20+ years as a CAE, I’ve never completed an audit plan.

      • ramesh rajagopalan
        August 21, 2014 at 10:10 PM

        An internal audit can be world class when it embraces best practices from various industries, anticipates change, aligns its audit strategy to the changing environment and circumstances, provides a proactive futuristic solutions to the business ahead of the event/change actually occurring, thus mitigating the risks instead of being a reactive, past oriented, fault finder. This would leave only tail issues (or) low risks being uncovered (or) unaddressed by business thus minimising the risk exposure post that event or change.

  10. Norman Marks
    August 19, 2014 at 6:44 AM

    Sunil, would you agree that the IA customer’s assessment is what counts?

    Also, why is the number of audits per year important? Is it not more important to address the right risks? Why focus on achieving the plan when the world of risk is changing?

    I like some of your other measures. Thoughtful – thanks

    • Sunil
      August 19, 2014 at 6:57 AM

      I agree completely. Customer’s assessment is ultimately what counts. Hence efficacy (stakeholder ratings / assessment) is of utmost importance. Clearly addressing the right risks is of paramount important. Some internal audit functions though use quantity as a productivity KPI (e.g. six sigma / balanced-score card etc).

  11. Eduardo Anton
    August 22, 2014 at 12:13 PM

    I strongly believe that our internal audit customers are those whom rely can assess if we are or not a world class IA management. Internally if we adopt this consideration we close the continuous improvement opportunity, because our consideration of world class!!! condition.

  12. c oloughlin
    August 24, 2014 at 11:12 AM

    I would hope that the results of an external quality assurance review would also play a part in being rated as world class. Compliance with the IPPF, those are the appropriate standards applicable to the organization, is one part of the whole overview.

  13. Michael Corcoran
    September 2, 2014 at 10:07 AM

    20th Anniversary – $500 million Shareholder Value Creation Event

    In the summer of 1994, I discovered a $2.5 billion understatement in the methodology used to calculate the tax basis of Philip Morris Inc. The Tax Department had some suspicions about the methodology and asked Internal Audit for help. The value did not manifest itself until the subsequent spin-offs of Philip Morris International and Kraft Foods. This has created actual cash value and savings to shareholders of about $500 million without even considering the time value of money. This was and still is an example of world class skills and results.

  1. August 17, 2014 at 6:01 PM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: