Whenever I see papers or presentations by consultants on the evolution of internal auditing, usually by adopting new technologies, I am at once amused and frustrated.
What these papers ignore is that so much more can be achieved by ensuring internal auditors perform the basics well.
For example, in my experience few internal audit departments focus on the more significant risks and stop auditing issues that would never have a serious effect on enterprise objectives.
You see this when audit thought leaders and practitioners talk about agile internal auditing, where they break down a lengthy audit (perhaps multiple man-months in length) into sprints. They prioritize the sprints, auditing the more significant areas first and the less significant ones in later sprints.
The problem is that those later sprints involve auditing issues that wouldn’t rise to the high-risk level on their own.
The lengthy audit should be cut down dramatically so that it only includes in its scope those issues of significance to the success of the enterprise as a whole.
Another example is the need to sit down and have a constructive discussion with operating management when potential issues surface. The first priority should be to agree on the facts and whether there is a problem. Once that is achieved and we can agree on the…
