As auditors, we provide assurance, advice, and insight on the system of internal controls over the more significant risks to enterprise objectives.
Internal controls provide the basis, the foundation, on which management and the board rely as they manage and direct the organization to success.
The typical audit assesses and tests the controls over transactions and how they are originated and processed: their completeness, validity, accuracy, and recording. We may also audit risk and governance practices, and how information and systems are protected.
But is that missing the boat?
Are we (and risk practitioners) failing to provide valuable assurance, advice, and insight on what may be even more important to successfully achieving objectives?
Organizations succeed or fail as the results of the decisions they make.
Those decisions include:
- Defining the purpose of the organization, what it desires to accomplish over the longer-term
- Deciding what strategic goals and objectives should be set for the period, including how each member of the management team will be compensated
- Identifying the strategies that will enable them to achieve their objectives
- Managing the organization every day, making tactical decisions such as:
- Who to hire
- Who to fire
- Sales prices for the organization’s products and services
- Which…
