Last week I discussed The most important audit committee demand of internal audit as reported by Richard Chambers based on his interviews with 15 committee chairs.
Today, let’s talk about their second demand, which follows on from their first:
Express an overall opinion on the effectiveness of risk management and controls by “connecting the dots”.
Let’s be clear and honest about this: many if not most internal auditor leaders are reluctant to put themselves out on a limb and express an opinion on the overall condition of the system of internal control.
Reasons they provide (I will let you decide whether these are reasons or excuses, but be open about it – and I will discuss each momentarily) include:
- We don’t have the resources to address all the controls, even all the controls over significant risks to enterprise objectives.
- The audit committee does not expect us to do this.
- The IIA Standards do not require it.
- Others are not doing it.
- It’s too much of a risk to express a positive opinion. The most I can do is report any major findings.
Back in 2009, I was a member of the IIA’s Professional Issues Committee and five of us (Gilbert T. Radford; Bruce C. Sloan; Debbie E. H. Loxton; Norman D. Marks; and Trygve Sorlie) wrote an official IIA Practice Guide (PG), Formulating and Expressing internal…
