There’s a curious article on Internal Audit and Emerging Risks in Directors and Board. It was written by someone who is considered a leader of our profession and published at the end of April.
It merits our attention because of who wrote it.
It starts well with:
The volatile and fluid nature of our current risk landscape requires vigilance from boards, management and internal audit.
True.
But then it has odd (at least to me) statements, starting with:
[The internal audit function is] An integral part of the company’s risk management system…
While we provide (or should provide) assurance on the company’s risk management system as a monitoring activity (and I have provided guidance on how to do that), it is not part of it.
Considered how the article continues:
…the role of the internal audit function is to keep a close pulse on emerging and “under the radar” threats.
No, it is not.
If management and the board are relying on the small team in internal audit to identify all the emerging risks facing the organization, they are in trouble!
The role of the internal audit function is to provide assurance that management is “keep[ing] a close pulse on emerging and “under the radar” threats.
The next sentence is correct:
For boards of public companies, leveraging an internal audit is critical both…
