Last week, I was in a duel with Richard Chambers on the topic of internal audit opinions.
Neither of us had much time to express our views, so I am taking the opportunity of today’s post to share some insights that might be useful.
Last month, I ran a survey that asked internal auditors “How do you communicate your overall opinion?” The answers were:
- We don’t include an overall opinion on the adequacy of controls over the risks in scope… 8.7%
- We use traffic lights, such as red/yellow/green… 19.0%
- We use language like “the controls are effective, adequate, or ineffective”… 41.3%
- We construct an opinion statement that reflects not only whether the controls are adequate overall, but which risks might not be at unacceptable levels… 23.0%
- Other… 7.9%
Consider four identical manufacturing companies where internal audit has completed an audit of their inventory management processes. This is a critical activity for them (as it is for businesses in many sectors, such as retail and wholesale, oil and gas, and more).
Imagine that you are on the boards of each company and reading the audit reports.
All the audits found the very same six issues. But they reported them differently.
The auditors of Company A wrote that they had completed their audit of inventory management processes and found a…
