I believe every internal audit executive would agree with me that our independence from management is critical.
We need to be able to operate without undue interference from management.
That means that they are not able to stop or change our audit reporting, our opinions, or our assessments.
It also means that they cannot stop us from performing an audit, and they cannot change its scope. They also cannot command that we perform other activities (even other, lower risk audits), diverting our limited resources from our essential responsibilities.
But if we use the wrong words injudiciously when talking to management, we may give them reason to believe they can do all of that.
So what are the right words to use?
When we develop and update (continuously) our audit plan, the schedule of audits we plan to perform, we will seek input from management.
We want to know:
- Their concerns about risks and controls.
- Their ideas and assessments of the more significant risks to enterprise objectives.
- Their plans for change.
- How they see us adding value.
- Whether they have task forces or similar projects reviewing areas that we might target for an audit.
- Their thoughts on the audit projects we are considering.
We want their collaboration on our audit plan.
But it remains OUR audit plan.
We can put that at risk by careless use…
