My 3 Biggest Fears as an Internal Auditor

What do you fear?

Internal auditing is a rewarding career. Stakeholders trust internal auditors to evaluate policies, processes and procedures to determine if organizations are adequately mitigating risks.  This is a huge responsibility.  When things are going well, clients often view auditors as the “traffic cop” or a “necessary evil”.  However, one of the first questions asked when a control breakdown occurs is “Where were the auditors?” or “Why didn’t the auditors catch this?”. It is a double edged sword. Often practitioners are met with anticipation, fear, reward, or regret. Below are my biggest fears as an internal auditor.

Missing Something Important

I fear the day that an area we audit suffers an extreme control breakdown. There, I said it.  But let me clarify that the fear has nothing to do with confidence in my team’s auditing competencies, but moreso witn the perception of others.  Inaccurate perceptions can ruin reputations and end careers.

Take, For example, the CAE who is terminated because s/he audited a subsidiary in which it was determined months later that data privacy controls were weak. The subsidiary exposed tens of thousands of private records and faced not only fines and penalties, but also a loss in customer confidence. The obvious question arises, ”Didn’t you guys just audit that?” The short answer is yes.  The long answer is yes but this was not in the scope due to…and you describe the engagement scope. Your focus was warehouse inventory period. However, your stakeholders only hear “Yes, we audited that but”. And the longer answer, this was not in scope and that audits provide reasonable but not absolute assurance, only seems to add more to the confusion.  The confusion leads to anger. Emotional anger in rational situation is never good. All of sudden, audit becomes the scape goat while the real issue is often overlooked.

Now, the other outcome is that an audit function could completely miss the boat. For example, the area in which the breakdown occurred could have been in scope and reviewed.  The issue may have been missed during the engagement. After all, no one is perfect. However, because of our strict audit approach, I actually fear this less than I do the previous example.

Finding Something Important

It is very plausible that internal auditors may ”find” something during the course of an audit. Personally, I have seen fake vendor schemes, check skimming and time card abuse. However, I’m not referring to small items like these. I’m afraid of finding Cynthia Cooper (WorldCom) company ending issues. My fear has little to do with will I report the issue. I’m pretty outspoken and believe in telling management what you need to know vs. what you necessarily want to know. The fear is more so about the repercussions the innocent will suffer.

At the time, WorldCom was the second largest long distance provider in the US, only AT&T was bigger. There were tens of thousands of employees in multiple locations and it was a multibillion dollar corporation. The internal audit department, led by Cynthia Cooper, discovered the company was not reporting accurate numbers. This discovery led to the largest bankruptcy in U.S. history (at the time). To make matter worse, jobs were lost and lives were interrupted.  In her book, Cynthia discusses working late at night to gather evidence needed to validate the fraud.  So essentially, their honesty, integrity and hardwork contributed to the downfall of the company.  

I believe the internal audit function did the right thing.  Also, as mentioned, I definitely would have reported the fraud.  But none can ignore the fear of knowing that you could possibly contribute to the downfall of an entire organization and its people.

Not Making a Difference

Everyone wants to make a difference; teachers, doctors, nurses.  Auditors are no different.  Many of us get into the profession to help organizations operate more effectively and efficiently. It is a shame when organizations view internal auditing as a “necessary evil”. Every employee in an organization contributes to the successful delivery of its products and services.  Internal auditing is no different.  Organizations miss out on the opportunity to have their own internal consultants or to build future leaders.

Conclusion

Internal auditing is a tough yet rewarding profession.  There is much to see, learn and do.  It is exciting and challenging.  It requires professionals who are intelligent, adaptable and fearless.  Facing your fears can be tough.  Honesty and integrity are the guiding principles that will see you through every dilemma you may face.