The Future of Internal Audit – My Plea

We have a window of opportunity to fashion our profession in such a way that it becomes truly effective. This opportunity has been created by the UK Financial Services Authority leaning on the Chartered Institute of Internal Auditors to come up with a new guidance regime that seeks to cure the ills of the past.

We are led to believe that the FSA will directly intervene if the CIIA does not succeed.

Without putting words into the regulators mouth, it would appear that internal audit failed in its primary responsibility leading to the failure and demise of many institutions. This is a view I agree with in the context of our role as the third line of defence!

Some of my readers will conclude that my company, Risk Audit, has a conflict of interest in making any recommendations given the fact we run a professional development business. I acknowledge those conflicts but please forgive me for responding to Maslow’s needs. The fact I need to put food on the table does not diminish my passion as an internal auditor (man and boy). I started life as junior internal auditor, progress to running audit functions and now find myself lecturing on the subject and engaging in an ever increasing number of related mentoring assignments.

A few words about the CIIA process. The trade association has assembled a group of highly experienced individuals. They represent and / or have worked in large businesses. One hopes that they will take into account the opinion of little person. Please bear in mind that small businesses can have major effects (MF Global / Northern Rock). One also hopes that their processes will include a transparent process that encompasses not only the members of the CIIA. The CIIA does not fully represent the internal audit community in the City of London.

What are my big ideas?

For reasons of Maslow, I will not go into any great detail at this stage but please let me outline the essential areas that need to change:-

• Internal audit must focus on strategic risk control – the failure of these processes lies at the route of some of the most spectacular disasters we have witnessed;
• The scope of internal audit should be widened to capture the role and processes related to Non-executive directors – is Walker believes NED’s are important then their processes are important enough to be audited;
• Benchmarking internal audit competence lies at the core of our challenge – we have a blueprint for this benchmark (visit our classrooms and webinars and you will know what I mean).

I hope that Risk Audit and other practitioners can participate in this debate.

Finally, a few words to the regulator. Until very recently, it was safer for a Head of Internal Audit to avoid aggressively escalating their toxic issues within the business. That balance is now changing. I hope that the FSA and PRA will judge internal auditors not only by their processes but also by the degree to which they successfully persuade the board and management to change for the better.

However please remember. Internal audit is internal audit not an extension of the FSA’s inspection function. To migrate towards the latter will cause management to clam up and important information flows to shut down. We sense a real danger than we are moving towards the latter.

Please send any comments you have to [email protected] or call me on + 44 665 5481.