For the last two years I’ve had the opportunity to represent the incredible men and women of the internal audit profession. You don’t often read about the invaluable contributions that internal auditors make, which means our profession is often misunderstood. This misunderstanding often leaves internal auditors in a gray area when it comes to legislation and regulation — either inadvertently caught up in efforts aimed at other functions/professions or left out of conversations in which we should have a leading voice.
Inaccurate, unnecessary swipe at internal auditors
One recent example took place just before the holidays when the Public Company Accounting Oversight Board released a proposed standard that completely missed the mark on internal audit, misrepresenting our role in an organization and taking an unnecessary swipe at the integrity of internal auditors. You can read the IIA’s official response to better understand the details, but in short:
As part of the PCAOB’s efforts to oversee CPA firms, the proposed standard says that external auditors (who are hired by an organization) should not work with internal auditors (who are employed by the same organization) to get direct assistance in certain parts of the confirmation process. The most concerning part of the proposal is the PCAOB’s reason for why external auditors shouldn’t work with internal auditors: “Involving internal auditors or other company employees in these activities [confirmation process] would create a risk that information exchanged between the auditor and the confirming party is intercepted and altered.”
It’s misleading to include internal auditors in the broad bucket of “company employees,” considering the internal audit function is intentionally structured to be independent from an organization’s management. To ensure their independence from management, the internal audit function reports directly to the board of directors or its audit committee. That puts internal auditors in a unique and incredibly valuable position and enables them to maintain organizational independence and individual objectivity. Because of their broad access to proprietary information, systems and processes, internal auditors, like CPAs, are bound by a strict code of ethics.
Considering that the internal audit profession is built upon integrity and independence, more than 230,000 IIA members were understandably upset to learn a regulatory body had suggested that their entire profession couldn’t be trusted and might intercept and manipulate information.
Proposed solution misses the mark
While the suggestion that internal auditors would manipulate data was inflammatory to many of our members, the PCAOB’s proposed solution to that unfounded concern — eliminating the internal auditor from certain parts of the confirmation process — makes even less sense. Internal auditors are independent from management and, just like external auditors, report directly to the board of directors to ensure they provide objective, independent insight.
This proposal reveals a lack of understanding of the very foundation of internal audit as well as our role within an organization. Our profession is committed to transparency, accountability, and serving the public interest. Internal auditors are valuable partners who should be among the first at the table working to solve whatever problem presents itself. When regulators and other stakeholders better understand our profession, they’ll realize that we’re after the same outcome. Then we can work together on solutions, which is where the value of internal audit really shines through.
While an external auditor is often hired to come in to do a postmortem analysis after an organizational crisis to determine what went wrong, an internal auditor works for the board of directors to try to prevent something from going wrong in the first place. An organization that has a robust internal audit function has someone constantly testing, exploring and evaluating, which makes the organization healthier and stronger. It’s like getting a physical every day, which improves your organizational health and minimizes the likelihood that you’ll develop a serious problem later.
The path forward
This PCAOB proposal is a reminder that we still have work to do in terms of building relationships and educating stakeholders about our profession. As we improve the general understanding of the work we do, there will be a greater appreciation of the value of internal audit. I look forward to working with the PCAOB to amend their proposal and build a strong working relationship.
