In the years since the onset of the financial crisis, the role of several internal departments have come into the spotlight. Among these are those of compliance, enterprise risk management, and internal audit. This post will focus on the latter. Public interest in the role of internal audit increases and decreases with time. Naturally, it increases dramatically in times of crisis – whether it is the crisis of a single organization or a more widespread crisis across a system. Additionally, the spotlight’s focus on the internal audit role can shine on companies in all industries, not just the oft-discussed financial sector.
Internal audit is truly critical to the decision-making process in any organization. It is an activity that is an exercise in risk management and the provision of information and consulting. This exercise requires discipline to marry various skill sets – from investigation to organization to communication – to analyze and manage risks. It is very similar to some functions of compliance in this sense – there is a focus on appropriate processes and controls being in place to ensure that organizational objectives are being met. Additionally, internal audit plays an important role in understanding and monitoring internal fraud. For example, the Fraud Triangle is a framework that people in oversight roles should always be aware of given that there is no perfect system to deter irregular actions. This framework allows people in such roles to monitor for possible motivations for fraudulent activities – whether they be through opportunity, rationalization, or pressure – and to remove them in order to deter said activities. Internal audit is a key company safeguard in this sense.
Overall, an effective audit program, coupled with a compliance program, is crucial to the success of any business, small or large. Even if it is simply an informal activity for a small business or in a hybrid form in others, most businesses would be taking a material risk to go without some form of audit. What is important is that the audit should not merely have the goal of confirming the vision of senior executives. It is an investigation to test existing controls and to ensure that appropriate processes are in place.