I just read an excellent piece on Bloomberg BusinessWeek. It discusses the board's responsibility related to oversight of corporate compliance, culture, and the performance of executives.

Every organization should have a well-thought out policy for corporate or individual use of social media. The reputation risk if use is not well managed can be significant.

This is one of a pair of posts. What I want to cover here is generally how internal auditors can derive professional value from their use of social media. In my personal blog, I share details of who I follow, what discussion groups I belong to, and why.

For many years, I used (and continued to develop) a tool that helped with risk discussions with board and top management. You can access a copy here. (By the way, I have made a number of other files available from my LinkedIn profile).

I just responded to a LinkedIn question about Audit Universe.

Audit universe contain all the auditable areas. Is it defined anywhere in how many years the entire Audit universe should be covered i.e., all the areas should be audited at least once? Is it defined in any IIA standard or any other pronouncement? what is the best practice?

It would be hard to find an organization today that does not have a strategy that has been blessed by the board, and which is intended to drive performance. But there is often a major gap between establishing a strategy and fulfilling its promise – a gap created by defects in management processes.