The great French military and political leader, Charles de Gaulle, is said to have observed that “generals are always fighting the last war.” The reasoning behind this often-used quote is that military threats are always changing and evolving, and there is a temptation to assume that the next threat will look just like the last one. My fear is that internal auditors are tempted to fall into this trap. However, focusing audit coverage on “yesterday’s risks” can result in being ill-prepared when new calamities appear.

There was a time when a career goal for many internal audit professionals was to rise through the corporate internal audit ranks to become their company’s general auditor — what is known as today’s chief audit executive (CAE). My first CAE had been an internal audit professional for almost 20 years when I joined the organization. He was still the CAE 13 years later when I took his place (having left and returned to the department twice).

This year will mark my 34th in the internal audit profession. During my career, I have had the privilege of leading internal audit teams and conducting quality assessments of internal audit functions in the public sector, not-for-profit sector, corporate sector, and even the Big Four. I am sure I could fill a book on the successful strategies I have seen deployed by high-performing chief audit executives (CAEs). By the same token, I have witnessed more than a few spectacular failures over the years. Failures are rarely career enhancing, and sometimes they can be downright fatal not only for the CAE’s career, but also for the internal audit function itself.