You’ve heard the expression, “People who live in glass houses shouldn’t throw stones.” A corollary drawn from a presentation I share with government auditors, though applicable to all internal audit shops, is “If you’re going to throw stones, you’d better live in a shatterproof house.”

Last month, I lost two people who had an important influence on my life. One was a dear relative, and the other a close personal friend from my college years. As I have reflected on these two remarkable women, I am struck by one thing they both had in common: They lived their lives in color. Unlike so many people who simply punch the clock on their personal and professional lives, both of these women lived their lives to the fullest, and pursued their passions (personal and professional) with zeal.

Some time back, I blogged about “big impact” audits, those career milestones we look back on with the satisfaction of knowing that our work, and profession, made a significant difference. Whether it’s in internal auditing or in life in general, we all aspire to make a difference. We want that feeling of accomplishment that comes with knowing we have changed the world, if even in a small way. But internal auditing is especially rewarding when we can make a big impact — when we can bring about major changes that improve operations and prompt senior management and the board to sit up and take notice. 

No relationship for a chief audit executive (CAE) has been transformed more over the past decade than that with the audit committee. According to The IIA's Audit Executive Center, more than 75 percent of internal audit departments in North America report functionally to the audit committee. And in many companies, the audit committee holds a discussion session with the CAE at every meeting. 

One of the occasional criticisms of internal auditors is that we are not as innovative as some in other professions. There is a grain of truth to the “innovation-aversion syndrome,” as I will call it, but our profession has adopted a number of new technologies in the past 20 years that have permitted us to leverage key technologies. Today, for example, many internal audit functions leverage audit management systems, deploy systems for maintaining workpapers electronically, use data mining and analysis tools, and deliver our reports electronically with embedded hyperlinks for the readers’ use in perusing evidence or data in greater detail.

A couple of weeks ago, I responded to a U.S. Securities and Exchange Commission (SEC) request for input on a proposal that NASDAQ-listed companies have an internal audit function. This rule change, if adopted, would elevate internal auditing at NASDAQ-listed companies to a level on par with what is already required for companies listed on the New York Stock Exchange.

Every profession makes ethical behavior a cornerstone of accountability for its members. Internal auditors are no different, and we hold ourselves to a very high standard in this regard. This is exemplified by the International Professional Practices Framework (IPPF), which includes a well-defined code of ethics based on the principles of integrity, objectivity, confidentiality, and competency. As the code's introduction states, "a code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about governance, risk management, and control." 

Are you a good listener? Funny how “auditor,” a word that started out as something so desirable, has come (for some) to evoke fear and dread — like “dentist.” 

There are times when I look back at the history of our organization and I’m awestruck. Today is one of those days. I reflect with gratitude on the individuals who were instrumental in The IIA’s evolution, and I believe all of us are humbled by the everlasting impact they’ve made on the internal audit profession and The IIA. One person, in particular, headed the pack.

You’ve heard: “It’s not what you say, it’s how you say it.” Well, in internal auditing, I’d say it’s a combination of both. What we say in our audit reports most certainly matters. The reports must be clear, concise, and accurate. But it’s the way we communicate that will determine how our findings and recommendations are received — I call it “tone.”