For many years, I taught accounting courses during the evenings at a local university. I would often tell my students, “The only stupid question is the one that is never asked — unless the question is, 'Would you postpone the next exam?'” 

Ensuring strong and effective oversight of internal audit departments has always been challenging. After all, organizational independence is critical for internal audit functions, so simply reporting to senior management may not support the strongest governance. In fact, the vast majority of internal audit functions achieve a higher degree of organizational independence, at least in part, by reporting functionally to an audit committee. This relationship is usually ideal for enhancing independence, but reporting functionally to an audit committee that meets only a few days each year can create challenges not faced by other departments within the organization. 

Back in 2009, I blogged on the fact that many audit committees expected internal audit to help them avoid surprises. I concluded that whether it was fair or not, it was an expectation we needed to recognize. Since then, risks have become more dynamic and unpredictable. Given the environment in which new risks emerge from seemingly nowhere, it shouldn’t surprise us that “no surprises” is still an expectation.