When I hear jokes about internal auditors, usually I can just laugh and blow it off. After all, there are plenty of jokes about doctors and lawyers and pointy-headed bosses, so why shouldn’t jokes be told about us? I attend quite a few audit conferences, and I’m used to the occasional joke about how internal auditors are heartless, or how we have dry personalities, or even how (dare I say it?) we "get in the way" when people are trying to do “productive” work. Once in a while, though, a joke strikes a little too close to home. 

I had an incredible experience today while preparing to unveil The IIA’s new Hall of Presidents. I was reflecting on the contributions made by The Institute’s past presidents, and it was literally overwhelming to realize just how much difference these eight individuals have made on internal auditing since Bradford Cadmus was appointed the first full-time managing director in 1947.

In my last blog post I discussed how often CAEs of small audit shops lament about the challenges of working with limited resources, and I expanded on three of six strategies I recommend for generating a “big impact” with a small staff. I’ve talked about the impact you can make by following the risk, leveraging the resources you do have, and benchmarking your success. But there are three more strategies that I’ve found can mean the difference between just another audit and making a lasting difference for the organization and a lasting impression on your stakeholders.

I often hear chief audit executives (CAEs) of small audit shops lament about the challenges of working with limited resources. In a way, I can sympathize. For most of my career, I worked in or led small audit shops. In fact, the first three years that I served as a CAE, I only had three or four full-time internal auditors on my staff. As my career progressed, however, I eventually found myself leading mammoth audit staffs of several hundred auditors. While it was nice to have all those resources to dedicate to the complex high-risk areas of the organization, I never felt quite as proud of our ability to generate “big-impact” audit results as I did with those smaller shops. In my last blog post, I discussed defining big-impact audits. But you may ask, “can we make a big impact with limited resources?”

Whether it’s in internal auditing or in life in general, we all aspire to make a difference. We want that feeling of accomplishment that comes with knowing we have changed the world, if even in a small way. But internal auditing is especially rewarding when we can make a big impact — when we bring about major changes that improve operations and cause senior management and the board to sit up and take notice.

There is no doubt that when it comes to risk, the internal audit profession is maturing. A few years ago, annual risk assessments were considered a leading practice but were not even required under our professional standards. Today, documented risk assessments are mandated at least annually. Many audit executives see a need for more frequent assessments, and a growing number of executives are shifting toward a continuous risk assessment model. We are spending more and more time and resources assessing risk — but unless there is a shared vision on risk appetite within the enterprise, the full benefit of any risk assessment is unlikely to be realized.

Mary Poppins had it right: Impossible things are happening every day. Or at the least, extremely improbable things are happening all around us. In these uncertain times, the unexpected has become the status quo, and we go through our days knowing that the next super-catastrophe might be just around the corner. We’re not just dealing with fires and floods — we’re at risk from terrorism, pandemic disease, mega-earthquakes, tsunamis, super-sized volcanic eruptions, or perhaps the decade’s largest industrial accident, just to name a few.

I enjoy working with new auditors, in part because they so often see the world in terms of clear black-and-white issues. “Should we do an audit?” “Should we issue a finding?” “Am I maintaining a healthy degree of professional skepticism?” For many new auditors, each yes-or-no question points unerringly to a single correct answer. 

The global financial crisis has played out over the past two years like a “slow motion” train wreck. Following the spectacular implosions of iconic financial services organizations in 2008, dominoes have continued to fall in predictable order. As the world slid deeper into financial crisis, the plight of the world’s governments was frightening. Tax and other revenues plummeted while the demands for social and related services rose. The results have been spiraling deficits and crushing levels of debt.

The iconic Larry Sawyer once observed that “few sources of friction within the audit department exceed that caused by the process of report writing.” Sawyer went on to correctly observe, “The most brilliant of analyses and the most productive of audit findings seem to be forgotten during the trauma of report writing.” In my view, these are some of the wisest comments Sawyer (or any other practitioner or academic) ever uttered about internal auditing.