Whether it’s in internal auditing or in life in general, we all aspire to make a difference. We want that feeling of accomplishment that comes with knowing we have changed the world, if even in a small way. But internal auditing is especially rewarding when we can make a big impact — when we bring about major changes that improve operations and cause senior management and the board to sit up and take notice.

There is no doubt that when it comes to risk, the internal audit profession is maturing. A few years ago, annual risk assessments were considered a leading practice but were not even required under our professional standards. Today, documented risk assessments are mandated at least annually. Many audit executives see a need for more frequent assessments, and a growing number of executives are shifting toward a continuous risk assessment model. We are spending more and more time and resources assessing risk — but unless there is a shared vision on risk appetite within the enterprise, the full benefit of any risk assessment is unlikely to be realized.

Mary Poppins had it right: Impossible things are happening every day. Or at the least, extremely improbable things are happening all around us. In these uncertain times, the unexpected has become the status quo, and we go through our days knowing that the next super-catastrophe might be just around the corner. We’re not just dealing with fires and floods — we’re at risk from terrorism, pandemic disease, mega-earthquakes, tsunamis, super-sized volcanic eruptions, or perhaps the decade’s largest industrial accident, just to name a few.

I enjoy working with new auditors, in part because they so often see the world in terms of clear black-and-white issues. “Should we do an audit?” “Should we issue a finding?” “Am I maintaining a healthy degree of professional skepticism?” For many new auditors, each yes-or-no question points unerringly to a single correct answer. 

The global financial crisis has played out over the past two years like a “slow motion” train wreck. Following the spectacular implosions of iconic financial services organizations in 2008, dominoes have continued to fall in predictable order. As the world slid deeper into financial crisis, the plight of the world’s governments was frightening. Tax and other revenues plummeted while the demands for social and related services rose. The results have been spiraling deficits and crushing levels of debt.

The iconic Larry Sawyer once observed that “few sources of friction within the audit department exceed that caused by the process of report writing.” Sawyer went on to correctly observe, “The most brilliant of analyses and the most productive of audit findings seem to be forgotten during the trauma of report writing.” In my view, these are some of the wisest comments Sawyer (or any other practitioner or academic) ever uttered about internal auditing.

Over the past two years, I have heard executives complaining with increasing frequency that “internal auditors just don’t understand the business.” My sense is that some of these complaints are legitimate while others originate from business unit managers who simply don’t want internal auditors probing around in their areas of operation.

In my last blog entry, I explored the concept of internal auditing’s stakeholders and who I thought they were. I identified the primary stakeholders of a typical corporate internal audit function as:

In my last blog entry, I cited some emerging challenges and identified five key priorities that chief audit executives (CAEs) should be pursuing as 2011 gets underway.

The past three years have been both remarkable and challenging for internal auditors. We have demonstrated remarkable agility in swiftly refocusing our efforts to address emerging risks in the wake of the global financial crisis. While resources have been reduced commensurate with corporate downsizing, the glass is arguably very much “half full.” As we move into 2011 and beyond, however, it will become imperative to “fill the glass.” Many internal audit stakeholders are once again growing restless in terms of internal auditing’s knowledge of the business, efficiency, and overall “value proposition.”