Five Dilemmas Every Internal Auditor Will Face

Richard Chambers, CIA, CGAP, CCSA, CRMA, shares his personal reflections and insights on the internal audit profession.


As I have commented on numerous occasions, internal auditing can be a rewarding profession for those who enjoy making a difference in their organization. However, as with any profession, it is not without its challenges. New internal auditors often become frustrated when they are unable to generate an impact as quickly as they would like, or when things don’t go their way. During my career I have experienced the profession from numerous vantage points. As a young internal auditor directly out of college, I experienced the awe, excitement, and occasional frustrations that come with any new career. As I became more seasoned, the wide-eyed enthusiasm waned, but my passion for the work did not. Later, as a chief audit executive (CAE), I experienced new challenges, opportunities, and — yes — occasional frustrations.

Throughout my career I have mentored scores of new internal auditors as they sought to make their way in an unfamiliar profession. As I look back on my own experiences and those of the auditors I have coached, I have identified five dilemmas that often serve as an early source of frustration. I feel confident in saying that every internal auditor will experience them at some point. My advice following each dilemma is directed at new internal auditors or those experiencing the dilemma for the first time:

  1. How much to audit. This is an enduring challenge for internal auditors. There is always a temptation to audit more rather than less. Should you evaluate three years worth of data? Should you add two more objectives to the audit plan that you believe are really important? These would be easy questions to answer if it weren’t for two very important constraints: time and resources. In the end, my advice is to audit on the basis of risk. The preliminary risk assessment at the outset of an audit engagement will reveal the most significant risks. As an internal auditor, you must then exercise professional judgment when reconciling the risks with resource limitations and the amount of time an expansion of audit objectives will mandate.
  2. How much to communicate. Abraham Lincoln once apologized for writing a long letter, because (he observed) he didn’t have time to write a short one. This is equally true for internal auditors. The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards) are very flexible when providing direction on communicating results. Standard 2410 simply requires that communication of engagement results include “the engagement’s objectives and scope as well as applicable conclusions, recommendations, and action plans.” The temptation is always present to add a lot more than the minimum requirement. My advice to new auditors is to tell your story as crisply and succinctly as possible. Remember, the longer your report is, the less likely that it will be read in its entirety by those in senior management who are in the best position to implement the very corrective actions you are seeking to influence.
  3. How to respond when your report is edited. Report writing and editing are enduring sources of frustration for everyone in internal auditing. The first time one of your choice phrases or report narratives is eliminated or edited extensively by your supervisor or CAE may be frustrating or even disheartening. Don’t overreact. Seek to understand why the edits were made, and learn from the experience of those more seasoned than you. If you really feel strongly, then make your case rationally and without emotion. In the end, though, you will have to accept the decisions made by those who are ultimately accountable for the quality of the internal audit engagement.
  4. How to deliver a balanced message. As internal auditors, it is easy to fall into the trap of reporting only negative results. After all, that is what they pay us for — right? It is important to remember that we actually add value by providing assurance on the overall effectiveness of risk management, control, and governance processes. A balanced report that also indicates “satisfactory performance” where warranted is an important component in any internal audit report. We shouldn’t limit assurance to what isn’t working well. We should deliver a balanced and objective view.
  5. How to respond when management “pushes back.” As a new internal auditor, the first time management (or other operating officials) takes strong exception to your draft report or audit results is apt to be a significant emotional event. The temptation is always present to lash back or become intransigent. Neither of these will serve your long-term purpose well. I learned early in my career that these were the times when I most appreciated the calm and assistance of the more seasoned members of the internal audit team. In all likelihood, your supervisor or the CAE will have plenty of experience with contentious audit results and is likely to have the relationships with the audited officials — both of which are key ingredients to resolving any standoffs.

I am sure there are many other dilemmas that we face in the course of our careers as internal auditors. However, these are the ones I have found to be the most commonly encountered. I welcome your thoughts as well.


Posted on Apr 3, 2012 by Richard Chambers

Share This Article:    

  1. This is good commentary on the high level dilemmas auditors face.  I do believe there are some additional day to day dilemmas such as the following:

    • What to do when the scope begins to creep?
    • How to handle a non responsive client?
    • What to do when you suspect fraud? 
  1. Richard, this is great information for new auditors. We will definitely reference your article during our Entry Level Auditor Roundtable on June 20, 2012. Thanks

  1. I can relate to the third point (How to respond when your report is edited.)  I (as with most IA practitioners) have in many cases been subject to such reviews and it can get really frustrating.  In my role I get to compile reports for several managers, and all have different writting styles and vocabulary preferences.  Some require more detail and some less.  How does one manage this?

  1. @ Tuliswa

    What I have learnt is to write accordingly to who reviews my job. In fact, what is an excellent writing style for one manager may be seen as an awkward one for another manager.

  1. This is very nice. Those of us in government and international government (e,g. UN) often face dilemma # 5, especially when your role, like mine, as some sort of external audit look. For example, your agency gives grants to NGOs and you are required to verify their reports and assess risk and controls for release of grant mony. You might not just get responses from their managements, but also from people from within your own organization whom you expected to support your work.

    It's even more complicated if you suspect fraud. What do you do here if you the person in charge?


  1. These are all excellent comments and an encapsulation of what good internal auditing and its challenges are all about.

  1. Thanks Chamber for such insights.

    One of the major challenges we face in the third countries or rather developing countries is mainly the attitude of the auditeee, especially when the report that the auditor produces are required as attachment to quarterly reports to the audit committee. What many auditors have faced is that management do not want to hear anything that is negative been reported to the Board - whether very risky or of average risk. In some cases even the Board sides with the management.

    A certain auditor reported on a contract that was entered between her employer with an international firm. When external auditors noted such observation, it was picked as it was reported in the internal audit report and became part of observations of the external auditors -and this ultimately landed at the parliamentary committee. Instead of commending the auditor, the Board was unhappy with the auditor just as was the management. So in my view, the five points are actually hitting all auditors across the globe, except those who are collaborating or acting with fear.


  1.  For me the biggest challange is to keep your independence and objectivity especially when you are at the helm of running an in-house internal audit department. All of the above disussed problems contribut to aggreviate this . you have to keep others especially the auditees at a an appropriate level of interaction/cooperation, given that they know you will raise observations on their performance. 

  1. Interesting article. I have, personally, faced all 5 dilemmas in my Internal Audit journey. Mainly the type of intimidation a beginner is forced to tackle in the face of powerful management members. CEOs are, most of the time, intimidatingly highly qualified individuals that have more experience in their own field than you and your managers. The face-off with such individuals should not be assigned to beginners, but to the surprise of many, managers still assign junior staff for such. Yes, it is a great learning experience, but it may affect the quality of the assigned team in the eyes of senior management.

    If I were to add anything to the list, I would say, the fact that an auditor is exposed to different industries that may, possibly, not be related is a dilemma itself. Especially for beginners. When an auditor starts getting comfortable auditing in a specific industry, he/she may suddenly be transferred to a totally different project where the experience gained from the previous engagement does not add much value to the current one. Referring to my own personal experience, as a beginner, I was being regularly assigned to Hotel industry engagements, and with a sudden jump, I was assigned to work on a pension fund audit. However, now that I'm a senior, I can see the beauty in the experience gained from such a concept, keeping in mind that I would benefit mostly from this industry transfer ONLY if I had solid Internal Audit experience to work with, otherwise, for beginners, it may prove to be disastrous.


  1. Richard, Nice article. I specially like the 4th dilemma that you have pointed out. Majority of the IA reports that I have seen till date had reported only negative results. This point is definitely a take away for me.
  1. Good reading, for which I can relate to. I have had exposures to these dilemmas. But based on my experience these dilemmas are not to be dreaded but rather to be cherished as they have really helped in giving me a solid audit foundation.  I also observed  that an able and capable help of the CAE would minimise the  impact of these dilemmas on internal auditors. These dilemmas are acid tests for internal auditors, which are worth experiencing.  These tests once hurdled, are feathers on any internal auditor's cap.

  1. When I read the article, I realized that I'm not alone struggling to familiarized myself into audit. I just move from Revenue Assurance into Internal audit and found that IA offer wider scope of exploration for knowledge. Thanks for the article. I knew, somebody out there had similar problem that I had now.
  1. I would like to thank you for this article. It is very concise and does capture the main challenges that internal auditors face specifically at the entry level. I would add to the list maintaining independence and objectivity especially in small, somewhat intimate organisations.  Interestingly enough, even seasoned auditors could sometimes be faced with the challenge of deciding how much to audit and how to communicate it, especially in a dynamic environment. It is therefore, important to stay current on changes in the profession and continuous professional education.

  1. I have extensive IT and Risk management experince in working inside a financial client environment. I have been called in for a Audit manager Interview.  I have no experience in Executing Audit Engagement. How difficult would it be if I have to switch Audting career?

  1. I agree with all the five dilemma above. Just to share my experience as a new internal auditor on how to audit smart but not hard, firstly focus more on high risk areas, secondly focus on objective instead of controls and lastly focus on compliance. So, if these three areas had covered, it should be easy for us to audit smartly.

Leave a Reply