Five Classic Myths About Internal Auditing

Richard Chambers, CIA, CGAP, CCSA, CRMA, shares his personal reflections and insights on the internal audit profession.

 

Myths can tell us a lot about ourselves — or at the least, about how others see the world. But at times it seems that the most inaccurate myths are the most difficult to dispel, particularly if there is a grain of truth buried at the origins of the myth.

The modern internal audit profession has been around for less than 100 years. Yet it is amazing how many myths and misperceptions have evolved about the profession in such a relatively short period of time. And while each of the following myths is generally untrue, the fact that these myths are so enduring might be an indicator that each of us needs to take stock of how we are perceived in our own organizations. Do we do things to reinforce these myths? Or, do we need to do a better job of creating awareness of how the profession has changed? You be the judge.

Myth #1:
Internal auditors are accountants by training.

One of the most common misperceptions about internal auditing is that the auditors are all “bean counters” who focus solely on their companies’ financial records. There is an obvious grain of truth in this internal audit myth: A solid audit or accounting background can be helpful for a career in internal audit. But internal auditors commonly address fraud risks, compliance issues, and a myriad of operational issues that are unrelated to accounting, and the auditors’ backgrounds are likely to be as diverse as the operations they audit. An accounting degree is not the only path for career success, and these days it’s not even the most common path: A recent survey by The IIA’s Audit Executive Center indicates that audit executives are now recruiting job applicants with analytical/critical thinking ability, data mining skills, business acumen, and IT skills more often than they seek applicants with accounting training.

Myth #2:
Auditors are nit-pickers and fault-finders.

At the heart of several jokes about internal auditors is the misperception that we are dead set on picking apart processes and ruining the reputations of the people who do the “real work.” According to the myth, the auditors are viewed as the group who “bayonets the wounded after the battle is over,” distracting management from more important responsibilities.

In reality, of course, internal audit’s focus is on major risks rather than on nit-picking details. Audit resources are limited, and when auditors focus too much attention on minor issues, they are limiting the time available for addressing the major risks and controls that are at the heart of internal audit. Any auditor would rather report on a $6 million cost savings than on a $6 error!

Myth #3:
It’s best not to tell the auditors anything unless they specifically ask.

This myth can be actively damaging, so it is unfortunate the advice has made its way into more than one “How to Survive an Audit” article. Audit clients are sometimes given this advice by well-meaning friends, but it results in less efficient audits and wastes everyone’s time. If auditors believe their clients are purposefully hiding information, whether by omission or commission, they normally will increase the scope of the audit to determine whether other important information has gone unreported. The purpose of internal auditing is to add value and improve an organization’s operations, and hiding information is against everyone’s best interests.

Myth #4:
Internal auditors follow a cycle in selecting their audit “targets” and use standard checklists so they can audit the same things the same way each time.

This myth is less true with each passing year. Our professional standards require risk-based plans to determine our priorities, both in developing audit plans and schedules and in planning individual audits. Obviously some risks justify repeat audits on a regular basis, and there are some types of audits — for example, certain compliance reviews required by regulators — where audit programs and checklists are unlikely to see major changes from year to year. But in general, internal auditing has become a dynamic profession that can change any time an organization’s risks change.

Myth #5:
Internal audit is the corporate “police function.”

As Lord Justice Topes once said, “The auditor is a watchdog and not a bloodhound.” In my experience, the best auditors are almost always those who create a rapport with audit customers. When an auditor’s behavior is accusing or aggressive, they are far more likely to be met with resistance than when they treat findings as an opportunity to help accomplish objectives and facilitate improvement. Breaking down this stereotype is so important that most internal audit groups actively encourage clients to think of internal audit as a coach, not a cop.

Each of these myths was closer to reality in the 20th century than today. It’s easy to think of a few specific examples where an action that reinforces these stereotypes might be justified — but unfortunately, there are too many cases in which auditors are needlessly perpetuating the myths. Are any of the classic myths true about you or your internal audit group? If so, it might be time to take a good look at what you are trying to accomplish and how you plan to reach your goals.

Changing perceptions takes time, and it often requires the combined effort of many individuals to break down a stereotype. Our profession's image is rapidly improving, but more work is needed to enhance our stakeholders’ understanding of the profession. Each of us can help to re-shape these myths and misperceptions, whether through small steps such as passing pertinent news information along to clients, or through larger contributions like sharing audit knowledge at a seminar or conference.

Each audit group is unique, and your perspective on these audit myths might be different from mine. Has your internal audit department recently made changes in any of the areas discussed above? If so, please let us know how it worked for you.

 

Posted on Jun 20, 2012 by Richard Chambers

Share This Article:    

  1. Thanks Richard

    I shall circulate a print copy of this to educate other departments in accepting new face of Internal Auditor.

    While efforts are always towards improving value to the Company and the Society, the audit scope sometimes acts as limiting factor. As you rightly said ."Changing perceptions takes time". Let us try.

    Thanks again

  1. Richard,

    Great article!

    These myths definitely have a life of their own, but I can defintiely see the progress within my own company in overcoming them.  As you mentioned, building rapport with your stakeholders is crtical.  Addtionally, you need to develop an audit function that fits the company culture to truly add value.  When your stakeholders start to proactively seek you advice and input you know that you are suceeding.

  1. Unfortunately that's the real picture. Most organizations treats auditors as a policeman, instead of professionals who supports and solve problems in the organization. The real question is: What we are doing to change such myths and whether we also don't provoke such perceptions? Richard,thanks for the precise shot in the heart of the problem.
  1. I would like to contribute to sensitising the public on the professional responsibilities, authority and functions of an internal auditors.

  1. Richard,

    Excellent post.  Auditing is a tough job.  Over the years the profession has changed drastically.  We are (or should be) partners with our business clients.  This is a big change from say 30 years ago.  The myths your present are relevant, but how do we overcome them.  I have written an article based on yours with some techniques to overcome the 5 myths (http://www.thatauditguy.com/overcoming-the-5-classic-myths-about-internal-auditing/). 

  1. I've seen more resistance towards external auditors than internal auditors. Internal auditors are viewed more as partners, where as external auditors are more independent and not really involved with the company. Internal audit's budget is part of the company's entire budget. When I worked in external audit, I faced much more resistance. However, now that I'm in internal audit, I do not face much hostility. I would also think that external auditors who are funded independently face even more resistance. They have no concern whether the relationship sours in the future.
  1.  I have been an auditor for thirty-five years and an Internal Auditor for thirty. The same stereotypes haunt the profession today as haunted it when I began.  I combated them through a very successful career as an Internal Audit Director by making myself as valuable a member of the management team as possible and never playing gotcha games.  It took many years but I succeeded in making my Division a place where management at all levels of the organization could turn to get reviews and internal audits that really added value and made the organization a better and more well run place to work.  I never stood still, selling our service to all who would listen, innovating at every turn and applying tools like risk assessments, analytics and data mining to our work, auditing on as concurrent a basis as possible.  

    I can honestly say that none of the stereotypes listed in this excellent article were ever applied to me and my staff to our detriment, or, if they were, were quickly dissipated under the influence of our approach.

  1. Thanks Richard, A great article that typically reflects reality!

    I feel sorry when I know that someone could be tagging the whole IA profession with these attributes although they can be partly right for few practitioners. I personally believe these myths represent a common de-facto perception among business owners towards auditors. This is why we need sometimes to double our efforts to change that perception.

    Based on my experience in this field, I am almost certain that views could change with time provided that we communicate using the right approach and then be able to deliver the expected value to management. It is all about the communication experience of the auditees and management with the internal audit. I think that building a trustable and pleasant relationship with management will never impair our mission and cause of existence; on the contrary, it will enhance their acceptance of our work and synergies our efforts, which will be of great value to all!

Leave a Reply