Hi Norman,

You have the first critical task of internal auditing covered fairly well but you overlooked the other four.  And you completely discounted the definition of internal auditing that states auditing provides two services (assurance and consulting).  Are you suggesting that the "red-i book" (it is international now) be edited down to fit the <b>"World according to Norman"</b>?

How valuable is an internal audting function that places a low priority on: integrity & reliability of information in operational & financial systems; safe guarding of assets; compliance with laws & regulations; and, effectiveness & efficiency of operations & processes?

PS: I will leave the parenting advise alone as on the east coast, we have issues with duct tape and pythons as pets.

best regards,

Sparks

If this is controversial, then the profession needed the reminder.  The concept of "value-add" is (too often) limited to only that value that can be monetized.  There is value in identifying cost savings.  But if Internal Audit focuses only on this, they become another profit center, and stray from their core mission.  There IS value in assurance, as Norman describes with the "lightning at night" analogy.  There is value in identifying improvement opportunities, mis-aligment of business processes or operations with an organization's strategic objectives, and many other areas where Internal Audit's skill sets and rigor can be applied.  This is a good reminder that we could do a better job of packaging and communicating that value.

Norm and everyone else:

You can provide assurance and provide value to the organization. They should not be mutually-exclusive and need not be. As you know, the Internal Audit function serves two masters (1) Management and (2) the Internal Audit profession. And I remember well how these two masters are not always equally served. By definition, there is going to be conflict. The argument is as old as dirt. The expense of Internal Audit vs. the benefit. In the olden days (when Authur Andersen was still the largest auditing firm on the planet and Enron was just some energy company in Houston) the issue was less clear cut. Now it has become more so. But "providing value" is certainly defined by the organizations management and board. There is no reason why Internal Auditing cannot add value (in monetary terms) and provide some measure of assurance service.

I am thoroughly heartened by the comments, which all confirm the great value of assurance. Thanks to all.

Sparks, my good friend, I suspect you and I may see things a little differently.

1. I agree that the definition says assurance and consulting, and I support consulting where it contributes to peace of mind - i.e., recommendations as part of assurance services. Other consulting activities are OK only if assurance services are fully resourced first.
2. With respect to "integrity & reliability of information in operational & financial systems; safe guarding of assets; compliance with laws & regulations; and, effectiveness & efficiency of operations & processes", these are the areas that internal controls target. But internal controls should not be considered in isolation, only as responses to risks (or treatments of risk). I prefer to provide assurance on the more significant risks, and that means only assessing the controls (whether relating to compliance, integrity, or other) relied on to manage those risks.

Norman, thanks for the insite for the group as I do believe I see where you are coming from.  However, hanging at the 30,000 foot view of auditing critical tasks and priorities is easy.  It is when you zoom in to the tree top level that you realize not all auditing functions (and auditors) see issues the same way.  I suspect many would challenge the "Five Critical Tasks" as I have extracted from the redbook.

I still encounter internal auditing functions with a strategic mission to integrate other priorities as stated in the redbook, and pull away from a mere "compliance" group.

best regards,

Sparks

I think this is an important topic; but I agree with comments that value adding IA work should not be regarded as mutually exclusive from risk based work.

I believe IA should be seeking to meet its assurance obligations in a value adding way: After all if we assure a minor issue where there is a control question that will - arguably - add less value than assuring a key risk area where there is uncertainty; so even in relation to assurance some of what we do adds more value than other work (for example - does it really add that much value to audit an area where there is a known problem?)

Central to this is what we do to validate what adds value - our own views of whats adding value or something that we have cross-checked with our key stakeholders?

The lean concept of Kano is worth looking up. This approach also provides a powerful way of determining the assurance / advisory balance that so many struggle with - see link attached for more on Lean auditing. 

I concur with the significant value from risk-based assurance work. The point is that some projects that are focused on value-adde (such as those listed) rather than on top-rated risks consume resources at the cost of providing assurance on major risks.

For example, why do departments provide fraud detection, duplicate payment, and/or healthcare audit services but (a) do not provide an overall opinion on governance, risk management, and related controls, or (b) do not audit these areas?

- risk management across the organization

- the provision of timely, reliable, current, and useful information for making decisions

- governance processes, such as the performance of the external auditor or the provision of information to the board

Norman,

Your last point is the one I have been struggling with the most recently.  It seems to me the Truth of what we do is to call out what may prevent us from achieving strategy.  Strategy set by the governing by body, decisions made by management, risks that eventually become issues. 

At the end of the day two items continue to pop up for me communication and leadership.  Are you willing to tell the truth about what you see?  Are you willing to hold  folks accountable for telling the truth and getting the results we all agreed upon?  If you can't see clear evidence at the top through governance processes, your chances of be able to provide assurance, whether through audit or any other activity, is limited. 

If the governing body isn't willing to tow the line and hold the mirror with a steady hand value is an irrelevant subject.

Hi Everyone,