A fundamental if unsettling truth about internal auditors: We do not audit success. Yes, I know this is likely a gross oversimplification. And I know it isn't true of your internal audit department. But my discussions with audit professionals and personal experiences in the field show few if any exceptions to the rule. And I am willing to bet that, if you look back over the last year/two years/five years or however many number of years you want to review, there will be no evidence that it even crossed your mind to include as an important risk the fact that a process, department, or business unit was doing too well.
This topic came up during a recent conversation I had with an individual whose company had just moved into a new building. He mentioned the move had been delayed because the company discovered the new facility's plumbing was clogged with needles.
It seems the previous owners had been involved in manufacturing medical supplies. It also seems that high quality standards had been established for the hypodermic needles they produced. (As a frequenter of doctors' offices, I am not unhappy to hear that such standards were required.) Finally, it seems that, because employees were unable to meet those standards, they took the substandard products and disposed of them in sinks, toilets, and any other fixture available for quick removal of the offending items. Presumably they were trying to get rid of the inferior products discreetly and avoid falling short of the established quality standard.
I must point out that I am not making this up; I'm merely reporting what I have been...