Effective internal auditing often involves going beyond the initial audit. Some practitioners may believe their obligations end after communicating findings in the audit report, but this approach generally proves insufficient. Internal audit recommendations have no value if management decides not to take action.
When audit findings are not acted upon, the most likely explanation is that management does not believe the risk justifies the cost or disruption the recommended actions would cause. It could also mean that management disagrees with the risk level expressed in the audit report or that it does not believe addressing the risk is a priority. Even worse, management's inaction may be a sign that it does not understand the report.
Each of these problems represents a failure of internal audit. Management may contribute to the problems, but internal audit bears ultimate responsibility--the client's failure to act reflects internal audit's inability to sell its findings and persuade management to make timely changes. Internal auditors need to convince managers that action is necessary, appropriate, and in some cases, urgently required.
The effective internal audit department not only helps drive constructive change, but it has a reputation for ideas that will help the organization succeed. In that sense, internal auditors are evangelists for running the business better.
Audit practitioners can add considerable value to the business if they are willing to work with management to effect worthwhile change. Two examples from my own career illustrate how auditors can serve in this capacity and help evangelize for organizational improvement.
When I was the head of internal audit at a large U.S. domestic oil refining and marketing company, one of the firm's local refineries consistently gave both the auditors and senior management headaches, even while we smiled at its earnings. The refinery's operations were complex and difficult to manage. Even though management paid great attention to equipment maintenance, employee safety was a critical concern--the facility experienced occasional fires, as well as an explosion that cost several lives. Compliance with federal and state environmental laws and regulations also proved challenging.
Because of the high risk level, internal audit maintained a team resident within the refinery, led by an experienced audit director. The team issued several reports each year identifying significant issues relating to the quality...