Internal audit's professionalization is largely the result of codified activities. Established, credible paraphernalia of professional practice, including comprehensive standards, practical guidance, rigorous certification requirements, and a code of ethics, form the foundation of internal auditing. Steadily increasing public recognition and respect for internal auditing surely exists in part due to this robust structure. Nonetheless, as the profession continues to mature, we have reason to be cautious. Once a critical mass of standards and advisory material has been reached--and it may perhaps already have been reached--we should pause to avoid being stifled by instructions, bureaucracy, and over-codification.
To a large extent, unspoken assumptions bind internal audit professionals together in their common endeavors. Arguably, a large part of a profession's wisdom arises from experience and knowledge that are too deep to be articulated. Codified guidance cannot capture the full range of professional activity that involves wisdom and sensitivity.
Explicit instructions and bureaucratic literalism can create the illusion that what really matters in professional activity can be captured entirely in written form. Moreover, it implies that professional practice must be based solely on this established guidance. The distinguishing features of many professions--a physician's bedside manner, an architect's aesthetic sensitivity, and the acerbic rhetoric of a courtroom lawyer--cannot be codified in rational blueprints.
We may distinguish for our purposes among three types of knowledge: knowledge that, knowledge how, and knowledge what. The auditor may know that a procurement process aims at an optimal decision on expenditure...