Getting Up to Speed
Thank you for your great "Back to Basics" department. I have nearly a decade of public accounting audit experience but stepped into the internal audit world just over a year ago. While there is a lot of overlap between internal and external auditing, there is still a lot to learn. The department, especially August 2019's "Expand Your Role in Internal Audit," is a great resource to get me up to speed.
I agree culture is really important, and it's good to contribute, but I'm concerned where you are taking this for internal auditors who are new to this area. It would be easy to do work here and be detached from The IIA's International Standards for the Professional Practice of Internal Auditing. What is the key risk concerning culture/behavior that you are looking at? Who is managing the risk of problems in lines one and two and with what metrics? By what criteria is internal audit going to judge management's approach? What insight is internal audit planning to give?
I continue to fear false assurance by internal audit teams in this area by thinking culture is a thing that can be measured and managed and, quite possibly, missing a subculture problem or a behavioral/political problem concerning a key risk (especially beyond compliance).
STEVE LOFLIN comments on Alex Rusate's "Expand Your Role in Internal Audit" ("Back to Basics," August...