Another issue that I get annoyed with (what is the purpose of internal audit?) all started with the old discussion over whether internal auditors should make recommendations or agree management actions.
There are those that believe strongly that audit should make recommendations and those, like myself, that feel we should agree management actions.
Internal audit struggle enough trying to get management to take action without trying to impose 'audit' recommendations on to management. Management need to take ownership of the issues and do something about them. Management are also the experts (or should be) in their area, they will know things that Internal Audit may never be made aware of and are therefore in the best position to decide appropriate action. Audit may need to offer guidance, suggestions, etc and will need to ensure that they are satisfied that agreed management actions will resolve the issue. Rather than audit focussing on making recommendations, efforts should be put into getting management to clearly understand the issue that has been found and getting their consensus that it is an issue and what risks they, as management, face. Once management understand and accept the issue there should be no problem in coming up with an agreed management action. Management will clearly understand what is wrong and will know they need to do something to put it right.
So from that point of view I get rather annoyed when told the purpose of internal audit is to make recommendations. No, no, no! The purpose of internal audit is NOT to make recommendations, the purpose of internal audit is to instigate change!
Do you agree or not?
Yours annoyed
Blogging Auditor
Instigate change? No, I'd say it's more to determine whether the organization is meeting its objectives. To wave flags. To raise risk issues.
ReplyDeleteI disagree. Audit makes recommendations based on whether the organization is meeting management's stated goals. Audit might also note that it thinks management has the wrong goals.
But in the end (and in the beginning), Management makes the decisions and instigates the changes, not Audit.
Good luck with your blog. You don't need readers who agree with you, just readers who keep coming back. :)
Not so sure I agree with you. I've always viewed audit's job as to identify risk and inefficiencies. Management's job is to manage risk and whether they want to implement more efficient processes. Sometime the risks and inefficiencies aren't worth remediating, and that's management's job to determine that.
ReplyDeleteHowever, if audit believe management is ignoring some items, audit takes that to the audit committee, which then deals with management.