A Vigilant Internal Audit Program

A company must implement a vigilant internal audit program. This is the view of Michael Volkov, a seasoned internal auditor.

We all know colleagues who love to complain but do nothing about the problems they complain about. Eventually, a complainer loses value in a company and they end up having little influence.

I know that a dysfunctional internal audit function is not always the internal auditor’s fault. In many cases, it is a failure of corporate leaders to support a vigilant internal audit function.

If a company is unwilling to promote a vigilant internal audit function to identify weaknesses in its internal controls, you can be sure that the company has a weak ethics and compliance program.  It most likely also has an equally weak whistleblower culture for encouraging employees to raise concerns.

An ineffective internal audit program carries huge risks.  The absence of an effective audit function undermines the integrity of the company’s financial reports. A compliance officer cannot operate in this environment. A weak financial system means that there will be even less commitment and interest in ethics and compliance.

The telltale signs of an ineffective internal audit function:

A lack of resources means an inability to provide minimum coverage of financial risks unless management supplements internal audit operations with outside assistance.

If internal audit findings are treated as “suggestions” and nothing more, the absence of authority undermines the independence and integrity of the internal audit function.

A lack of a specific timetable being established for remedying a deficiency and if the responsible manager does not verify the remediation by the deadline, the internal auditor notifies senior management. This is a critical requirement. An internal auditor with authority is a valuable player in the corporate governance landscape.

 An internal auditor is neutralised through a slow and ongoing process of delay, obfuscation and suppression.

Bit-by-bit, a picture of neglect may emerge. Sometimes it can be explained by the quality of the internal auditor himself or herself and/or the quality of the audit reports. Other times, the internal auditor may be off-target in his or her audit schedules and priorities.

The internal audit function must however never be allowed to become a “paper pushing” program.