Audit Professionals April 9, 2017
Posted by Audit Monkey in The Joy & Pain of Internal Audit.Tags: internal audit
trackback
As my limited pool of readers know, I’m not keen to blog these days but I will make an exception. In part, this is a response to ITAudit Security’s leg pull regarding my criticism of Internal Auditors being unprofessional.
I’ve been parachuted in to improve the Internal Audit Function at an organisation. The previous Auditor(s) were asked to leave due to ‘concerns’. Being typically British, it was slightly ambigious as to what those concerns were but once I had a look at the Audit Files, the reports and the folders on the network, it all become clear but I could have guessed.
The reports were verbose and had little substance; the files on the computer network were a mess and had no logical train of thought. As for the Audit Files, I had a brief look but I could tell immediately they had been overdocumenting. It was clear that the Auditors didn’t really understand the subject matter as the focus was on trival items rather than the substantive ones.
So what is my point? Poor work gets Auditors a bad name. It makes the profession look unprofessional when it really needs to up its game and prove to all the dissenters (me included!) that we can add that elusive value and aren’t a bunch of numpties.
Audit Monkey's Blog 
I think this is a common IA problem. Too much time focused internally on work that our stakeholders never see, not enough on the problems that should demand our attention.
Too true but every time I’ve said to a Head of Audit, too much time is spent on report writing, and multiple iterations, the comeback is this the only thing Management see so it has to be good, whereas my view is get the darn thing written and out the door.
And seldom read
Audit Monkey,
I am unclear what we disagree on. When internal auditors (or those pretending to be such) do poor work and don’t follow the appropriate audit (and IT standards), they are unprofessional. I agree wholeheartedly.
However, if you will recall from any certification exams (and from real life), management is always to blame for poor performance. In the case we are debating (my blog post in which I noted how you can get an IT audit job with little or no experience), I insisted that new, inexperienced, lazy, or just plan stupid auditors should be under what the IIA calls ‘audit supervision’.
(Train up a child in the way he should go, and when he is old, he will not depart from it. Hopefully)
In other words, audit leads/managers/directors/CAE should be supervising, reviewing, and improving the work of IT auditors, whether they are experienced or not. Audit management is responsible for the work of their auditors.
If they shirk their duty, then the management over internal audit (administrative and ultimately the audit committee) is next in line for the responsibility.
I am not absolving the stupidity and laziness of some auditors.They are responsible to follow standards and use common sense, and learn a heap of a lot of info quickly and apply it appropriately.
But management is responsible, as that is what they are paid the big bucks for.
Now, given the explosion of technology and how it touches almost everything a business does, Hence the need for massive amounts of good IT auditors.
As I like to remind you, my dear monkey, you were once new to bananas and needed to learn the ropes (you haven’t denied that yet!). While some people need more beatings and coaching than others, we all learn on the job to a great extent, as we know school and classes do not prepare you for the real world. Those ivory tower wizards only know so much, and usually they have little idea how to apply what they know to the business world.
I just don’t see any difference between auditors and their management’s failure to ensure good work and highway construction crews, or any other profession. All need some kind of supervision and when that doesn’t happen, then the lawyers bring them back to their senses.
I don’t see internal audit any differently. We like to think we’re the gatekeepers of all efficiency, monetary integrity, and the like, we’re just another cog in the wheel. We also resist eating our own dog food while insisting everyone else take seconds.
[…] Monkey’s blog is here: https://auditmonkey.wordpress.com/2017/04/09/audit-professionals/ […]