Expanding our assurance.(IN MY OPINION)

IT IS UNLIKELY THAT INTERNAL AUDITORS ARE TO BLAME FOR THE CURrent economic crisis. By all existing definitions, internal audit departments in financial institutions worldwide--those at the heart of the storm--were effective at providing assurance. So why did so many organizations suffer apparent I risk and control failures ultimately resulting in economic disaster? The failures occurred primarily because few people, including internal auditors, had sufficient foresight to recognize a fundamental shift in the nature of risk--an evolution from the combined impact of multiple idiosyncratic risks to genuinely systemic risks. With this knowledge, internal auditors can now take steps to help prevent the same adversity from striking again. We need to recognize the new risk landscape and make the necessary changes to internal auditing's processes, scope, and role.

[ILLUSTRATION OMITTED]

Huge advances in IT have enabled globalization of markets, but without any real global structure. The system works and thrives on multiple codependencies among many parts that have not been put together in any ordered manner. In fact, most of the parts do not even realize that such dependencies exist until something goes wrong. These dynamics characterize the pernicious nature of systemic risk.

Still, internal auditors are not guilty of negligence by failing to opine on systemic risks effectively. Internal audit assurance focuses on assessing the risks within individual organizations, not cross-organization risk. But now auditors should expand their focus. Internal auditing recently evolved from providing individual departmental assurance to enterprisewide assurance. Now auditors must broaden their contribution still further to external systemic-level assurance, or at least assurance that organizations really do understand all their risks--including the systemic ones--and have taken appropriate actions to mitigate them.

Beyond globalization, a common theme of organizational failure has been lack of behavioral integrity. A new and forward-thinking approach to assurance on ethics, behavior, and culture must be developed to address this shortcoming. It may not involve trapping a cast of dastardly villains with lie detectors, but effective behavioral and cultural assurance has been missing from internal audit practice to date. Neglecting to enact meaningful change now could lead to additional failure in the future.

Systemic risk, behavioral risk, and supply chain risk represent areas where the assurance landscape has changed. Internal auditors must recognize and respond to these seismic shifts now if we are to benefit from the lessons we have learned. Forward-thinking, strategically inclined audit practice can significantly Strengthen the cornerstone of governance that internal auditing has rightly become, but only with the cooperation of the profession at large.

To comment on this essay, e-mail the author at simon.darcy@theiia.org. The opinions expressed are solely those of the author.

Print Get the Mag Weekly Updates