The cost of not having an internal
audit activity is relatively well recognized and understood by most corporations and investors.
However, the cost of having a bad one may not be so obvious and understood by
some!
But, what is the definition of bad
as it relates to this post? I am sure the first thing that jumps to
your mind is the “value adding” theme! Others may add “inefficient”, “ineffective”,
“irrelevant”, "weak”, “stagnant” and “stress creating” to the list! The
list can go on and on depending on who is providing the input!
Regardless of the definition, the cost of
having a “bad” internal audit activity may include:
- Damage to the reputation of the
Internal Audit profession as a whole!
- Damage to the credibility of
management and the Audit Committee at the concerned organization.
- Loss of the public and
investors’ trust in the organization.
- Management not getting relevant
and timely information to help make the right decisions. Or worse, getting wrong
information resulting in major problems!
- Management and other
stakeholders getting false sense of security.
- Major risks go unidentified,
undetected or underestimated.
- Waste of time, resources and
money!
- Loss of opportunity for real
improvement of operations.
- Distraction and loss of focus
on real issues.
- Disruption of business and
processes.
- Negative impact on other
assurance and compliance functions.
Sadly,the above is not a comprehensive
list! Can you suggest more items to it?
You may have noticed that some of the costs listed above are also applicable to situations where internal audit activities do not exist at all! Based on that and If you have to choose between having a bad internal audit activity (on the basis that something is better than nothing!) or not having one at all, which would be your choice?
You may have noticed that some of the costs listed above are also applicable to situations where internal audit activities do not exist at all! Based on that and If you have to choose between having a bad internal audit activity (on the basis that something is better than nothing!) or not having one at all, which would be your choice?
The first step in “fixing” a bad
internal audit activity is by admitting that there is a problem, then having the
courage to seek help!
These are my thoughts,please share yours!
.png)
.png)
.png)