Internal audit departments are trying to find the right balance between meeting their
compliance responsibilities and accomplishing their business improvement duties.
Unfortunately, management and the audit committee persist in the perception that internal
audit tips the scales much more to the compliance side; they don’t expect internal audit
to play a role in developing and executing the organization’s strategic vision.
This perception isn’t necessarily misplaced. Over the past decade or so, in the wake
of the Sarbanes-Oxley Act of 2002 (SOX), internal audit has concentrated largely on
financial controls. This focus has resulted in a narrower competency, one that doesn’t
fully satisfy most organizations’ current needs. In the 1980s and 1990s, internal audit
departments primarily served as a business-operational, value-added consultative
function for their organizations. The regulatory explosion following the financial crisis
and recession of 2007-2009, however, provoked a dramatic shift as internal audit
was directed to focus mostly on financial controls and less on being a leader in the
organization. Internal audit departments understandably hired staff members armed
with formidable accounting and financial skills but little knowledge of the broader
spectrum of business management and value.