Building an Effective Internal IT Audit Function
(While this topic is written from an internal auditor's perspective, the concepts and philosophies can be adapted to guide the external audit function as well)

AUDIT DEPARTMENT PURPOSE

Why does the internal audit department exist? What's the end goal? * Is our purpose to issue reports? * To raise issues? * To make people look bad? * To show how smart we are and how dishonest, incompetent, and corrupt the rest of the company is? * To flex our muscles and show that we can do anything and tell on anyone because we report to the board of directors?

AUDIT DEPARTMENTS * formed by the company's audit committee (a subset of the board of directors) * for the purpose of providing them with independent assurance that internal controls are in place and functioning effectively.

The audit committee wants a group that it can trust to be objective enough to tell it if there is anything the committee should be worried about. What's "really going on" in the company. The committee wants someone it can trust to turn in all the evildoers in the company who refuse to implement internal controls. Internal audit departments usually report directly to the chairman of the audit committee, so they feel protected from blowing the whistle on the hordes of dishonest managers who surely have infested the company.

The real mission of the internal audit department is to help improve the state of internal controls at the company. Admittedly, this is accomplished by performing audits and reporting the results, but we must remember that these acts provide no value in and of themselves. They only provide value when the internal control issues are resolved. This is an important distinction to remember as we develop our approach to auditing and, most important, to dealing with the people who are the "targets" of our audits.