Internal audit gone wrong

In a world rife with scandals impacting all aspects of business and life, internal auditors aren’t immune to bad behavior. Here’s how to find their occasional crimes and misdemeanors, plus some practical measures to deter and detect their nefarious activities.

At the turn of the millennium, I was a junior auditor with a Big Four accounting firm with almost one year of experience. I was assigned to an internal audit outsource of a medium-sized food manufacturer. The manager leading the audit was a rising star at the firm who was also studying for his MBA at one of the top business schools in the U.S. He heavily delegated work to me and spent lots of time with me at the client site. Most days he’d finish his work in a couple of hours and spend the rest of the day reading his university course books and answering my questions. I was extremely impressed with his efficiency, and I was learning a lot. When the assignment was over, he showered me with praise in front of the partner. I left the assignment feeling fortunate to have worked with such a great manager. Shortly after, he left the firm and went to work for a well-known Wall Street company.

When I had a chance to catch up with him a few years later, I begged him to share how he was always able to complete his audit work so quickly. He hesitated and then looked at me and said, “If you want to get to the top, you need to focus more on relationships and rapport and less on executing tests of control.” He said he’d test the design of a control, and if it passed, he’d simply write down transaction numbers and unique identifiers to satisfy the sample size requirements for operating effectiveness testing. He’d then state that no exceptions or findings were identified — all without performing any actual testing. I asked why the partner never picked up on this. My former boss said, “It’s all about the story you tell and how confident you are when telling it.” I was dumbfounded as the image of the great manager came crashing down in my mind. Unfortunately, this wouldn’t be the last time I encountered an unethical internal auditor.