Internal Auditing: Roles, Certification, and Career Growth

Introduction: The Changing Audit Landscape

Over the past two decades, a number of changes took place that greatly altered the business world. Some of these were external, such as ever-increasing globalization, growing competition, and fast-paced technological innovations. However, some of the changes were internal as well. At the beginning of the millennium, huge cases of company fraud rocked the structures of many organizations. As a result, the entire auditing field was put on trial.

Enron and similar financial disasters made many companies think carefully about how to enhance their own internal audit functions. Organizations clearly realized they had to be more careful about aggressive or risk-taking accounting techniques and be mindful of the pressures to meet earnings estimates. They could not ignore risk management issues and had to follow up on audit findings once issued in order to determine the strength of financial controls. The bottom line: internal auditing needed to meet stringent quality assurance goals, just as any other company product or service does.

Although the role of internal auditor dates back to the 1940s, it has now taken on much greater meaning. What many considered an unremarkable position about a decade ago has become one of the most important aspects of a successful organization.

In order to find out more about this position in present times, the author interviewed the internal auditor of a local mid-sized family-owned business. Despite the fact that most financial concerns have been associated with publicly owned corporations, studies show that even smaller privately owned companies are at risk. Wells (2004) concluded that "small businesses remain the most vulnerable to occupational fraud because of three factors: They are the least likely to have an audit, a hotline, or adequate internal controls." Passage of the Sarbanes-Oxley (SOX) Act of 2002 raised the profile of internal audit staff at both publicly and privately held companies. Privately held mid-sized companies are thus adopting some of the SOX principles and turning to their present internal audit staff for help, or hiring new personnel to meet changing and growing needs.

Dalton and Dalton (2005) add that even a private firm not subject to SOX oversight — one operating in a state without parallel legislation and not subject to other regulatory guidelines — has a host of reasons to be SOX-compliant:

• If private firms have plans to go public, underwriters and investors will insist on compliance prior to the initial public offering.
• If private firms are attempting to raise capital from banks, venture capitalists, or private equity firms, audited financial statements and assurances about best-practice corporate governance will be a requirement.
• Insurance companies will request certified financial statements and other governance provisions to establish coverage for directors and officers.
• If private firms prepare and distribute financial statements for any purpose (e.g., banks, venture capitalists, private equity, trustees, institutional investors), they will be expected to be SOX-compliant.
• Any private company involved as a partner in a merger with a public company, or as an acquiree in an acquisition, may be certain that SOX compliance will be part of the due diligence process.
• Private companies with an employee stock ownership plan may expect that the plan trustee will encourage — if not insist on — SOX-like compliance.
• Private companies will want to consider that clients, joint venture partners, vendors, and other business partners that are publicly traded firms may insist on compliance with the same practices to which they are subject (Dalton & Dalton, 2005, p. 8).