the information they receive from management is fair and accurate. At first, directors
turned to the external independent accountants. However, as they became aware that
external accountants really focus on a much higher level of materiality in connection
with their audit of the annual financial statements, directors have increasingly turned
to internal auditors. The apparent conflict of interest here is that management hires
the internal auditors, compensates them, and evaluates them.
Can individuals who report to management really report on management, espe-
cially if the report may not be favorable? The answer should be yes, of course they
can based on professionalism. The challenge to corporate governance structure in
business today is to maintain the proper “tone at the top.” That is where there is a real
risk exposure. Boards of directors need to ask themselves whether “Enron” could
happen in their own companies and an essential protective device is to have an active
aggressive internal audit function that can assist the Boards in monitoring the inter-
nal control environment in their companies. This is particularly true today because
the Sarbanes-Oxley Act of 2002 requires management certification of financial state-
ments and internal control reporting.
Auditors who bring very negative information have to be strong and have a good
set of facts. The difficulty with the facts, except in a case of outright fraud, is that
they can be viewed differently. Auditors can present evidence that management does
not implement controls previously agreed to. Management can contend that they did
not implement the controls for cost or reorganization reasons, to name a few. Audit
committee chairmen need to understand the conflict that exists if management con-
trols salaries, budgets, and promotions of the internal auditors who are expected to
report independently.
The IIA in response has provided a number of tools on the issue of ethics. There
is a Code of Ethics, a Standard for the Professional Practice of Internal Auditing, and
a position paper on whistle-blowing and consultation with peers. To quote the IIA,
“Serving as the conscience of an organization is one facet of the internal auditor’s
function. A strong sense of ethics is required to fulfill this responsibility. Like any
skill or ability, a strong sense of ethics requires training and understanding. Regular
reviews of the basic tenets of feedback is a mechanism that can prevent the pendu-
lum of ethics from being either in the black/white only world, or in the one where
telltale gray is more dominant than necessary.”^4
32.7 QUALIFICATIONS FOR AN INTERNAL AUDITOR. Owing to pressure from the
IIA and its support, the number of schools offering courses in internal auditing is in-
creasing. In the past, most have considered public accounting qualifications as ap-
propriate background for internal auditing. Should internal auditors be generalists or
specialists? Do they have to be certified public accountants? How important is it that
internal auditors understand the industry they work in? Is internal auditing a training
ground for young people, or is it a place for only really experienced people? The an-
swer is, “So much depends on how the function is run.”
The author believes that you need very bright, inquisitive staff and the right type
of management and training. Sprinkling that with specialists and experience will only
help to improve the quality of the function. Nothing succeeds like experience in train-
ing bright auditors.
32.7 QUALIFICATIONS FOR AN INTERNAL AUDITOR 32 • 11(^4) Flescher, 1991, p. 104.