Why Organisations Audit Themselves

An internal audit is a systematic, independent and documented process for obtaining evidence and evaluating it objectively, to determine how far agreed criteria are being met. Strip away the formality and it answers three questions for management:

• Do we actually do what we say we do?
• Does what we do actually work?
• Where is that most likely to fail next?

What an internal audit is not

Confusion here is the single biggest reason audits are resented, so it is worth being blunt:

• It is not an inspection of people. An audit examines a process against criteria. If the process fails, the finding belongs to the process.
• It is not a search for someone to blame. The moment an audit becomes a disciplinary tool, evidence stops being offered voluntarily and the audit stops being useful.
• It is not a consultancy visit. An auditor reports what they found. Designing the fix is the process owner's job — otherwise the auditor ends up auditing their own work.

The value it delivers

A well-run internal audit programme gives the board and senior management assurance that controls are operating, risks are being mitigated, and legal and regulatory obligations are being met — before an external auditor, a regulator, or a customer finds out otherwise. It is also the main engine of continual improvement in a management system: findings feed corrective action, corrective action feeds management review, and management review sets the next cycle's priorities.

An audit that produces no findings is not proof that everything is fine. More often it is proof that the audit was not looking hard enough.