As I have discussed in past columns, internal audit efforts must be risk-based and contribute to the long-term assurance needs of the organization and its board. A formal risk-assessment audit must be completed at least annually and the results of that assessment should direct audit priorities.
Over the past five years, a focus on short-term results (quarterly financial results and meeting current regulatory requirements) has driven the priorities of management and consequently the organization toward a short-term perspective. Similarly, internal auditing’s efforts have moved toward this short-term focus, boiling down priorities to whichever audits the company needs to complete in the immediate quarter.
