In my last two columns I’ve been delving into the challenge of auditing governance, risk, and compliance in a unified fashion. I still have a final column to write on that subject (auditing GRC from a governance perspective) but I want to interrupt things this month to talk about the skills and knowledge an auditor needs—because auditing GRC is not for the faint of heart.
The task isn’t something that should be delegated to the less seasoned, as it requires considerable knowledge and savvy to recognize governance vulnerabilities as well as fortitude and deftness to influence action when needed. In evaluating organizational governance (I use “organizational” to include non-corporate entities such as non-profits), internal auditors are examining a company’s decision-making and control processes. Governance involves a company’s relationship with a wide range of powerful participants in addition to board directors, such as shareholders, management, external auditors, legal counsel, regulators, standard setters, and others. To audit GRC is to probe the checks and balances that establish responsibilities, require accountability, and enforce consequences. That’s pretty heady stuff.
