A term of art in the audit profession that is tossed around but not well-understood is “reasonable assurance.” What does it actually mean when an audit report attests with reasonable assurance that the financial reporting or internal controls are reliable?
Jose Tabuena
Managing the Exchange of Personal Data Across Borders
Cross-border transfer of information is an increasingly crucial and thorny component of transacting business around the globe. The challenges of data exchange for international companies are considerable as the requirements and repercussions are not uniform across jurisdictions. What is permissible in the United States may be forbidden in Europe or elsewhere. Internal auditors and compliance […]
Protecting Your Data From the Unhappy Employee
Almost all organizations have faced the situation of a once highly regarded employee who turns disgruntled or goes rogue and now threatens to cause havoc to the company’s IT system or to take valuable data as they walk out the door. Companies can sometimes forget about the employee with elevated privileges, who can enter back […]
Make Me a Disbeliever: Audit Regulators Want More Skepticism
The skeptics are back, and they want you—or at least the internal and external auditors among you—to be more skeptical too. Audit regulators and others are once again asking auditors to embrace their cynical side and more effectively challenge corporate executives before signing off on an audit. These calls for skepticism stem from concern that […]
Can You Audit Corporate Culture?
Corporate culture, like an individual’s personality, is an amorphous quality that exerts a powerful influence over all behaviors and actions. Every compliance officer agrees that culture is important and works to improve the culture and ethical aspects of the company. Yet for all of its implied significance, culture is often viewed as a soft issue […]
Internal Audit’s Role in Managing Third-Party Risks
As companies continue to get in trouble for the actions of their business partners, some may be wondering, “Am I my brother’s keeper?” The answer, at least in the eyes of regulators, is yes. The types of risks from third parties continue to proliferate: corruption, product defects, supply chain disruption, data security breaches, theft of […]
Where Internal Audit and Compliance Should Report
On parallel yet similar tracks, the roles and reporting relationships of the chief audit executive and the chief compliance officer continue to be heated, contested, and ultimately muddled topics. Although the view that CAEs and CCOs need a high degree of independence and clout to accomplish their responsibilities has gained increasing momentum, there are still […]
What Every Internal Auditor Should Know About Big Data
Forget the cloud; Big Data is the new new thing, and it could have major implications for internal audit. More organizations are exploring what sort of business intelligence they can derive from all the information at their disposal. Although its application is in its infancy, internal auditors and compliance professionals are paying close attention to […]
Auditing the Compliance Hotline
The Securities and Exchange Commission’s whistleblower program issued its first payout last month, awarding $50,000 for information on a multimillion-dollar fraud. When Sean McKessey, chief of the SEC’s Office of the Whistleblower, announced the award, he stated that the SEC has received an average of about eight solid tips per day since the program was […]
How to Promote Effective Use of the Company Compliance Hotline
Compliance officers continue to fret over the effects of the Securities and Exchange Commission’s whistleblower program, established by the Dodd-Frank Act, which has earmarked payouts to those who report tips on corporate fraud. They’re concerned employees could ignore internal corporate compliance hotlines in favor of running straight to regulators with their tips so they can […]


