"Where were you?" is the question asked of external audit when corporate failures hit the headlines – Enron, Toshiba, Patisserie Valerie, Thomas Cook, Carillion... is the same question aimed at internal audit when a project goes off the rails or a control fails?

Psychic abilities are not listed on IIA Global’s core competency framework. So to answer this question, we take a candid look at the role of internal audit and ask whether it is a reasonable expectation that internal audit has 20/20 foresight at all times.

The story behind the question

As the third line of defence, internal audit has an important role in the corporate governance framework: to enhance and protect organisational value by providing risk-based and objective assurance, advice and insight.

Taking the lines of defence analogy literally would suggest internal audit is the backstop within the organisation; the goalkeeper making a glorious save when the opposition break though the defence.

Organisational defences are more complex than a back four on the football pitch, making it virtually impossible for a team of internal auditors to be the corporate goalkeeper unless they individually mark every board member 24/7.

In reality the independence of the third line puts internal audit closer to the role of referee in a tight derby game: expert in diplomacy and the rule book, respected for fairness, issuing warnings and overseeing the action. Like the referee, audit leaders are constantly maintaining pace with the game and looking ahead to the next move.

Speaking in October 2019, Sir Donald Brydon, leading the review into UK audit voiced his frustration that the world of audit was being blamed for everything, he said “it is not auditors that cause companies to fail, that’s the result of the actions of directors”.

It is true of both external and…