The recently reported cases of internal control deficiency can be traced to the detection failures of internal and external audit activities worldwide. The tools in the hands of modern day auditors, whether internal or external, are not adequate to the changing business scenarios in which they perform. It does not mean that the traditional tools are not effective. They proved their worth and still prevent large-scale internal control failures. However, many of the cases of reported control deficiency can be traced to tone at the top — technically a part of the control environment of the organization.

Three “S” words govern internal auditors’ thinking about themselves and their profession: survival, status, and substance. For the past 20 years, we have worried perhaps excessively about survival and status, and not enough about substance.

Welcome to The Soapbox, a forum aimed at promoting idea-sharing and dialogue among members of the internal audit community. We welcome submissions on any internal audit related topic and encourage practitioners from all levels of experience to participate. Entries should be submitted to the InternalAuditorOnline blog editor, Tim McCollum, at tim.mccollum@theiia.org for consideration. Posts may be edited for clarity and length.