What is the Internal Audit Brand?

Earlier this year, I was asked to give a presentation on the Internal Audit Brand at the Institute of Internal Auditors Australia Annual Conference – colloquially known as SOPAC.

In the nine months since its delivery not a week has gone by without multiple requests for its onsending; not a week has gone by without multiple “thank you for finally saying what needs to be said” notes and not a week has gone by without “I cannot bring myself to agree with some / all of your views” missives.

So as our penultimate Honestly Lay Bare for the 2014 we thought we would re-produce the speech.

Grab a coffee.

Have a read.

And think.


I am not very good at chess.

Never have been.

I am more of a checkers type of guy.

Having said that I have a disproportionate fascination with the history of things that have stood the test of time.

And one of those things that I find intriguing is the history of chess.

In their wonderful new book The Second Machine Age Erik Brynjolfsson – a Professor of Management at the MIT Sloan School of Management and Andrew McAffee – the director of the MIT Center for Digital Business – recall the story of the history of chess.

It was invented in present day India in the sixth century.

As the story goes it was invented by a very clever man who presented his brainchild to the emperor.

The ruler was so impressed by this difficult and beautiful game that he invited the inventor to name his reward.

The inventor praised the emperor’s generosity and said:

“All I desire is some rice to feed my family”.

Since the emperor’s reward was spurred by the invention of chess, the inventor suggested that they use the chessboard to determine the amount of rice that would be given.

“Place one single grain of rice on the first square of the board, two on the second, four on the third”, and so on, so that each square receives twice as many grains as the previous.

“Make it so” the emperor declared impressed by the inventor’s apparent modesty.

What the emperor did not realise is that if he did follow through on his request he would have had to give the inventor eighteen quintillion grains of rice – a pile that would dwarf Mt Everest; more rice than has been produced in the history of the world.

After thirty two squares, the emperor had given the inventor 4 billion grains of rice – about one large field’s worth.

It was only then did the Emperor get concerned because he was starting to appreciate the total value that was at play in the inventor’s magical reward scheme.

Yet – at thirty two squares – he was only at the first half of the chess board.

He only knew what he had seen before.

He had no way to comprehend the size of the second half of the chess board.

For the inventor, it was the second half of the chess board where he knew – but the emperor did not – that the greatest reward lay.

In some versions of the story, once the emperor realises that he’s been tricked, he has the inventor beheaded!

Putting that unfortunate personal outcome aside, the moral of the story and my challenge to you today is what is the second half of internal audit’s chess board?

What is it that we are doing that restricts us to only see the first squares on the board and neglect the plentiful rewards that sit within our reach but out of our sight?

My proposition is that we have been appalling bad at recognising our value, promoting our brand and getting others to demand our services.

We no longer have to worry about cavorting over the riches of the second half of the chess board.

We have to be worried about never again being asked to the chess table.

We have already been asked to step away from the table in a number of domains that should have been rightly ours.

And in doing so the exponential largess – the second half of the chess board – that otherwise awaited us has been distributed as dividends to others.

This honest yet confronting assessment comes from a person that is passionate about the value that internal audit can and does bring to an organisation.

I have devoted nearly a quarter of a century to the practice of a beautiful and meaningful art.

I am a proud internal auditor.

Yet my licence to continue to ply my craft demands not the formal certification of the Institute but a detailed self-assessment of our brand.

If you came today expecting to be given the play book on developing your personal brand so that you too can become – as my LinkedIn profile proudly declares – “one of the world’s leading Chief Audit Executives” then you will be disappointed.

Such an exercise in self-reinforcement would no doubt be personally rewarding to my sense of importance but I doubt it would do anything for the betterment of the profession that we all hold so dearly.

I want to examine the internal audit brand through the prism of what is a successful brand.

One needs only to enter the singular phrase “attributes of a strong brand” into Google to discover that this is an area that is not devoid of literature, opinion and guess work.

To remain as objective as possible I propose to look at the internal audit brand through the prism of a brand strength framework developed by the international branding consultancy, Interbrand.

By doing so it is my fervent wish that the profession that I have dedicated my career to lives out the true potential of its existence.

It is my hope that the brand of internal audit is the dominant brand in the markets it seeks to service.

The Interbrand framework highlights a number of key attributes – clarity, commitment, protection, responsiveness, relevance, differentiation, consistency, presence.


Lets start with clarity.

Interbrand proposes that clarity is about what the brand stands for in terms of it values.

Equally there has to be clarity about its target audiences.

We as a profession often seem to confuse our value with our values.

Whilst linked they are different.

Internal audit is, as we know, an independent objective assurance and consulting activity.

Our value is the additional benefits that are delivered to our customers / clients / auditees from their interaction with us.

Our values – being broad preferences concerning appropriate courses of actions or outcomes – are centred around, supported by and constricted by our reliance on the foundation stone of independence.

If values tend to influence attitudes and behaviours then it is the value preference for independence that most strongly drives the behaviour of our profession and brethren.

The Australian National Audit Office provides a good assessment of what is independence. It notes:

A distinguishing feature of internal audit is its independence. Internal audit is independent in the sense that it is not subject to the authority of the areas of the entity it audits. This independence, best described as ‘operational independence’, assists in ensuring that internal audit acts in an objective, impartial manner free from any conflict of interest, inherent bias or undue external influence.

However, internal audit is not independent of the organisation in the same way as the external audit function is. It provides a service to management, reports to the Audit Committee and is ultimately accountable to the Chief Executive or the Board for the achievement of its objectives and the use of its resources.

Whilst there are many appropriate work-around solutions to address this second issue of the absence of independence from the organisations that we seek to audit it is hard to escape the conclusion that we are still debating what it means to be independent.

Our definition of internal audit doesn’t use the caveat of operational independence.

We say independence.


So if we have the situation where one of the most esteemed audit functions in Australia – if not in the world – is making a distinction on independence can we truly say that we have achieved the high plain of clarity about our values?

Let’s now look at clarity of target audiences.

Who are our target audience?

Could you imagine attending the Annual Conference of the Royal College of Physicians and year after year the learned medical attendees continuing to debate whether or not the patient was their core and most important constituent.

What would we – as consumers of the service that the Royal College of Physicians ‘produce’ – think?

We don’t want a physician sitting opposite us internally negotiating which stakeholder is the most important when we disclose our inner most medical challenges to them.

The drug company, the medical insurance fund, even the medical training colleges are undoubtedly all stakeholders but they are not the target audience.

We – the sickly patient sitting nervously before them – are. For internal audit who / what is our patient equivalent?

Is it the shareholder?

Is it the Audit Committee?

Is it Senior Management?

Is it a combination of all of these or someone else?

This is another interchange for which we as profession have been caught in its vortex for way too long.

To humbly seek to settle this matter once and for all today I propose that it is the shareholder – and only the shareholder – that is our target, prime and most important audience.

To support my assertion I – thankfully – have history on my side.

In 1867, the then largest company in the world – the London & North Western Railway – decided to set up what is considered one of the world’s first true internal audit functions to provide some form of assurance over the large geography that the Railway then covered.

In correspondence that the Railway’s external auditors penned they described this new function as seeking to:

Honestly lay bare to the proprietors the true condition of the undertaking.

To the proprietors.

Not to Management.

Not to the auditee.

Not to the regulator.

To the proprietor.

They were then and are now – 147 years on – the target audience of our efforts.

Yet this year represents the first year that this Conference has had a specific focus on the representatives of the proprietor – being the Board and the Audit Committee.


Time now to move on the internal commitment to the brand and a belief internally in the importance of the brand.

As a former Board member of the Institute I can talk from first-hand experience when I say that the Australian internal audit community is well served by the passionate commitment of the Institute’s employees and volunteers in the promotion of the importance of internal audit.

What I would challenge – and this may be controversial but the moment dictates complete honesty – is that internal understanding of the importance of the brand.

To my recent knowledge there has been only two employees of the Australian Institute in the last 10 years that have had an extensive internal audit practitioner background.

Neither are with the Institute today.

How can we ensure that the promotion of internal audit is consistent with the challenges of internal audit if our professional association is devoid of the very skill set that it seeks to represent?

We can argue that this practitioner perspective comes from the membership of the Board and there is merit in this argument (putting aside the distinction between church and state that should exist between the actions of a Board and the actions of the Management).

The challenge that I would put out today therefore is how does the profession, how does the Institute, develop and maintain an understanding of the importance of the brand?

First and foremost we need to broaden our membership base away from not only practitioners of audit to all stakeholders / consumers of our service offering.

We need to broaden our demographics so that we have a broad-based understanding of the importance of our brand.

Not only a practitioner view.

Not only an administrator view.

Whilst I am on the path of controversy can I respectfully – yet forcefully – suggest that we look at the Certified Internal Auditor certification and for once genuinely ask of ourselves whether having such certification adds to the value that you as an auditor bring to your organisation.


I don’t propose to spend too much time on the technical aspects of protection for – to my lay eyes – we appear to do well or to the appropriate standard in terms of ensuring the brand of internal audit is secure from a legal and propriety perspective.

What I would, however, like to address is the design, scale and geographical spread of the profession and most particularly the Institute.

Internal audit is not an American construct.

Yet if one were to look at the way our profession has sought to administratively organise ourselves one would be forgiven for thinking that the profession is best served when the interests of the American auditor is best served.

Why is it that every second International Conference – the gathering that should define us to ourselves and to others – is held in North America?

Are these conferences really only designed as a profit making exercise and is that our excuse for each alternate year seeking to retrace Columbus’s steps?

Where is the real global engagement of the profession and the Institute?

Where is the International Conferences being held in the shadow of the Taj Mahal outside of New Delhi or the Istiqal Mosque in Jakarta?

In the last ten years – and this is most definitely not a reflection of the high quality and integrity of the people that have filled the roles – we have chosen an American as our global leader on at least four occasions.

How is that representative of a global organisation? A global profession?

We cannot ever hope to be a global profession – a global brand – if every other year we head back to the safety of the North American shore.

If it is true that we are living now in the Asian century I look forward to seeing how the internal audit profession will be truly understanding of the largest growing population; the largest expansion of economic wealth in the history of all mankind from the warm climes of Orlando.

The time has come for the profession to embrace its global footprint not just visit it.

I await the announcement soon of the relocation of the Institute secretariat to Beijing or Mumbai.


Now to responsiveness – that is the ability to respond to market changes, challenges and opportunities.

Where were you the day that you heard that Lehman Brothers had collapsed?

For me, I was sitting in my then office in suburban Melbourne reading with incredulity at the prospect that such a pillar of the global financial community would be lost to the corporate sewerage of poor governance, ineffective management systems and possible fraudulent misconduct.

It is reasonable therefore – given those factors which are the base level focuses of internal audit – that our responsiveness to a fundamental change in the market that we audit would be welcomed.

Yet if one reviews the online literature in the nearly six years since that monumental day you will take considerable time to discover anything more than one – yes one – short blog by our learned colleague and Institute blogger, Norman Marks, on its ramifications.

How can that be?

How can one of the greatest governance stories since the Great Depression result in one high Google positioned piece of analysis by the professional body that seeks to represent the internal audit profession?

How are we as a profession being responsive to the changes around us?

Is it that we aren’t or are we just waiting for the Global Financial Crisis to finish?

Lets hope it is the latter.

If it is the former we have in the Lehman case study an incredibly damning indictment on how we as a profession respond to changes in the market that we serve.

Perhaps though the issue of relevancy (and competency) existed, at least in Lehman, for many years before.

In the whistle-blower complaint that was sent to Lehman Brothers Chief Financial Officer in May 2008, the following observation was made:

certain senior level internal audit personnel do not have the professional expertise to properly exercise the audit functions they are entrusted to manage

It was not as if Lehman Brothers – and now – us as profession were not warned!

As we continue on this path of brand self-flagellation it is time to stop at the door of relevance and differentiation.

What is our fit with our customers – however so defined – needs, desires and decision criteria?

What makes our service offering distinctively different from our competition?


To answer the first question about relevancy we have to assume that we know what it is our customer needs and desires.

Not only are they two very different things – needs and desires – it is nigh on impossible to be relevant to our customers if we don’t understand them.

So what are their needs and desires?

Is it right to assume that everyone wants to work in a well-controlled work environment where systems are efficient and processes are effective?

It shudders me to my very core to think of a workplace that would not meet that high standard.

But – not for the first time either today or in my career – I have to ask myself as to whether I am a good representative sample.

And the answer has to be no.

There will be people – with no malicious intent at all – who believe that the best work environments are ones with shades of grey (albeit somewhat less than 50 shades thereof!); where rules are guidelines to be negotiated with not followed.

Their need and my need for a properly functioning internal audit effort are fundamentally different.

Is this a problem that there is this divergence?

In short, yes, because the whole philosophy of internal audit is premised on the assumption that there is one right way of doing things and that any variation to that standard warrants a corrective management action.

To remain truly relevant to the needs of our customer we need to find a way to bring greater flexibility to the practice of internal audit.

What that looks like and how we will seek to move towards that delicious and deliberate ambiguity is a challenge that should entertain our greatest minds.

But will it?

I suspect that it will just be easier to slouch in the malaise of governance inflexibility and argue when challenged that to desire something other than a well-controlled work environment is the corporate equivalent of arguing against motherhood.

If we do we will have lost our brand relevancy moment – possibly forever.


Whilst we continue riding the relevancy train it is also important to consider our differentiation from our competitors.

To do so, not surprisingly, we have to define who our competitors are.

Perhaps the easier answer – and the core of the challenge – is to ask the question: who isn’t our competitors?

Putting aside the issue of independence and objectivity for just one moment if you can, the giving of assurance is not a skill that is the sole domain of the auditor.

Anyone can give assurance.

There can be management assurance.

There can be regulatory assurance.

There can be spectacularly ill-informed and uneducated assurance.

So to differentiate from this motley group of assurance providers we need to be offering something that is, well, different.

And that thing has always been the petard of independence.

Yet as we saw above this crutch is not without its challenges for it is not possible to say that we are truly independent.

So perhaps this is at the very core of the strength – or otherwise – of the internal audit brand.

The ease, as always, is in the identification rather than the resolution of the problem.

But find a resolution to this brand issue we must. And the solution is right before our eyes.

In the Sherlock Holmes book The Adventures of Copper Beaches, Holmes cried impatiently:

Data! Data! Data!

I can’t make bricks without clay!

The solution to our differentiation issue is data.

We can, should and must be the clay that makes the bricks that makes the buildings.

By virtue of nearly every mandate for any internal audit function we have the right and privilege to access all areas, all functions, and all data without management interference.

Yet we only ever invoke that clause in our social contract in aggressive situations to overcome management obstinacy.

We need to look at our use of data in a fundamentally different way and by doing so use it in such a manner that can and will differentiate us from our competitors.

We need to provide back to the business the insights that have access to all areas, all functions and all data brings.

We as a profession were never the leading voice in the modern development of corporate governance.

We should have been.

For Australians listening to or reading this speech – how in the world did we ever lose the battle of governance to the company secretaries? Granted it is just a name change but sometimes that is all that is needed to demonstrate differentiation.

We as a profession are being currently overlooked to develop integrated assurance mapping.

We can’t be.

We as a profession need to embrace the messiness of data – the potential of that most overused phrase big data – and show that we are the rightful heir of this area of assurance.

When John Kennedy sent man to the moon he said that he did it not because it was easy but because it was hard.

Well this will be hard.

But lets set ourselves the goal against which we will measure our success or otherwise as being seen as the best, leading and most experienced data interrogators.

The final two areas that I want to look at are brand consistency and presence.

For consistency this is an examination of the degree to which a brand is experienced without fail across all touchpoints or formats.

For presence it is the degree to which a brand feels omnipresent and is talked about positively by customer and opinion formers in both traditional and social media.


If you will allow me the grace, I want to use a story about SOPAC as representative of the consistency issue. I appreciate that it is not a perfect analogy with the broader internal audit consistency issue but it will do.

For those of you attending this presentation today, can I ask one question – what does the acronym SOPAC stand for?

I once asked this exact question of two people – one was one of the most senior internal auditors Australia has ever had the pleasure to host and the other was a junior auditor based in Parramatta.

The former – the senior person – had no idea what SOPAC stood for.

The junior person immediately responded that SOPAC was where she swam most days.

SOPAC being the initials of the Sydney Olympic Park Aquatic Centre.

At the most micro levels – the branding of our conference by the association that seeks to represent the Australian internal audit community – we fail the test of consistency in that it is not a brand that is experienced without fail across all touchpoints or formats.

We need to and must do better.


And that leads us to our presence.

I have left the easiest brand element to the last.

Who amongst us thinks that the internal audit brand is omnipresent with our corporate stakeholders?

Who amongst us regularly see it talked positively by customers and opinion formers?

Who amongst us see internal audit owning any significant social media real estate?

Of these three issues I do want to discuss momentarily the exploitation of social media by the internal audit profession.

Or perhaps the lack thereof.

We need to use social media – in all its formats – to engage, entertain, and challenge.

How is it that a short sighted bald auditor who is standing before you today can have a weekly exchange of ideas and – it should be said consulting opportunities – with 10,000 of his nearest friends on his newsletter database.

The answer is social media.

This is the low cost medium through which my constituency have found their voice so that now my work is being used as training materials in Kuwait; being translated into Turkish and being freely and properly exploited in Azerbaijan.

It is not being asked of internal audit to invent social media. It is being asked of internal audit to use social media.

The clock is ticking on the relevance of SOPAC in its current face to face format.

If you really want to reach the 3,000 Australian members of the Institute it wont be through getting them all to come to the fair shores of Melbourne, Sydney or Brisbane each March.

If you really want to reach the many multiples of stakeholders that those 3,000 people engage with you, you need to present and re-present the profession’s intellectual property and many different and divergent voices in a manner that people can consume at a timing of their choosing not ours!

Presently we do not.


In conclusion, I want to take you back to a very sunny Sydney day on Sunday 20th June 2004 – just under ten years ago.

As a much more youthful looking Bob McDonald as Global Chairman strode to the stage of the 63rd Institute of Internal Auditors International Conference we were at the dawn of a new era for internal audit in this region.

As the promotional brochure said we aimed to inform.

We aimed to inspire.

We gathered that June to discuss the issues that – properly executed – would have ensured that the brand of internal audit would be strong and relevant.

The program content devised by an equally youthful looking Michael Parkinson addressed many of the issues that the environment of the day dictated.

It was an inspiring and proud moment to be an Australian internal auditor.

Come with me though to the gates of London’s ExCel centre in 103 days to the opening ceremony of the 2014 International Conference.

The speakers – whilst different ten years on – are addressing the same issues as they were back in June 2004.

We as a collective of people passionate about internal audit have not advanced our profession over a decade to the extent that we should have.

We cannot expect a strong brand if the product that it represents has not moved on over a 10 year period.

My challenge to the profession; to the Institute; to you and most importantly to me – for it is me that I can control – is what are we going to do to ensure that the great wonderment that is internal audit not only lives out its potential but that it is a brand that will stand the test of time.

What is it that is on the second half of the chess board?


Download PDF


Subscribe to Receive Our Email Updates

  • This field is for validation purposes and should be left unchanged.