Internal auditors have always had a problem expressing an opinion - or rather, expressing an opinion that others take the right way, with a proper understanding of its scope and type and the criteria used to produce it. The issue has come to the forefront recently as more corporate officers and audit committees respond to the demands of the Sarbanes-Oxley Act, especially Section 404, which requires officers to certify that their internal controls are sound and effective.
Understandably, these officers often rely on internal auditors to confirm that internal controls are adequate. They ask for an opinion from the chief audit executive, though neither they nor the CAE really know the scope and validity of the requested opinion. Understandably, the CAE is often reluctant to provide such an opinion.
In response to the widening need for clarification and advice, the Institute of Internal Auditors has released a position paper, "Practical Considerations Regarding Internal Auditing Expressing an Opinion on Internal Control."
Advertisement
IIA president David Richards said that his organization's paper should help auditors and audit committees understand what they're talking about when they talk about opinions.
"A lot of internal audit departments are being asked to sign a statement for management or to do something, and we're saying that internal auditors should be careful that they don't just cavalierly sign a piece of paper without having thought through the ramifications and knowing what they're being asked to sign for," Richards said. "If you have professional judgment, you should not have to give it up just because somebody asked you to sign something."
Richards said that the paper was recently downloaded from the IIA Web site 3,200 times over a two-week period - more than three times the number of downloads of another IIA paper, on outsourcing, that was issued at the same time.
Many internal auditors have never expressed opinions on the adequacy of controls for organizations as a whole. Rather, they have only identified specific weaknesses that they have found. The readers of such a limited opinion, Richards said, have no way of knowing how to interpret its significance. Too often, such a limited opinion is interpreted as a certification of excellence or even perfection.
Larry Harrington, vice president of audits at Raytheon, who helped author the paper, agreed that internal auditors have been reluctant to issue opinions.
"Internal auditors are not used to giving an overall opinion," Harrington said. "You may do 50 audits a year, but you express an opinion on each one. Expressing an opinion on the entire system of internal controls can be difficult because you have not audited everything. This position paper talks about the fact that audit committees are moving toward asking internal audit for overall opinions on internal control within the company, so the struggle that the internal auditor has is whether the various individual audits are enough for the auditor to give the audit committee an opinion on internal control across the entire company."
