Too many internal audit results create a sigh of relief or a scream of frustration from the auditee who has been told he or she has passed or failed .

Many readers may believe that is an outdated perception, but regrettably it is not. The problem is growing; every year management react to the need to be able to demonstrate compliance with ever-increasing external requirements, such as changes to legislation or the small print of a new swathe of regulatory bodies, by doing more compliance auditing.

But hang on a minute. Why do we need to do all this compliance auditing? Simply because most managers and supervisors are overburdened just keeping the boat afloat and heading in the right direction. Therefore auditors are used as a safety net, in the sure knowledge that something will be overlooked and wrong steps taken.

So, literally, millions of hours of internal auditing are being carried out just in case somebody or something does not do a job properly. They are seen as a necessary evil, because the forms need to be filled in to show the work has been checked, but this condescension has a knock-on effect in that effectiveness is seen more in terms of efficiency rather than asking difficult questions.

Our belief is that the reality should be that internal audit engages very bright people in reviewing key parts of an organization from a variety of aspects. Therefore internal audit is perfectly placed to challenge the way an organization is being managed.