Many of my fel-low internalauditors have

known that it was onlya matter of time untilthe outsourcing ofinternal audit depart-ments led to a majorfinancial disaster. TheEnron debacle, whichis still unfolding as I write thisarticle, is proof positive thatoutsourcing the internal auditdepartment is not in the bestinterests of any organization.The external auditor for Enron,Arthur Anderson, acted as theexternal auditor, outsourced theinternal audit function, and pro-vided a significant amount ofconsulting services. Their feeswere not measured in thousandsof dollars or even millions ofdollars; their fees were meas-ured in tens of millions of dol-lars! In my mind, when an audit-ing firm has this level offinancial involvement with asingle client, then they are nolonger independent.

INTERNAL AUDITORS ARE BEST

Several years ago, Enronoutsourced their internal auditdepartment. I knew several of

the auditors there. They werevery capable, knowledgeable,and loyal to their company. Theyalso had a tremendous knowl-edge of the business that can begained only through years ofdaily interaction with manage-ment and staff. Outsourced audi-tors often do not achieve thesame understanding of the busi-ness and the people performingthe everyday business transac-tions. Internal auditors do!External auditors go from clientto client. Their allegiance is totheir firm and the partners of thefirm, not to the client.

Internal auditors areemployees of the company withan independent reporting struc-ture to the audit committee.Their status as employeesensures that they are interestedin the long-term good of theorganization. Yes, they may befinancially dependent on the

company. They mayhave stock options andthey may have compa-ny stock in their401(k). This level ofcommitment ensuresthat they will act inthe best long-terminterests of the compa-ny. Without a strong

and capable internal auditdepartment, wrongdoing may goundetected and questionabletransactions and dealings maygo unnoticed, as in the Enroncase. Worse yet, executives maybe able to get away withschemes to inflate the value ofcompany stock. The SEC hascorrectly limited the externalauditor to a maximum of 40 per-cent of internal audit work start-ing in 2002. The SEC obviouslyis aware of the risks and, quiterightly, has taken action.

Now is the time to get rid ofthe outsourcers and build astrong internal audit department.The new audit department shouldbe staffed by knowledgeable peo-ple who have good businesssense, strong audit skills, and theability to perform a clear andindependent analysis of all com-ponents of the business. Someaudit departments have already

The Enron debacle proves that outsourcing theinternal audit department is a bad idea. Now is thetime to get rid of the outsourcers and strengthenyour own internal auditing. The author gives somevaluable tips on making it stronger, smarter, andflexible. © Canaudit Inc.: The Canaudit Perspective, February 2002

Gordon Smith

Enron’s Lesson: Rebuild Internal Auditing Now!

featu

reartic

le

13© Canaudit Inc.: The Canaudit Perspective, February 2002 Published online in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/jcaf.10064

proven their value to manage-ment. They created a strong staffand are providing the level ofservices management and theshareholders require. Yes, thereare other audit departments thatare carrying some “dead wood.”Rather than outsourcing thedepartment, let us instead build anew audit department.

In my lectures around theworld, I am constantly askedabout the composition of theaudit department. Should it bestaffed with young graduates,who will serve two years in auditbefore moving to junior manage-ment positions? Should it bestaffed by seasoned professionalauditors, who do not needto look outside of thedepartment for their nextposition in the company?Should business unit man-agers cycle though theaudit department as part oftheir professional develop-ment program? Should wehire people with industry experi-ence, or bring in staff with goodbusiness skills developed outsideof our industry?

BUILDING THE “IDEAL” AUDITDEPARTMENT

After 25 years of listeningto these questions, I have, asyou suspect developed my“ideal” internal audit depart-ment. Let’s start with the staff. Ibelieve that we need a strongcore of dedicated audit “lifers.”These people love internalaudit, the challenges, and thesuccesses. They know the busi-ness and they are ready and ableto provide other managers withsound business advice whenasked. That said, there shouldonly be a few of these individu-als. There should also be someyoung, energetic graduates, whogive the department the vitality

and energy that is required toget the work out. The graduateslove to perform tasks that arenew to them. Often these sametasks are deemed to be boringand repetitive by the more sen-ior auditors. To the new auditor,they are interesting and impor-tant. By performing these tasks,they are learning new skills thatwill help them throughout theirbusiness careers.

I also am a great fan ofrotating staff through the auditdepartment as part of their man-agement development. Thisensures that the audit departmentand the auditors within thedepartment understand the

business, as skills are transferredfrom the “rotation” auditors tothe regular audit staff. In addi-tion, the “rotation” auditors willgain new skills and controlmechanisms that they can applyin their management career. It isalso necessary to bring inoutsiders to enhance skill setsand provide a fresh perspective.By using the new graduates, the“rotation” auditor, a small num-ber of outside hires, and theseasoned audit professional, the audit department will havethe skills and the ability to iden-tify and report significant busi-ness risk.

But even the best auditdepartment does not have theskills to perform all requiredaudits. When skill shortfalls areidentified, then they must beresolved. If the department islacking a skill set that will berequired in the medium and long

term, then they should first iden-tify existing staff who can devel-op the required skill. This can bedone through training programs,research, or a series of structuredaudits. Hiring a skilled individ-ual is also an option. The currenteconomic downturn is a uniqueopportunity to acquire strongskills at reasonable prices.

To fulfill the short-term skillshortfalls, I suggest you usequalified consultants to augmentyour staff. With their specialskills, they should be able to per-form the audits or audit tasksquickly and effectively. The con-sultants should be required toprovide a knowledge transfer to

members of the existingaudit department as part ofthe consulting agreement.When the consultants leave,there will be follow-upwork that will be required,and your staff should beable to do this. By usingconsultants effectively, an

internal audit department canaccomplish their audit objectivesand enhance their skill sets at thesame time.

DID OUTSOURCING REALLYSAVE MONEY?

If your company outsourcedthe audit department in the past,now is the time to review thatdecision. Pull out all of the costsrelating to audit outsourcing.This includes fees, expenses, andfacilities used in performing theaudits. Next, gather a dozen auditreports and read them in one day.If you see phrases like “based onour limited review,” then theyskimmed the surface. If thereport tells you what you alreadyknow, then there was no valueadded. If the reports identifyissues but do not provide detailedsolutions, then the audit was notas effective as it should be.

14 The Journal of Corporate Accounting & Finance

© Canaudit Inc.: The Canaudit Perspective, February 2002

…we need a strong core of dedi-cated audit “lifers.”

Now let’s go back to yourcost analysis so that we canidentify the cost per report. Takethe total costs of the outsourcerand divide it by the number ofreports. This results in a cost perreport. Let’s assume that thisnumber is $75,000. Lay thereports you reviewed out on atable. Pretend that you are inBarnes and Noble and ask your-self if you would buy any of thereports for $75,000. If you onlyselect three or four reports, thenit is time to ditch the outsourcerand bring your audits back inhouse. Reestablish your auditdepartment and select your audit team.

Rebuilding the audit depart-ment will take more time thanyou realize. First, you will needto select a general auditor with astrong business sense, an execu-tive presence, and the ability tomotivate managers and staff.While there is a tendency to hirea “Big Five” partner to performthis function, I believe this is the

wrong decision. When a “BigFive” person heads an internalaudit department, the depart-ment often becomes a miniexternal audit firm, not an inter-nal audit department. Youwouldn’t hire a physician tobuild your house, nor a plumberto perform a heart transplant.Therefore, to build an effectiveinternal audit department, itshould be headed by an experi-enced, motivated, business-ori-ented internal auditor.

Once the general auditor ishired, managers and staff can beacquired over a two-year period.Use this time to wean the com-pany from the grips of the out-sourcer and build the credibilityof the internal audit department.Then be prepared for theturnover that will occur whenother business managers poachyour staff, offering them promo-tions within the company andthe career growth they earned.Yes, you will have to continuallyrenew the auditors in your

department; plan for thatturnover and pre-position thenew staff members before theold staff members leave.

As many of you know, Ihave been in internal audit mostof my working career. I haveseen the pendulum swing backand forth several times now. Iremain convinced that it takes astrong and independent internalaudit department to identify cor-porate risks and ensure that con-trols are in place to protect thecorporate assets. Are there anycompanies that want to be thenext Enron? If so, continue tooutsource your internal auditfunction. If not, then now is thetime to reinstate internal audit.

As always, my opinions aremine and mine only. I would liketo hear your comments on thisissue, positive or negative. Asthe Enron criminal investigationproceeds, the truth will comeout—and internal auditors willagain take over from the “BigFive” outsourcers.

May/June 2002 15

© Canaudit Inc.: The Canaudit Perspective, February 2002

Gordon Smith is president of Canaudit Inc. (www.canaudit.com). His first book, published by John Wileyand Sons, is titled Network Auditing: A Control Assessment Approach. He is currently working on his sec-ond book for Wiley, Control and Security of E-Commerce. Canaudit, the company founded by Mr. Smith,has provided training and technical audit consulting services to the internal audit community for over 16years. This article is reprinted with permission of the author and Canaudit, Inc.