I work in IA these days. My boss reports to AC *and* MD. But the MD decides the size of his salary & bonus, not the board’s remuneration committee (and they *do* have one…)

Veering a bit away from the purely regulatory issue, may I suggest that ‘internal’ auditors these days are not only supposed to ‘deliver’ audits/ICFR reviews via a checklist-based approach, but are expected to do much more. A transition from purely compliance/transaction-based audits to successively more robust risk-based audits is quietly underway at many organizations – in fact, this is one of the euphemistic ‘best practices’. While IAs have been factoring in business risk into their audit scoping process since quite some time now, they are now also expected to vigorously contribute to (and, in many cases, spearhead) the enterprise risk management initiative, being perhaps best placed to do so given their wide-angle view across organizational hierarchies and boundaries. And this is a much more sustained campaign, beyond individual audit assignments, dependent to a large extent on building lasting relationships with the process owners across business functions, not only Finance.

As such, may I submit that an outsourced accounting firm cannot really be expected to “do the exact same thing an internal team would do” and, as such, the apprehensions to “employ a team of people that will only work half the year” are totally unfounded.

I feared government agencies, like the FBI and SEC. However, the FBI and SEC of today are overwhelmed and under-resourced.

Therefore, if was still a criminal, I would no longer fear the FBI and SEC today.

A perfect storm is forming.

Get ready!