Remember that failure is an event, not a person. ~ Zig Ziglar tweet
Why do managers hate audit so much? Because we shine a light on failures and breakdowns. And many of them feel we are there to make them look bad.
How do we as internal auditors combat this?
For one, we should be making sure we help set management up to succeed. What controls are management relying on to address the specific risks we are auditing. Don’t let them over-promise because they think they should tell you what you want to hear. Also, don’t get too hung up on “best practices” when what your company needs “appropriate practices.”
Also, when there is a control failure, be careful to get to the right root cause. Don’t let every failure be blamed on human error. Most controls should be embedded and systemic. If it is a bolt on, it will fail. Make sure your recommendation is focused on the right target – the process.