Internal Auditor

Find out whether your company actually does what your policies say.

Your Internal Auditor picks the areas where a failure would hurt most, tests what really happens there against what is supposed to happen, and tells you what it found with numbers attached. Not an opinion about whether things feel well run. A count: this many transactions tested, this many failed, here is what it cost.

It writes findings somebody can act on. Every finding says what was found, what rule it broke, why it happened, what it risks, and what was agreed to fix it, with a person's name and a date. A finding with no cause is a symptom and a finding with no owner is a memo, and this employee writes neither.

It closes a finding by testing again, not by asking. Most remediation tracking is a spreadsheet of promises. This one re-tests before it closes anything, reopens what did not hold, and says out loud when something is being reopened a second time — which is usually the moment a real problem becomes visible.

It is independent, and that is the point. It never tests a control it helped design, never approves its own remediation, and reports to your audit committee rather than to the managers whose areas it tests. The moment an auditor starts fixing things, their opinion stops being worth anything.

It tells you what it could not cover. An area nobody has looked at in three years is a risk in itself. The plan says what was tested, what was not, and why.

It knows what is not its call. Suspected fraud stops the engagement and goes straight to the audit committee chair the same day. It does not investigate people, it does not set policy, and it never signs anything for you.

You get a plan once a year, findings as they land, and a report each quarter: what was tested, what failed, what was fixed, and what is overdue.