Where should internal audit be in preventing failure?
Have you ever wondered what makes the difference between spotting a risk and actually preventing a failure? Not just any failure – the kind that can bring an organisation to its knees. Think about it: how many times have the warning signs been there, yet action comes too late?
This article explores that question through the lens of a deeply personal and professional experience – and shares three practical levers that can help internal audit teams move from technically correct to strategically essential.
A lesson from catastrophic failure.
In April 2011, I was leading an audit in BP’s Cairo office. I remember the glass walls, the smell of strong coffee, and the distant honking of Cairo traffic. But the mood inside the room was anything but routine.
Overnight, news had broken of a major explosion in the Gulf of Mexico. My colleague told me, “I’ve sold every share I own in BP – you should do the same.”
The explosion was on the Macondo oil well. In the weeks that followed, the true scale became clear: 11 lives lost, over 780 million litres of oil spilled, $65 billion in costs – and a reputation damaged on a global stage. This was a catastrophic corporate failure.
What made it even more painful? Many of the warning signs had been there. Technical risks, overdue maintenance, ineffective emergency systems. But more crucially, cultural and organisational issues meant those red flags didn’t result in action.
Internal audit was identifying problems, but not creating change. Some executives were even promoted despite repeated safety lapses. Why? Because trade-offs were being made for the things that felt certain – like cost and production – at the expense of something that felt uncertain: the chance of catastrophic failure.
That experience changed how I think about assurance. And it raises a fundamental question: Where should internal audit be positioned to prevent this kind of outcome?
The trusted conscience.
To be truly effective, internal audit can’t just observe. It needs to influence. That means moving beyond a traditional, retrospective model and becoming a “trusted conscience” of the organisation.
What does that look like?
We’ve developed a simple framework to explore this, based on two critical qualities:
- Proximity – Are we close enough to see what’s really going on?
- Credibility – Are we trusted enough to challenge and influence it?
When both are low, internal audit is irrelevant. High proximity but low credibility? You’re in the room, but ignored. High credibility without proximity? You may be wise, but you’ll always be too late.
Only when internal audit has both can it operate as a trusted conscience – seeing the danger, and being able to challenge it effectively.
But there’s a trap. It’s hard to build credibility without proximity. And hard to get proximity without credibility. So how do we break that loop?
Building trust: three practical levers.
To become a function that prevents – not just reports on – failure, here are three powerful levers internal auditors can pull:
- Get closer.
Don’t wait for permission. Show up where consequential decisions are being made. Informally attend key meetings. Build relationships with project teams. Get close enough to feel when incentives are misaligned, or people aren’t speaking freely.
It’s not about being intrusive. It’s about being present and perceptive. Close enough to notice what others may miss – and credible enough to stay.
- Offer insight, not just oversight.
Compliance auditing won’t shift the dial. True insight comes from stepping back, spotting patterns, and surfacing what’s being assumed but not said.
Ask bigger questions. Instead of “Is the onboarding process effective?” try “How do we decide who to trust?” Join the dots others haven’t. Translate risk into relevance.
Insightful audit functions don’t just test controls. They help organisations see themselves more clearly.
- Challenge with care.
We all know people don’t respond well to gotcha moments. But they will listen to someone who fully understands what’s at stake and genuinely wants to help.
Start with curiosity – understand the pressures and trade-offs. Then frame your challenge around shared objectives: “Here’s something that might get in the way of what you’re trying to achieve – can we talk about it?”
When we challenge like that, we don’t just gain compliance. We earn trust and influence.
Courageous proximity.
True objectivity doesn’t come from standing at a distance. It comes from being close enough to understand, and brave enough to speak the truth.
That’s the mindset internal audit needs today:
- Close enough to see the danger.
- Trusted enough to challenge it.
- Courageous enough to speak before it’s too late.
Want to talk about how your internal audit function could shift from retrospective assurance to forward-looking influence? We’d love to start a conversation.
AUTHOR.
STEVEN BROWN.
