During one strategy retreat, a seasoned board member told a story about a broken lock. It revealed why many internal auditors do not add value. They just collect the monthly paycheque for the role of “window dressing” compliance check-box. “We have an internal audit department.” We meet the requirement! You get the idea.
He said, “A vault had five locks. Four were strong and regularly checked. The fifth, hidden at the back, was old and rusty. No one paid attention to it. One day, the vault was emptied, not broken into, just quietly opened through that one weak point.
The lesson? Too many auditors focus only on the obvious. They check what is working, not what’s quietly failing. They audit the known risks, not the unknown exposures. They miss the silent threats, the culture gaps, tech loopholes, the poor assumptions, and process drift.”
To add value, internal auditors must evolve, not just as inspectors, but as strategic sentinels and surveillance experts. A good internal auditor is an intelligence gatherer, spotting early signals, decoding patterns, and surfacing hidden threats before they escalate.
The 5 mindsets that make a winning, future-ready internal auditor:
1) Anticipate, don’t just assess. Don’t wait for risks to be defined. Sense emerging threats –cyber for high digital trust, culture, ESG, AI–before they’re on the risk register.
2) Read people, not just policies. Fraud doesn’t hide in procedures; it hides in people. Watch behaviour. Listen between the lines. Culture is the real control environment.
3) Disrupt the comfort zones. If an area has never been audited, that’s a red flag. Challenge the sacred cows. Audit where it’s politically sensitive. That’s where risk hides.
4). Think in systems, not silos. See how finance connects to IT, how ops links to brand, and how weak governance creates strategic risk. Map interdependencies.
5) Be an intelligence asset, not a compliance officer. Deliver insights the board didn’t expect. Become their early warning radar, not just a post-mortem technician.
Don’t be the auditor who only checks the four strong locks. Be the one who finds the fifth, the quiet weakness no one dared to see. If you want to be trusted in the future, be feared for what you see today.
Start now, audit the invisible, challenge assumptions, anticipate danger, and bring it to the attention of the leadership.
That is what makes you special – anticipating what could go wrong and making recommendations to prevent it and prepare for it.
I remain, Mr. Strategy.
