Several practical examples at Novartis illustrate that, depending on location, scope and topic, internal auditors must adopt specific approach techniques.
They can either act as police officers, providing assurance that the rules within an organization are applied and “punishing” those who don’t comply, or act more as doctors, diagnosing in a more constructive way organizational problems and prescribing treatments to make the organization better and avoid chronical diseases.
While both roles include risks of overpromising and under delivering, they also have some benefits, which, in combination, could maximize the impact of the value proposition of internal audit.
In the end, the best approach might be the one or the other... or a combination of both.
Former Head of Internal Audit