A 2007 article in The Economist reported that “[a] large number of both IT and non-IT executives say that the primary obstacle to alignment is a poor understanding among business leaders of how IT should support business objectives.” The article further reports that the “perception is reversed when it comes to how well IT executives understand the business. Only 24 percent of IT executives identified IT’s lack of business understanding as a chief obstacle, whereas 33 percent of non-IT executives perceived this to be the case.”

Occasionally, internal auditors stumble upon a “find of the lifetime” when they discover that several employees in their company have been surreptitiously bilking the business for millions of dollars. These auditors are given a red carpet, a bigger office, and celebrity-like treatment; they might even find their names in a forensic accounting textbook one day. But let’s be honest, how many of you can put that on your resume?

The recently reported cases of internal control deficiency can be traced to the detection failures of internal and external audit activities worldwide. The tools in the hands of modern day auditors, whether internal or external, are not adequate to the changing business scenarios in which they perform. It does not mean that the traditional tools are not effective. They proved their worth and still prevent large-scale internal control failures. However, many of the cases of reported control deficiency can be traced to tone at the top — technically a part of the control environment of the organization.

Three “S” words govern internal auditors’ thinking about themselves and their profession: survival, status, and substance. For the past 20 years, we have worried perhaps excessively about survival and status, and not enough about substance.