Internal audit. The quiet competence test.

I have sat through three internal audit presentations in the last eighteen months. Two were competent. One was quiet in a way that matters. The difference is not obvious until you are looking for it. The obvious version sounds confident. It presents findings in neat categories, names risks in the language the board already uses, and arrives at recommendations that feel proportionate to the problems it has named. This is good work. It is not the quietest work.

The quietest audit function is the one that has already changed the firm's behaviour before it arrives at the board table. You notice this first in the questions it does not ask. An internal audit that has been working properly in the months before any formal review will have seen the same control gap in three different operating units. It will have raised it twice informally. The third time, it will arrive at a board meeting with a pattern, not a single incident. The board hears about the pattern. What the board does not hear is the groundwork. That groundwork is the actual work.

I learned this first at Citi, where the audit function was large enough to have specialists embedded in each division. They sat in the room. They saw the same trade twice. They asked the first trader why the reconciliation was late. They asked the second trader the same question. By the time the third trader got the question, the pattern was already moving through the firm. I watched it work. It was not dramatic. No one called a meeting to announce a corrective action. The control simply tightened because the people in the room knew someone was paying attention in the way that mattered.

When you are hiring an audit partner or evaluating your internal audit team, you are looking for people who understand that detection is not the point. Correction is. A competent audit function spots a problem and waits to see if the organisation fixes it before it escalates. An exceptionally competent one makes the organisation fix it by asking the question three times in three different rooms. The second question is quieter than the first. The third question is quieter still. By the time it reaches the board, the control is moving.

This is harder to do in a small firm or a family office where the audit function might be one person, or contracted out. But the principle holds. When you commission an internal audit review, you are not buying a report. You are buying a presence that will be in the firm between now and the next formal review. The audit person who writes a careful email to the operations director about a process gap, and then follows up with the finance team to see if anyone else has seen it, is doing the quiet work. The audit person who notes the gap and waits for the board meeting is documenting, not fixing.

I ran an audit committee for a firm where the internal audit partner had been in place for eight years. She knew the business so well that she could predict which unit would struggle with a new regulatory requirement before anyone asked for a policy document. She would go and have a conversation with the head of that unit. Not to accuse them of anything. Just to talk through what the requirement meant for their day-to-day work. The conversation would often happen in a coffee shop, not in a meeting room. This was the audit function doing its job. By the time the formal compliance sign-off came round, there was nothing to fix because the fixing had already happened.

The risk is that this kind of competence is almost invisible to a board. An audit function that is working quietly looks like it is not finding anything. The board will sometimes prefer the one that surfaces more findings, because findings feel like evidence of diligence. Be cautious about this preference. A high-volume findings register might mean the audit function is reactive and good at documentation. A low-volume findings register with a history of meaningful corrections to operating behaviour means the audit function is actually embedded in how the firm works. Look at the pattern across three years. Count not the findings that made it to the board, but the ones that were caught and resolved before they needed to become findings at all.