Auditing That Matters by Norman Marks: Are Internal Auditors Addressing the Risks That Matter?

In Auditing That Matters, Norman Marks challenges internal auditors to reconsider what makes an audit valuable.

Completing the audit plan, producing lengthy reports, and documenting control deficiencies do not necessarily mean internal audit has helped the organization. Marks argues that internal auditors must concentrate on the risks that could prevent the organization from achieving its objectives.

That distinction is important. An audit department can perform technically sound work and still spend its resources on risks that are no longer significant. A risk-based audit plan should therefore change as the organization, its objectives, and its risk environment change.

Norman Marks also encourages internal auditors to communicate the information management and the board need to make better decisions. The value of an audit is not measured by the number of findings or recommendations. It is measured by whether the work provides meaningful assurance and improves the organization’s ability to succeed.

Auditing That Matters is particularly useful for chief audit executives, audit directors, and experienced internal auditors questioning whether their audit plans remain relevant.

The book’s central lesson is direct: internal auditors should stop auditing what is merely familiar and start auditing what truly matters.