Internal audit: the expert in providing comfort to the audit committee. The case of risk management and internal control

This study investigates to what extent audit committees feel uncomfortable about risk management and internal control, and focuses on how internal audit can be the expert in providing comfort in these areas, building upon the sociology of professions literature. Four case studies reveal that audit committees need comfort with respect to the control environment. Thanks to their internal position, their familiarity with the company, and their position close to people across the company, internal audit seems to be the most suitable one to provide comfort and be the ‘guard of the corporate culture’. Furthermore, audit committees need comfort regarding the internal controls in high-risk areas. Besides internal audit’s assurance role, active involvement in the improvement of these internal controls provides a significant level of comfort to the audit committee. Their unique conceptual and companyspecific knowledge about risk management and internal control, combined with the right inter-personal skills, enables internal audit to provide this comfort. Formal audit reports and presentations, together with informal contacts, seem to be important ways of providing this comfort. Finally, it becomes clear that the overall level of comfort in the audit committee can be enhanced through a ‘joint audit approach’ between internal and external audit.