Job of 'policing' companies may fall more to insiders

Congress can pass laws, regulators can beef up enforcement, and shareholders can demand more accountability. But when it comes right down to it, making sure a company is operating well - not to mention ethically - is really an inside job.

That's where internal auditing comes in. It doesn't sound glamorous, but it's an expanding field beckoning to people with a lot of pent up we-can-do-better energy. Internal auditors keep an eye on a company's "controls" - not just financial systems, but all sorts of functions designed to make the business run smoothly and protect the interests of shareholders.

The recent string of corporate scandals provided a rude awakening to the importance of these internal checks. In the case of WorldCom, it was internal auditor Cynthia Cooper who blew the whistle on the company for inflating profits by $3.8 billion. She didn't intend to be a hero, she said to Time magazine when it named her one of its Persons of the Year. She was just doing her job.

A lot more of those jobs are opening up as companies turn to internal auditors for help in complying with the Sarbanes-Oxley Act of 2002. Top executives of publicly held companies now have to sign off on their financial statements and vouch for the effectiveness of internal controls.

"Up until now, CEOs and CFOs have been going to bed and sleeping well at night, knowing that they've got good controls or financial reporting because they've got good people.... But what's missing is the documentation that really supports that gut feel," says Trent Gazzaway, the national director of corporate governance advisory services for Grant Thornton, an accounting and business consultancy firm.

"I cannot think of a time in history when there's been a greater opportunity to enter the internal-audit field," he adds.

Job postings on the website of the Institute of Internal Auditors (IIA) in Altamonte Springs, Fla., have more than doubled in the past year, says IIA president William Bishop III. And in the organization's survey for 2002, half the internal-audit directors said they planned to make one or more new hires that year. People who can assess computerized systems are especially in demand.

Privately held companies are voluntarily adding more scrutiny, as well. In a recent survey that drew responses from 1,400 CFOs in such businesses, 58 percent said they are responding to new corporate-governance standards. Of those, 36 percent are creating or expanding internal auditing, according to Robert Half Management Resources.

An American company with $3 billion to $4 billion in revenue typically has about 16 internal auditors. The job is often a training ground for future management positions, but those who stay in the field and become directors earn an average of just under $100,000. The IIA offers certification for internal auditors, but many firms do not require it.

Assessing "the tone at the top" - the culture and the ethical environment of a company - is one of the key charges for internal auditors, Mr. Bishop says.

But their effectiveness depends on the resources and independence senior managers give them. Because auditors have a perspective that encompasses every aspect of the company, executives sometimes want to tap them to make recommendations for improving systems.

But their main goal is to make sure the systems already in place are working properly.

The balancing act can be tricky. "If I make a recommendation ... and then I come and evaluate it, I'm not going to be criticizing it," says Parveen Gupta, who teaches corporate governance and accounting at Lehigh University in Bethlehem, Pa. Ideally, the internal auditor should be an extra set of eyes, a consultant who knows the company well but has enough independence to give honest feedback.

Regulations "are pushing internal auditors to become a bit more policeman-oriented," he says, "but if employees perceive it as someone second-guessing them, that is very dangerous."

One tool designed to avoid that adversarial feeling is "control self-assessment." The auditor sets up discussions among employees to find out, for instance, if a written ethics policy is being implemented, or if workers are feeling such intense pressures that they might be prompted to push ethical boundaries.

The power of the new laws can go only so far. "This entire issue of corporate governance - trying to run the company as if you were managing your own money - is a matter of heart and soul," Dr. Gupta says.

And guts. Anyone considering a career in internal auditing, he says, "should have the guts to speak out, to tell the truth."