Norman Marks’s World-Class Internal Audit: Tales from My Journey is a former chief audit executive’s book of stories: short accounts of the audits, interviews, reports, mistakes and conversations that, in his telling, shaped the way he led internal audit functions for about twenty years. Marks published it through CreateSpace in August 2014, after he retired in early 2013, and he later described it as the first book in a series. He has called it the background to the ideas he set out more formally in Auditing that Matters (2016) and in a maturity model for internal audit (2019). The stories he has published from it come from his years in public accounting, from information technology management at a savings and loan, and from his time as chief audit executive, notably at the refiner Tosco. Their lessons are about judgement more than technique: when an auditor should tell the audit committee that a high risk is not worth fixing, why a board-approved policy can be too cautious, what a recommendation copied from a textbook costs, and how to hire, write and speak so that executives listen.
For an internal auditor the value of the book is that it shows principles at the moment they were learned, in situations most practitioners will recognise. This guide summarises it without reproducing it. We could not obtain its table of contents, so the guide works from the passages Marks has published on his blog as excerpts from the book and from a contemporary account of the function he ran at Tosco, and it says which is which. It sets the stories against the 2024 Global Internal Audit Standards, maps their lessons to the way a function hires, reports, rates risk and measures itself, and ends with a worked example in which a hospital system’s audit function tests its own habits against them in 2027. The Auditing That Matters summary covers the method the stories led to, and this guide does not repeat it.
In this guide
- The book in one page
- Who Norman Marks is, and how the book came about
- The structure: stories, not chapters
- Risk judgement: the high risk not worth fixing, the cautious policy, the textbook finding
- Communication and people: writing, teaching, listening and hiring
- What world-class meant: the function behind the stories
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: a habit-by-habit map
- The criticisms, and what the book leaves out
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Ashgrove Health System tests its habits
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is it? | A collection of short stories from Marks’s career, with his reflections and comments from people who worked for him, published in 2014 after he retired. |
| Who is it for? | Practitioners and audit leaders who want to see how one chief audit executive’s views were formed. Marks hoped it would be an easy, entertaining read that would help readers think about their own careers. |
| What are the stories about? | Public accounting, IT and information security management at a savings and loan, and internal audit leadership, notably at Tosco: audits, job interviews, reports, policies and conversations, including his own mistakes and embarrassments. |
| What is the main lesson? | In our reading, that internal audit earns its standing by taking the business’s view: judging a risk as an owner would, saying when a risk is worth accepting or a policy is too cautious, and speaking the language of the people it serves. |
| What does world-class mean here? | The recognition that audit committees, executives and peers gave his functions for the value they delivered; and, in his own reflection, a standing that has to be earned again as expectations rise. |
| How does it relate to his other books? | It is the first of a series: it explains how he came to his approach, Auditing that Matters explains how to put it into practice, and Is your Internal Audit World-Class? lets a function assess itself. |
| Why read it as an auditor? | Because the situations recur in every function: the high risk not worth fixing, the over-cautious policy, the finding taken from a checklist, the executive who will not listen. The Standards now address several of them, for example Standard 11.5 on communicating the acceptance of risks. |
| Reading time | Our estimate is two evenings; Google Books lists the paperback at 244 pages. |
Who Norman Marks is, and how the book came about
According to a 2021 interview profile, Marks spent ten years in public accounting at the firm that is now PwC and about five years as a vice president in information technology, and led internal audit for roughly two decades. A 1998 profile in the Journal of Accountancy records that he had joined Tosco, a petroleum refining and marketing company with $15 billion of sales by then, as general auditor in 1990. His blog names Solectron, Maxtor and Business Objects among the other companies where he was chief audit executive. At Business Objects he also oversaw the Sarbanes-Oxley section 404 programme and implemented a risk management programme, and in 2008 SAP appointed him vice president of governance, risk and compliance for Business Objects, by then an SAP company. His published biography adds roles as chief risk officer, compliance officer and ethics officer, and leadership of what is now called IT governance, including information security and contingency planning.
His credentials are the CPA and the CRMA. He won the IIA’s Thurston award for his articles in 2004 and 2014, is a fellow of OCEG and an honorary fellow of the Institute of Risk Management, and was inducted into the IIA’s American Hall of Distinguished Audit Practitioners in 2018. He retired in early 2013 and has since written books on internal audit, risk management, technology risk and Sarbanes-Oxley, as well as novels, and has kept up a blog that he was still writing in October 2026. His later books for internal auditors include Auditing that Matters (2016), the maturity model Is your Internal Audit World-Class? (2019), a pair of case-study volumes (announced in 2020), and Auditing at the Speed of Risk with an Agile, Continuous Audit Plan (2022).
The book came out of retirement. Announcing it on 13 August 2014, Marks wrote that he had found the time to collect stories from his professional life that had shaped him as a leader and his approach to internal audit. Some were amusing, he said, and others were learning experiences, including mistakes and embarrassments. The book also carries comments and observations from people who had worked for him, some of whom had followed him from one company to another. Its description presents it as an account of the experiences that led audit committees, executives and peers to recognise him as the leader of world-class internal audit teams, and the launch post illustrates that recognition with praise from unnamed executives and audit committee members and with the note that his team was the first internal audit function profiled in an online best-practices repository begun by Arthur Andersen and continued by Protiviti. In 2020 Marks placed the book at the start of a series: it explains how he came to his approach, Auditing that Matters explains how to achieve what he considers world-class practice, and the maturity model lets readers assess their own. The Auditing That Matters summary covers the second book.
The structure: stories, not chapters
We could not obtain the book’s table of contents. Google Books lists the paperback but offers no preview or contents, the bookseller pages we could reach have none, and the author’s own announcement identifies only one chapter: the story he excerpted at launch comes from chapter 5, on the value of writing and teaching. A post the following month names a second, a chapter on auditing forward, and publishes a passage from it. This guide therefore does not describe the book chapter by chapter or say which chapter covers what. What can be verified is the material Marks has published from it on his blog between 2014 and 2022, each passage introduced as an excerpt from the book. One 2018 post gives the title as World-Class Risk Management: Tales from my Journey, but its link points to this book’s ISBN, and none of his other books carries that subtitle. The table lists the excerpts this guide draws on. The third column gives Marks’s own lesson, or ours where it is marked as such.
| Setting | The story, in our words | The lesson | Published on his blog |
|---|---|---|---|
| Public accounting, at Coopers (chapter 5) | His paper on the business potential of microprocessors did not satisfy his boss until he explained it in person and dropped the jargon; teaching new staff later made him master the fundamentals | Write and speak for the audience, in plain language, with examples and diagrams | August 2014 |
| IT management at a large savings and loan | An IT auditor reported as a serious weakness that dial-up numbers were not changed at least quarterly, citing a book by an IBM specialist and ignoring the layered controls and the cost | Our reading: a criterion from a book is not a criterion until it has been tested against the organisation’s own risks and costs | January 2018 |
| His interview at Tosco | The audit committee chair tested whether he would stand up for himself, then asked what he read rather than what he had done | Hire for the ability to think; Marks adopted scenario questions for his own interviews | December 2014 |
| A treasury audit at Tosco | An auditor sent to get the treasurer to smile found an overnight-cash policy far more cautious than the company’s commodity trading; the policy was changed | The aim is to take the right risk, not to eliminate risk | July 2022 |
| An information security audit at Tosco | A legacy data centre was rated high risk, but with closure planned Marks told the audit committee he recommended only monitoring the migration | Take a business perspective; accepting, or even increasing, some risk can be right | January 2018 |
| Lunch with a risk association’s president | The president could not get time with his chief executive; Marks found him dull to listen to | When management will not make time, the speaker is probably the problem; speak the language of the business | May 2018 |
| Reflections on the profession | Being recognised as world-class is no reason to stop; the leading edge of the profession is thin | Never be satisfied; learn from other functions | September 2014 |
Read together, the excerpts show the book’s shape better than a contents page would. Each story turns on a moment at which the conventional audit response was available and Marks, or someone who taught him, chose a different one. The next two sections group them into two themes, risk judgement and communication; the third looks at what world-class meant in the function Marks ran at Tosco, using a contemporary account rather than his memory.
Risk judgement: the high risk not worth fixing, the cautious policy, the textbook finding
One of the Tosco stories concerns an information security audit of the data centre in Concord, California, that ran the refining company’s legacy financial and other applications. Marks and his IT auditor found that the old COBOL applications, which their vendor no longer supported, were secured only within the applications and only for online transactions; the overnight batch jobs that accessed the application files had no security at all. They rated the risk high. But management planned to close the centre and move production to a new data centre at the Bayway refinery in New Jersey, replacing the legacy systems as it did so, and an upgrade in the meantime would have been costly. Marks told the audit committee, with the chief executive and the chief financial officer present, that the area was high risk and that he recommended no action beyond monitoring the migration. The executives, he writes, were astonished that a chief audit executive would decline to recommend action on a high risk. His answer was that he would not have made the investment if the company were his. The lesson he draws is that internal auditors must take a business perspective, and that accepting, or even increasing, some risks can be the right course.
In the 2018 post that published the excerpt, Marks added that the audit led to no major change but markedly raised senior management’s and the board’s respect for internal audit. One reader’s comment under it stressed that the board should be told whenever a high risk is not brought within acceptable levels, so that its acceptance is informed; the criticisms section below takes up the others. The 2024 Standards give that point a standard of its own, 11.5, Communicating the Acceptance of Risks, and the guide to risk acceptance by management sets out the process. In our reading the story and the Standard are compatible: Marks made his recommendation to the audit committee, in front of the executives, not around it.
The second Tosco story runs the other way. Before Marks joined, he writes, the company had been, in his phrase, leaking cash, and its treasurer had held meetings twice a day to make sure there was enough to get through the next. When Marks assigned an auditor to treasury he gave her two objectives: to assess whether treasury met the corporation’s needs, and to get the treasurer, a respected, disciplined and gruff executive, to smile. She found that the board-approved investment policy restricted overnight cash to the safest investments, with the lowest returns, while the company’s trading desk was allowed speculative trades in commodity derivatives worth several million dollars, and made money on them consistently. Her question was why a company willing to take large risks in commodities would take none on its overnight cash. The treasurer agreed, reluctantly and on business grounds, he and the chief financial officer changed the policy, and at the final review he gave the auditor a reluctant smile. Marks’s lesson is that the aim is not to eliminate risk but to take the right risks, weighing the potential downside against the upside and the cost of acting; he adds that management decides how much risk to take, and that internal audit can challenge the decision. The guide to auditing treasury and the guide to risk appetite statements show where that challenge fits in an engagement today.
The third story is about a finding Marks received rather than one he wrote. At a large savings and loan, where he had led the IT audit team before moving into IT management with responsibility for information security, an IT auditor he had once hired audited the security programme and reported as a serious weakness that the dial-up numbers for remote access were not changed at least quarterly. Marks’s response set out what the finding ignored: callers needed a user ID and password and were locked out after three failed attempts; the operating system, applications and databases each required further authorisation; frequent changes would lead users to write numbers down, forget them and call the help desk, at a cost likely to exceed the reduction in risk; and the automatic dialling tools that hackers used would find the modems anyway. Asked why the change was needed, the auditor cited a book by a well-known IBM specialist. His manager, an IT audit director hired from outside, told him to keep the finding, and it came out only after the head of internal audit read Marks’s written response. Marks republished the story in a 2018 post on bad audit reports.
| The story | The conventional response | What Marks did or argued | Where the 2024 Standards bear on it (our mapping) |
|---|---|---|---|
| Legacy data centre security at Tosco | Rate the risk high and recommend remediation | Rated it high, recommended only monitoring the migration on cost grounds, and said so to the audit committee | Standard 11.5, Communicating the Acceptance of Risks: the decision is made in the open and the board hears it |
| The overnight investment policy | Test compliance with the board-approved policy | Questioned the policy itself against the company’s appetite for commodity risk | The Purpose of Internal Auditing includes advice and insight; Standard 9.1 on understanding governance, risk management and control processes |
| Dial-up numbers at the savings and loan | Apply the control the textbook recommends | Weighed the layered controls, user behaviour and cost against the risk reduction | Standard 13.4, Evaluation Criteria, and Standard 14.4, Recommendations and Action Plans |
The three stories make one argument from different directions. In the first the auditor declines to recommend a fix the business does not need; in the second he asks the business to take a risk it is avoiding; in the third an auditor recommends a fix on the authority of a book rather than an assessment. The common thread, in our reading, is that a recommendation is a business decision and has to be argued as one, with its cost in view. That is harder than applying a checklist, and the dial-up finding survived review until the head of internal audit read the response. The guide to writing recommendations management can implement and the guide to evaluating management responses cover the two sides of the same discipline.
Communication and people: writing, teaching, listening and hiring
The chapter Marks chose to excerpt at launch, chapter 5, is about the value of writing and teaching, and it goes back to his public accounting years at Coopers. Working in a group there called CAG, he saw business potential in microprocessors and wanted to explain it to his colleagues. He wrote a paper with diagrams; his boss was not satisfied with the early drafts, and both grew frustrated. The advice that broke the impasse came in two parts: explain in person why the subject matters, then write down what you said; and avoid technical jargon or explain it plainly. The revised paper was longer, and everyone understood it. Later that year Marks taught at an off-site training session for the group’s new staff and found that teaching forced him to master the fundamentals and to use plain English. The rules he later set for his own staff follow from both experiences: write and speak for the audience, tell it what it needs to hear, in language it understands, with examples and diagrams, and master the fundamentals first. The guide to writing for the board and the guide to reports people actually read are the current versions of those rules.
A second communication story turns the lesson on a listener. After Marks spoke at a risk management association’s conference, its president asked him to lunch to discuss a problem: he reported directly to his chief executive but found it hard to get time with him, and when they met the chief executive seemed uninterested and reluctant to act on his recommendations. Over lunch Marks realised that he did not want to listen either. The president spoke in a monotone, without passion, in technical rather than business language. If Marks found him hard to listen to, a busy chief executive would too. His conclusion is blunt: when management does not make time to talk, the professional asking for the time is the likeliest problem, and the remedy is to talk about what matters to the business, in the business’s language, and to show how it affects the listener. He made a related point in 2017 when recommending Richard Chambers’s Trusted Advisors: a world-class auditor should be able to hold an hour’s conversation about the business with an executive without using the words risk or control. The Trusted Advisors summary covers Chambers’s attributes.
The hiring story begins with Marks’s own interview at Tosco. The chairman of the audit committee, a vice chairman of Bear Stearns, opened by asking why Marks had postponed the interview twice, which Marks took as a test of whether he would stand up to him and for himself. Then, instead of asking about his experience, he asked what Marks read: a way of finding out how his mind worked, whether he was open to new ideas, whether he could work with management without antagonising it, and whether he had the intellect to advise top management. Marks adopted a version of the method. After comfortable questions about the candidate’s background and motives, he would describe a real situation and ask how the candidate would approach the audit. A candidate who asked questions to understand the underlying risks earned credit; one who asked for the audit programme ended the interview. The right answer did not have to match his own approach; what mattered was whether the candidate could reason through an unfamiliar situation. His worst hires, he admits, came when he trusted a résumé, or a direct report’s hiring judgement, too far.
| Practice | What Marks did or required | How a function applies it now |
|---|---|---|
| Explain first, then write | Say in person why the subject matters, then write down what was said | Agree the message of each finding orally with the client before drafting; the executive summary guide gives the one-page form |
| Plain language | No jargon, or jargon explained; examples and diagrams | A short style rule in the methodology, checked at review |
| Teaching as mastery | Teaching new staff forced him to master the fundamentals | Each auditor teaches one internal session a year on an area they have audited |
| The business’s language | The executive who will not listen is a signal about the speaker | Board and executive reporting written around objectives rather than control vocabulary; the guide to presenting to the audit committee |
| Hiring for thinking | A scenario question; asking for the audit programme ended the interview | A scenario round in every interview; the case study interview guide |
| Distrust of the paper record | His worst hires followed over-reliance on résumés or a direct report’s judgement | Structured panels and references that test reasoning, not tenure; the manager and director interview guide |
| Customers who smile | An audit objective to get the treasurer to smile | Feedback from the client at the close of each engagement, reported in the function’s measures |
What world-class meant: the function behind the stories
The stories describe moments; a contemporary account shows the function they came from. In November 1998 the Journal of Accountancy profiled Marks’s department at Tosco, which then had $15 billion of sales, 27,000 employees and a 22-person audit staff. The department generally did not audit past transactions; his job, Marks told the magazine, was to audit the present and to provide protection for the future. It concentrated on key risks rather than whole operations, a step he called using a laser rather than a shotgun. It hired mainly managers and some seniors and had dispensed with lower-level staff positions. Its auditors decided on the job whether the risk in an area was low enough that no audit was needed, and were encouraged to spend more or less time as the work required. Marks benchmarked the department against the industry, and the measure he valued most was internal audit cost as a percentage of sales: 0.017 percent at Tosco against 0.044 percent for the industry. The article reported that well over 90 percent of the department’s recommendations were implemented. Marks later wrote that the fundamentals of that approach had not changed in more than twenty years.
In August 2023, while the new Standards were still in draft, Marks set out the practices of the functions he had led, notably at Tosco, Maxtor and Business Objects, and the praise they had earned: board members who said internal audit helped them sleep at night, executives who called it a competitive advantage, and a place in Protiviti’s best-practices database. The practices were to scope audits around the controls over significant risks to enterprise objectives rather than every risk to the audited entity; to agree action items with management instead of making recommendations, because actions that management owns get done; to forgo formal follow-up of every item, and follow-up audits in most cases, in favour of discussing significant issues at regular meetings with management; and to build relationships by listening, avoiding surprises, praising good work and writing balanced reports. He then listed the provisions of the draft his functions would not have conformed with, on the risk assessment of the auditable entity, on recommendations in reports and on formal follow-up, and asked readers whether that made them less than world-class.
The final Standards, published on 9 January 2024 and effective from 9 January 2025, contain a standard on each of those subjects: Standard 13.2 on engagement risk assessment, Standard 14.4, whose title is Recommendations and Action Plans, and Standard 15.2 on confirming that recommendations or action plans have been implemented. One objection sits more easily with the final text than the 2023 framing suggests, since the title of Standard 14.4 names action plans alongside recommendations; in our reading the lightest form of follow-up is the hardest to reconcile. A function that says it conforms with the Standards, the subject of Standard 4.1, cannot treat them as optional, so Marks’s suggestion in October 2026 that a function designing itself from scratch might set the IIA’s Standards aside, at least for now, is not open to it. What it can take from the stories is the judgement underneath them, which no standard supplies. The excerpt on never being satisfied makes the same point about time: what is world-class today may be insufficient tomorrow, and a leader should learn from other functions, such as marketing and sales, and abandon a successful approach when something new appears.
| Practice | Source | What it meant in Marks’s function | The question under the 2024 Standards |
|---|---|---|---|
| Audit the present | 1998 profile | Current risks, not past transactions | Does the plan show current and emerging risks (Standard 9.4)? |
| Key risks, not whole operations | 1998 profile | A laser rather than a shotgun | Does each scope say why it is limited (Standard 13.3)? |
| Experienced staff | 1998 profile | Mainly managers and some seniors, no lower-level positions | Does the staffing mix fit the plan (Standard 10.2)? |
| Cost as a share of sales | 1998 profile | The benchmark he valued most | Do performance objectives measure value as well as cost (Standard 12.2)? |
| Agreed action items | 2023 post | Management-owned actions instead of recommendations | Standard 14.4, Recommendations and Action Plans |
| Light follow-up | 2023 post | Significant issues discussed at regular meetings | How is implementation confirmed (Standard 15.2)? |
| Never satisfied | 2014 excerpt | World-class today may be insufficient tomorrow | What will the function change this year (Standards 12.1 and 12.3)? |
Two of the practices deserve a caution. A staff of managers and seniors with no junior tier worked, by the 1998 account, for a function of 22 in a large company; Marks himself noted in 2020 that dropping junior staff had been highly controversial in the 1990s, though before Sarbanes-Oxley there was little need for that level of auditor, and in our view many functions depend on a junior tier for analytics and for succession. And cost as a percentage of sales is a measure of efficiency, not of value. Standard 12.2 on performance measurement, which Richard Chambers and Patty Miller described in 2024 as requiring the chief audit executive to develop and assess performance objectives, asks for more. The guide to audit KPIs shows how to build measures that capture both.
The nine ideas worth keeping
- A recommendation is a business decision. Argue it with its cost in view, as an owner would; the Tosco data centre story is the model.
- Saying a high risk is not worth fixing can be the right report. Marks said it to the audit committee, in the open; Standard 11.5 now deals with communicating accepted risks.
- Take the right risk, not no risk. The overnight-cash policy was a control on the wrong side of the company’s appetite; challenging it was as much internal audit’s work as testing it.
- A criterion from a book is not a criterion yet. The dial-up finding came from a textbook and ignored the organisation’s own controls and costs.
- Explain it first, then write it down. His boss at Coopers taught him to say why a subject matters before writing about it, and to drop the jargon.
- Teaching is how an auditor masters the fundamentals. The training session he taught at Coopers made him learn the subject well enough to explain it.
- If management will not listen, look at the speaker. The risk association president’s problem was his delivery, not his chief executive.
- Hire people who can think. Ask how a candidate would approach an unfamiliar audit; distrust résumés and other people’s judgement of them.
- World-class is a standing, not a status. In Marks’s view what is world-class today may be insufficient tomorrow; the function that stops changing stops being world-class.
The vocabulary: fourteen terms defined for practitioners
| Term | What Marks means | What it looks like in an audit |
|---|---|---|
| World-class internal audit | A function recognised by audit committees, executives and peers for the value it delivers | Evidence from stakeholders, not the function’s description of itself |
| Business perspective | Judging a risk and its remedy as an owner would | A cost-benefit line in every significant recommendation |
| The right risk | Neither avoiding nor eliminating risk, but weighing downside, upside and the cost of action | Testing whether a policy matches the organisation’s appetite |
| Accepting risk | Choosing not to mitigate a known risk on business grounds | A documented acceptance, reported under Standard 11.5 |
| Getting the treasurer to smile | His second objective for the treasury audit; he later asks auditors whether their audit customers smile | Closing feedback from the client on each engagement |
| Writing for the audience | Telling readers what they need to hear, in plain words, with examples and diagrams | Report rules checked at review |
| Explain, then write | Saying in person why something matters before putting it on paper | Agreeing a finding’s message orally before drafting |
| People who can think | Candidates who can reason through an unfamiliar situation | A scenario round in every interview |
| Audit the present | His 1998 description of his job: current risks, protection for the future | Engagements scoped on current processes, not old transactions |
| A laser, not a shotgun | His 1998 phrase for concentrating on key risks | Scoping memos that state what is left out and why |
| Agreed action items | Actions management owns and agrees, in place of auditor recommendations | Management action plans under Standard 14.4 |
| The language of the business | Talking about what matters to the listener, without technical jargon | Board reporting written around objectives |
| Never satisfied | Continuing to change the function after it is recognised as world-class | A yearly review of what to stop, start and change |
| Enterprise risk-based auditing | His later term for planning around risks to enterprise objectives; see the Auditing That Matters summary | Plan rows that are enterprise risks, not auditable units |
What it means for internal audit: a habit-by-habit map
The book is about one leader’s habits, so its practical value for a function lies in the processes where habits are set: hiring, reporting, rating, recommending and measuring. The map takes eight of them, with the Standards that govern each. The Global Internal Audit Standards guide sets out the full structure, and the Domain IV guide covers the standards on managing the function.
| Audit activity | What the book implies | Procedure it changes |
|---|---|---|
| Recruiting (Standard 10.2) | Hire for the ability to think, not for the résumé | A scenario round in every interview, scored on how the candidate explores the risks; the interview questions guide |
| Report writing (Standard 11.2) | Explain first, write for the reader, drop the jargon | Agree the message orally; a two-page summary for executives; plain-language checks at review |
| Rating a high risk that will not be fixed (Standard 11.5) | Saying the risk is worth accepting can be right, if said openly | A cost-benefit statement, management’s documented acceptance and a line in the audit committee report; the risk acceptance guide |
| Challenging policies | A policy can be too cautious for the organisation’s appetite | Compare appetite across related policies, for example treasury and trading, and report inconsistencies as advice |
| Reviewing draft findings (Standards 13.4 and 14.4) | A criterion from a book has to be tested against the organisation’s risks and costs | For each recommendation, record where the criterion came from and why it fits; the recommendations guide |
| Stakeholder relationships (Standard 11.1) | Clients who value the work, and leaders who will listen | Closing feedback on every engagement; meetings with executives outside the audit cycle; the Trusted Advisor Path guide |
| Measuring the function (Standard 12.2) | Value as leaders judge it, not cost alone | Performance objectives that combine efficiency with stakeholder ratings and changes achieved |
| Quality and improvement (Standards 8.3 and 12.1) | Never satisfied | A yearly stop, start and change review alongside the internal assessment; the internal self-assessment guide |
One row needs a warning. The habit of recommending acceptance of a high risk is the one most easily abused, because it is also what a function under pressure says when it does not want an argument. In our reading the safeguards are the ones Marks’s own story contains: the risk was rated high without softening, the reasoning was cost against risk reduction, the decision was put to the audit committee with the executives in the room, and the recommendation was to monitor the migration rather than to forget it. Without those four, accepting a risk is not business judgement but deference, and the independence and objectivity guide explains why the difference matters.
The criticisms, and what the book leaves out
The documented criticisms are of the stories rather than the book. Under the 2018 excerpt about the Tosco data centre, one reader doubted that recommendations based on what the auditor would do as owner are sustainable and preferred sound principles and procedures; Marks replied that the team had weighed impact, likelihood and the cost of remediation, and that management’s and the board’s business judgement was a better basis than theory. Another reader argued that the engagement was not really an internal audit and that the auditor’s first task was to say whether internal control was adequate or effective; Marks replied that the control was inadequate, that the team said so, and that the work was an internal audit with a consulting element. In our view the objections matter because they are the ones an audit committee is likely to hear from the external auditor or a regulator when a function recommends living with a high risk.
The rest is our reading. The evidence is one career, told by its protagonist, with praise from executives whom the launch material does not name; the stories are not research, and the reader has no way to hear the treasurer’s or the IT audit director’s side. The settings are large companies with experienced teams, and some of the technology, dial-up modems and unsupported COBOL, has gone, although the decisions it posed have not. The book is not a manual: one reader whose review Marks reproduced in 2022 says it is not a textbook or a source of audit programmes, and that is right. And it predates the 2024 Standards by a decade. Several of its habits now sit inside specific standards, on communicating accepted risks, on recommendations and action plans, on confirming implementation and on performance measurement, and Marks’s own later writing treats the IIA’s Standards as something a function can depart from where they do not suit it. A reader should take the judgement from the stories and the discipline from the Standards; the guide to what changed in the 2024 Standards covers the latter.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Paperback | CreateSpace Independent Publishing Platform, August 2014 (Google Books gives 12 August); ISBN 9781500791964; Google Books lists 244 pages | The edition to buy |
| E-book | Kindle edition sold through Amazon, announced with the paperback; offered free for five days in May 2024 | Reading on screen |
| Later editions | None found; the author’s pages list the 2014 edition only | — |
| Companion books by Marks | Auditing that Matters (2016), the maturity model Is your Internal Audit World-Class? (2019), and Auditing that Matters: Case Studies with its discussion guide (announced in 2020) | The method behind the stories, and a way to assess a function |
| Reading plan | Straight through in one or two sittings; then the stories again with the function’s own hiring, reporting and rating practices beside them | An audit manager or chief audit executive |
| Companion reading on this site | The Auditing That Matters summary for the method; the Trusted Advisors summary and the Speed of Risk summary for Richard Chambers’s parallel account; the Sawyer’s Guide summary for the conventional practice Marks argues with | Placing the book |
Read it with a notebook and a single question for each story: at which point would our function have done the conventional thing? The answers make a better self-assessment than most questionnaires, because they are about decisions rather than documents. Then read the same stories from the other side of the table: as the IT auditor whose finding was withdrawn, or the treasurer asked to change a board-approved policy. The book’s lessons hold up best when the reader can see why the other person was not simply wrong. The first 90 days as CAE guide describes the moment at which a new chief audit executive is best placed to change a function’s habits.
A one-hour discussion guide for an audit team
- Ten minutes: the high risk not worth fixing. Has the function ever recommended accepting a high risk? Take one current high-rated finding and decide, as owners, whether the fix is worth its cost, and how the decision would be communicated under Standard 11.5 if the answer is no.
- Fifteen minutes: the cautious policy. Pick two policies that express risk appetite in related areas, such as treasury investments and trading limits, or procurement thresholds and capital approvals. Are they consistent? If not, which is wrong?
- Ten minutes: the textbook finding. Take five recent recommendations and trace each criterion to its source. Mark any that came from a checklist or framework without an assessment of this organisation’s risks and costs.
- Fifteen minutes: explain, then write. Each auditor explains a current finding aloud in two minutes, without jargon, to a colleague playing the executive. Compare the spoken version with the written one.
- Ten minutes: the smile and the stop list. Name the last three clients who would say the function helped them, and why. Then name one practice the function should stop this year, in the spirit of never being satisfied.
Worked example: Ashgrove Health System tests its habits
Ashgrove Health System is a fictional US nonprofit with five hospitals, $2.1 billion of revenue and an internal audit function of 12. Its stakeholder survey in late 2026 was polite and flat: the function was respected for rigour, rated poorly for the length of its reports and for understanding how the hospitals make and lose money, and described by two executives as the department that says no. For the 2027 plan the chief audit executive asked each manager to take one of the lessons from the stories summarised above and test the function’s own habit against it, with results reported to the audit committee chair in the second quarter and again at the year end.
| Lesson | Ashgrove’s habit before 2027 | What the function found | What changed in 2027 |
|---|---|---|---|
| Explain first, write for the reader | Reports averaged 19 pages and were drafted before findings were discussed | Executives read the first page and the ratings; most disputes arose over wording the client first saw in draft | Findings agreed orally before drafting; a two-page summary for executives; reports fell to an average of 9 pages |
| A criterion from a book is not a criterion yet | 58 findings raised in 2026, each with a recommendation | 9 rested on a checklist or framework without an assessment of Ashgrove’s own risk or cost | 6 withdrawn after discussion with management and 3 rewritten; the source of every criterion now recorded in the workpapers |
| Accepting a high risk can be right | Every high-rated finding carried a remediation recommendation | A legacy laboratory system due for retirement in 14 months had weak interface security; a full fix would cost more than the remaining exposure | Recommendation to monitor the migration and add a compensating review; documented acceptance by the chief information officer and the chief financial officer, reported to the audit committee |
| Take the right risk | Treasury audits tested compliance with the investment policy | The policy kept all operating cash in overnight government funds while the long-term investment pool held a majority in equities | Raised as advice; the finance committee amended the policy to allow part of operating cash in a short-duration portfolio |
| Hire people who can think | Two vacancies; interviews built on résumés and certifications | Panel scores had predicted little about the last four hires’ performance | A scenario round on an unfamiliar service, a new hospital-at-home programme; 11 candidates interviewed and two hired, one from outside healthcare |
| Speak the language of the business | The quarterly report to the board was organised by audit and by control rating | Directors asked each quarter what the ratings meant for the system’s objectives | The report reorganised around the strategic plan’s objectives, with control terms explained or removed |
| Never satisfied | No review of the function’s own practices outside the external assessment cycle | Three activities produced little: a monthly activity report, a 40-item site checklist and a follow-up audit for low-rated issues | All three stopped; implementation of low-rated actions now confirmed from evidence submitted by management |
The year-end survey went to the same 40 executives and directors as the 2026 survey, and 31 responded. Ratings for report usefulness and for understanding the business each rose by about a point on a five-point scale, and neither executive who had called the function the department that says no repeated the description. The audit committee chair asked for the risk acceptance protocol to be written into the function’s methodology and its quarterly report, and for the criterion-source check to be included in the next internal assessment. The function’s measures changed too: the count of findings raised disappeared from the committee pack, and the share of findings agreed with management before the draft report, 41 percent in 2026 and 83 percent by the end of 2027, took its place.
Two decisions carry the book’s argument. The first was to treat the laboratory system as the Tosco data centre had been treated: rated high, judged on cost, and put to the audit committee in the open rather than softened or quietly dropped. That is what separates business judgement from deference, and it followed the function’s process for communicating accepted risks under Standard 11.5. The second was the stop list. Stopping the follow-up audit for low-rated issues did not stop the function confirming that actions were implemented, the subject of Standard 15.2, but it moved the confirmation to evidence submitted by management, which freed time for the advisory work on the investment policy. The guide to internal audit in healthcare and the guide to internal audit in nonprofits describe the setting in which a system like Ashgrove operates.
Frequently asked questions
Is World-Class Internal Audit the same book as Auditing that Matters?
No. World-Class Internal Audit: Tales from My Journey (2014) is a collection of stories from Marks’s career; Auditing that Matters (2016) sets out the method the stories led to. Marks describes them as the first and second books in a series. The Auditing That Matters summary covers the second.
What does Marks mean by world-class?
The standing his functions earned with audit committees, executives and peers, who described internal audit as helping them sleep at night or giving the company a competitive advantage. In the book he warns that what is world-class today may be insufficient tomorrow.
Does the book include audit programmes or templates?
No. It is a book of stories and reflections; one reader whose review Marks reproduced describes it as neither a textbook nor a source of audit programmes. For the practice behind it, read Auditing that Matters and the site’s guides on the Standards for managing the function.
Should an internal auditor ever recommend accepting a high risk?
Sometimes, and Marks’s Tosco data centre story is an example: the risk was rated high but the systems were about to be replaced and the fix was costly. Under the 2024 Standards the acceptance should be documented, and Standard 11.5 governs how it is communicated; the risk acceptance guide sets out the steps.
Are the stories dated?
The technology is: dial-up modems and unsupported COBOL applications. The decisions are not. Every function still meets the textbook recommendation that ignores the organisation’s own controls, the policy that is more cautious than the business, and the executive who will not listen.
Where does the book sit in the reading list?
Among the books on leading an audit function in the internal audit reading list, as the narrative companion to Auditing that Matters and to Richard Chambers’s books.
Related guides
- Auditing That Matters by Norman Marks: Summary and Lessons for Audit Leaders — the method the stories led to
- Trusted Advisors by Richard Chambers: Summary and Lessons for Internal Auditors — the attributes Marks recommended alongside his own
- Risk Acceptance by Management: The Right Process for Letting Issues Go — saying a high risk is not worth fixing, properly
- The Audit Case Study Round: Practicing Scenario Interviews — hiring people who can think
- Writing for the Board: Brevity, Altitude, and the Courage to Simplify — explain first, then write
- How to Run an Internal Self-Assessment of Your Audit Function — testing the function’s own habits
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- Agents of Change by Richard Chambers: Summary and Lessons for Internal Auditors — internal auditors as catalysts for change.
Leave a Reply