Ten Lessons Learned from a Career in Internal Audit

After more than 45 years in and around the internal audit profession, I’ve had plenty of time to reflect on what I’ve learned—often the hard way. Like most people, I didn’t pick up these lessons in a classroom. They came through experience, missteps, and moments that didn’t always go quite the way I expected. While everyone has to learn some things firsthand, sharing a few of these lessons may help others shorten that learning curve.

Like many auditors, I didn’t originally set out to build a career in internal audit. As a junior in college pursuing an accounting degree, I landed a cooperative education role as an entry-level internal auditor at a bank. The program alternated semesters of work and school, and by the time I graduated, I had accumulated about 10 months of experience. Up to that point, I didn’t even know internal audit was a career option. That early exposure led to a long and unexpected career, along with opportunities in strategic planning, mergers and acquisitions, and investor relations—experiences that broadened my perspective in ways I didn’t fully appreciate at the time.

What follows are ten lessons I learned along the way—many of them later than I would have liked.

  1

The Best Internal Auditors Have Spent Time Outside Internal Audit

If you spend most of your career in internal audit, it’s easy to see the organization primarily through the lens of risk and controls. While that perspective is important, it’s not how operating managers or senior executives typically view the business on a day-to-day basis. Their focus is often more on growth, performance, and navigating competing priorities under pressure.

Spending time outside internal audit—particularly in a leadership role—provides a broader understanding of how decisions are made and what trade-offs look like in practice. When you return to internal audit, you bring a more balanced perspective that makes your work more relevant and practical. In my case, time spent in strategic planning, M&A, and investor relations was invaluable in helping me see the organization as more than a set of risks that needed to be controlled.

  2

Being Right Doesn’t Mean You’ll Win

Early in my career, I assumed that if I had my facts straight, my conclusions would be accepted. I believed that being right was enough. That assumption didn’t last long.

Audit clients often challenge audit “findings,” sometimes strongly and not always on purely logical grounds. I learned that facts alone don’t carry the day. How you communicate those facts matters just as much as the facts themselves. You need to understand your audience, anticipate where pushback might come from, and present your message in a way that can be heard.

This also requires staying calm and composed when discussions become tense. Over time, you learn that influence comes not just from accuracy, but from credibility, empathy, and delivery.

  3

You Can’t Invest Too Much in Relationships

Like many in the profession, I’m naturally introverted, and early in my career I didn’t prioritize relationship building. In fact, I often avoided it. Too many times, the first substantive interaction I had with an audit client came when it was time to share observations—sometimes ones they strongly disagreed with.

That approach rarely works well. Relationships built over time create a foundation that makes difficult conversations more productive. When people understand your intent and know you’ve taken the time to engage with them, they’re more open to what you have to say. Any successful chief audit executive (CAE) invests a good portion of their time developing, maintaining, and sustaining relationships.

This was reinforced by mentors who encouraged me to invest more intentionally in relationship-building. If it doesn’t come naturally, it’s worth scheduling time for it. Conversations that have nothing to do with the immediate audit can pay dividends later when it matters most.

  4

Difficult Situations Can Improve over Time

At some point, everyone encounters situations at work that feel unsustainable—a challenging boss, excessive pressure, or organizational issues that seem unlikely to improve. Maybe you dislike your boss, the CAE is clueless, or the audit committee is not giving internal audit the attention it deserves. Early in my career, I reacted quickly to these moments, assuming they needed to be fixed immediately, and when unaddressed I easily grew very impatient.

Sometimes leaving is the right decision. However, more often than I expected, situations improved with time. Leadership changes, priorities shift, and dynamics evolve. What feels untenable in the moment doesn’t always remain that way.

The key is to balance patience with judgment. Not every situation is worth enduring, but not every challenge requires an immediate exit either. Moving too quickly can lead to trading one set of problems for another. Remember, the grass is not always as green at a new company as it may initially seem.

  5

“Trust but Verify” Sends Mixed Signals

“Trust but verify” is a phrase that comes up frequently in internal audit, and for a long time I used it myself. On the surface, it sounds reasonable. In practice, it can send a conflicting message.

If you tell someone you trust them but then independently verify their actions, the trust you expressed may not feel genuine. From their perspective, the message is unclear at best. A simple analogy makes the point: if you told someone you trusted them but then checked up on them behind the scenes, the relationship would likely suffer once that became known.

As internal auditors, skepticism is part of the role, and verification is necessary. But it’s more straightforward to acknowledge that reality rather than frame it as trust. Clarity in how you approach this can help avoid unnecessary confusion or tension.

  6

Avoid Blindsiding Audit Clients Whenever Possible

Early in my career, I tended to complete internal audit work and then present all “findings” at the end of the process. That approach often led to difficult conversations, as stakeholders were hearing significant issues for the first time.

Most people don’t respond well to unexpected negative news. A more effective approach is to communicate early and throughout the audit. Sharing observations as they develop gives stakeholders time to absorb the information, provide context, and begin addressing issues.

By the time you reach the final discussion, there should be no surprises. This approach leads to more constructive dialogue and better outcomes overall.

  7

Less Is Usually More

Internal audit involves extensive work—testing, analysis, and documentation—that supports your conclusions—work that you are, rightfully, quite proud of. It’s natural to want to share that effort, but most stakeholders are not looking for that level of detail.

They want clear conclusions, relevant insights, and practical recommendations. Providing too much information can obscure the key message rather than strengthen it. This was a lesson I learned through experience, particularly in meetings and written reports that were more detailed than necessary.

When stakeholders trust your work, clarity and brevity become more valuable than volume.

  8

What’s Obvious to You Isn’t Always Obvious to Others

By the time auditors reach a conclusion, they’ve spent significant time immersed in the details. The result can feel obvious after that level of analysis. However, the people you are communicating with haven’t gone through that same process.

That gap in perspective means you need to be intentional about how you present your conclusions. Organizing information clearly and providing the right level of context helps others understand not just what you’re saying, but why it matters.

This applies equally to written reports and verbal discussions. Taking the time to structure your message improves how it is received.

  9

Strategic and Linear Thinkers Process Information Differently

Midway through my career, I participated in a leadership program that highlighted different thinking styles. I learned that I tend to think strategically, processing information several steps ahead and connecting ideas quickly.

At the same time, I came to appreciate that many people think more linearly, preferring to move step by step through information. Neither approach is better, but the difference can create friction if it isn’t recognized.

Understanding how someone processes information allows you to adjust your communication. Without that adjustment, it’s easy to either overwhelm or frustrate your audience.

Adapt to the Other Person’s Style

Ultimately, effective communication comes down to flexibility. If you present information only in the way that makes sense to you, your message may not land as intended.

Some people prefer a direct, concise approach, while others value a more conversational lead-in. Some want detail; others want just the key points. Recognizing and adapting to these preferences is essential.

If you’ve invested in relationships, you’ll have a better sense of how to engage effectively. Adapting your style isn’t about changing your message—it’s about ensuring it is understood in a way that is comfortable to the recipient of that message.

Beyond Internal Audit

This list could easily be longer, but these are the lessons that had the greatest impact on my career—many of which I wish I had learned earlier. While they come from internal audit, they extend beyond the profession and can easily apply to how we communicate, build relationships, and navigate organizations.

Whether internal audit is a stepping stone or a long-term path, applying these lessons can help make that journey more effective and, hopefully, a little smoother. 

Hal Garyn is Contributing Editor at Internal Audit 360°, and Managing Director and Owner of Audit Executive Advisory Services, LLC based in FL.