The Auditor Who Was Never Heard

The internal auditor of a Caribbean commercial bank had been raising concerns for two years. Her quarterly reports documented control weaknesses in the bank’s trade finance operations: inadequate segregation of duties in letter-of-credit processing, incomplete documentation of correspondent banking transactions, and gaps in the know-your-customer procedures applied to trade finance counterparties. Each report was submitted to the chief financial officer, to whom she reported directly. Each report was acknowledged. None prompted meaningful action.

The internal auditor requested a meeting with the audit committee on three separate occasions. Each request was routed through the CFO, who advised that the committee’s agenda was full and that the matters could be addressed through management’s corrective action plan. The corrective action plan, now eighteen months overdue, existed only as a draft document on the CFO’s laptop.

When a correspondent bank initiated its periodic due diligence review, the control weaknesses that the internal auditor had documented were identified independently. The correspondent bank’s risk committee, unable to gain assurance that the deficiencies were being remediated, reduced the bank’s transaction limits and placed the relationship under enhanced monitoring. The commercial impact was immediate: the bank’s ability to process international trade transactions for its largest corporate clients was severely constrained. Two major clients moved their trade finance business to a competitor within sixty days.

In the post-incident review, the board discovered what the internal auditor had known for two years: the control weaknesses were real, the risks were material, and the failure was not one of detection but of escalation, independence, and institutional willingness to act on internal audit findings. The internal auditor had done her job. The organisation’s governance structure had prevented her work from reaching the people who needed to hear it.

This fictional scenario, while not attributable to any specific Caribbean bank, reflects a dysfunction that Dawgen Global encounters repeatedly across the region. Internal audit functions that identify risks but lack the organisational standing to ensure those risks are addressed. Auditors who report to the executives they are meant to oversee. Audit findings that are filtered, delayed, or diluted before they reach the board. Internal audit treated as a compliance checkbox rather than as a strategic governance function.

Internal Audit at a Crossroads in the Caribbean

Internal audit is undergoing a fundamental transformation globally. The Institute of Internal Auditors’ revised Global Internal Audit Standards, which took effect in January 2025, represent the most significant update to the profession’s foundational framework in over two decades. The new standards elevate internal audit’s role from a narrow assurance function focused on compliance testing and control verification to a strategic advisory function that provides the board with independent insight into risk management effectiveness, governance quality, and organisational performance.

This transformation reflects a recognition that the organisations facing the greatest risks are not those with the weakest controls but those with the weakest insight. An organisation that has robust controls but no independent function evaluating whether those controls are working, whether they address the right risks, and whether they remain adequate as the risk environment evolves is an organisation governing in the dark.

For Caribbean enterprises, this transformation presents both a challenge and an opportunity. The challenge is that many Caribbean internal audit functions are still operating under an outdated model — small teams, limited resources, compliance-focused mandates, and reporting structures that compromise independence. The opportunity is that organisations that embrace internal audit transformation can leapfrog from basic compliance-checking to strategic risk advisory, gaining governance capabilities that many of their competitors have not yet contemplated.

The Caribbean Internal Audit Reality

Under-Resourced and Overstretched: The majority of Caribbean internal audit functions consist of one to three professionals responsible for auditing the entire organisation. These small teams face impossible workloads: they are expected to complete annual audit plans covering financial controls, operational processes, regulatory compliance, IT systems, and sometimes fraud investigation — all with resources that would be considered inadequate for auditing a single business unit in a larger organisation. The predictable result is audit plans that are never completed, coverage that is superficial, and risk areas that go unexamined for years.

Compliance-Focused Rather Than Risk-Based: Many Caribbean internal audit functions remain anchored in a compliance-testing model: checking whether transactions are properly authorised, whether policies are being followed, and whether regulatory requirements are being met. While compliance assurance is valuable, it addresses only a fraction of the risks that modern organisations face. A compliance-focused internal audit function can confirm that the organisation’s travel expense policy is being followed while entirely missing the strategic risk that the organisation’s largest customer is becoming financially distressed, that a critical IT system has not been patched in eighteen months, or that a new regulatory requirement is about to take effect for which the organisation is entirely unprepared.

Compromised Reporting Lines: As illustrated in the opening scenario, the reporting line of the internal audit function is the single most important determinant of its effectiveness. The IIA’s standards are explicit: the chief audit executive must report functionally to the board through the audit committee and administratively to a level of management that supports the function’s independence. In many Caribbean organisations, internal audit reports directly and exclusively to the CFO, the managing director, or another executive — creating an inherent conflict of interest that undermines everything the function is designed to achieve.

Limited Use of Technology and Data Analytics: Modern internal audit leverages data analytics, continuous monitoring tools, and automated testing to achieve comprehensive coverage that manual audit procedures cannot match. A data analytics-enabled internal audit function can test one hundred per cent of transactions rather than sampling a fraction, identify anomalies and patterns that manual review would miss, and provide near-real-time assurance on control effectiveness. The vast majority of Caribbean internal audit functions operate with spreadsheets, manual testing procedures, and limited or no data analytics capability — a gap that becomes more consequential as the volume, velocity, and complexity of transactions increase.

Isolation from Governance and Strategy: Effective internal audit functions are integrated into the governance ecosystem: they understand the organisation’s strategy, they align their audit plans with strategic risks, they advise management and the board on emerging risks, and they contribute to the organisation’s overall risk intelligence. Many Caribbean internal audit functions operate in isolation — disconnected from strategic planning, uninvited to risk discussions, and treated as a back-office function rather than a governance partner. This isolation means the function’s work is often misaligned with the organisation’s most significant risks, reducing its value to the board and reinforcing the perception that internal audit is a compliance cost rather than a strategic investment.

The Business Case for Internal Audit Transformation

Caribbean organisations that invest in transforming their internal audit functions realise benefits that extend far beyond improved compliance. A strategically positioned, adequately resourced, and technologically enabled internal audit function provides the board with independent assurance that the organisation’s risk management framework is effective and that emerging risks are being identified and addressed before they become crises.

It provides management with objective insight into operational effectiveness, process efficiency, and control adequacy — insight that management cannot generate internally because it lacks the independence to evaluate its own performance objectively. It satisfies regulatory expectations that are becoming more demanding with each examination cycle — reducing the likelihood of supervisory findings, corrective directives, and the reputational damage that accompanies them. And it protects the organisation’s stakeholders — shareholders, customers, employees, and the communities in which the organisation operates — by providing the governance function that sits between management’s representations and reality.

The correspondent banking context adds particular urgency for Caribbean financial institutions. International correspondent banks evaluate the governance quality of their Caribbean counterparts as a factor in maintaining and pricing relationships. An internal audit function that operates with appropriate independence, follows recognised professional standards, and produces credible assurance reports is a tangible signal of governance maturity that strengthens correspondent banking relationships and international business partnerships.

Dawgen Global’s Internal Audit Modernisation Programme

Dawgen Global has developed an Internal Audit Modernisation Programme designed specifically for Caribbean organisations seeking to transform their internal audit functions from compliance-focused cost centres into strategic governance assets.

Internal Audit Maturity Assessment: Dawgen Global conducts comprehensive assessments of internal audit functions against the IIA’s Global Internal Audit Standards and international best practice, evaluating independence, competence, scope, methodology, technology utilisation, reporting quality, and stakeholder relationships. The assessment produces a maturity score and a prioritised transformation roadmap tailored to the organisation’s size, complexity, and regulatory environment.

Reporting Structure and Independence Advisory: Dawgen Global works with boards, audit committees, and executive management to design reporting structures that ensure genuine internal audit independence while remaining practical within the organisation’s governance architecture. This includes defining the functional reporting relationship to the audit committee, establishing protocols for direct communication between the chief audit executive and the audit committee chair, and creating escalation mechanisms that ensure critical findings reach the board without management filtering.

Risk-Based Audit Planning: Dawgen Global assists internal audit functions in transitioning from compliance-based audit planning to risk-based planning that aligns audit activities with the organisation’s most significant risks. This includes developing risk assessment methodologies, creating dynamic audit universes that reflect evolving risk landscapes, and building audit plans that balance assurance coverage with strategic risk focus.

Data Analytics and Technology Integration: Dawgen Global helps internal audit functions deploy data analytics tools and continuous monitoring capabilities that dramatically improve audit coverage, efficiency, and insight. This includes identifying the highest-value data analytics applications for the organisation’s specific risk profile, implementing analytics tools, training audit staff in data-driven techniques, and integrating analytics into the standard audit methodology.

Co-Sourced and Outsourced Internal Audit: For organisations that cannot justify a full in-house internal audit function — a common situation in the Caribbean’s mid-market — Dawgen Global provides co-sourced and outsourced internal audit services that deliver professional-quality assurance with appropriate independence. These engagements are led by experienced audit professionals who report functionally to the audit committee and bring specialist expertise in areas where in-house resources are limited.

From Compliance Watchdog to Strategic Advisor

The internal auditor in the opening scenario did everything right: she identified the risks, documented her findings, and attempted to escalate them to the audit committee. The failure was not hers. It was the organisation’s failure to build the governance structures that would have enabled her work to reach the people who needed to act on it.

Caribbean organisations cannot afford to repeat this pattern. The risks are too complex, the regulatory environment too demanding, and the consequences of governance failure too severe for internal audit to remain an under-resourced, under-empowered compliance function. The transformation of internal audit from compliance watchdog to strategic advisor is not optional — it is the governance imperative of the decade.

Dawgen Global stands ready to partner with Caribbean organisations in making this transformation. Whether through maturity assessments, reporting structure advisory, technology integration, or co-sourced audit delivery, our objective is the same: to ensure that the internal audit function delivers the independent insight that boards need, management deserves, and stakeholders expect.

Transform Your Internal Audit Function

Dawgen Global invites boards, audit committees, and chief audit executives to explore how the Internal Audit Modernisation Programme can strengthen your organisation’s governance infrastructure. A confidential Internal Audit Maturity Assessment is the first step toward building the audit function your organisation needs.

Request a proposal for Dawgen Global’s Internal Audit Modernisation Programme. Email [email protected] or visit www.dawgen.global to begin the conversation.

Take the First Step

Governance excellence is not achieved overnight. It is built through deliberate commitment, informed decision-making, and the willingness to hold leadership accountable to the standards that Caribbean enterprises and their stakeholders deserve.

Request a proposal for Dawgen Global’s Internal Audit Modernisation Programme.

Email: [email protected] | Visit: www.dawgen.global

This article is part of the “Governing the Caribbean Enterprise” series by Dawgen Global, examining corporate governance, risk management, and institutional accountability across Caribbean industries. All scenarios described are fictional constructions based on observed governance patterns and are used for illustrative purposes only.

About Dawgen Global