As the Fifa World Cup 2026 kicks off, it suddenly struck me that the worlds of internal audit and football have more in common than you may think. Let me explain.
In football, the aim is to outperform the opponent team. In other words, to score goals and win.
The mission of internal audit, according to the International Professional Practices Framework, is ‘to enhance and protect organisational value by providing risk-based and objective assurance, advice, and insight’. Success in this world is measured by strong governance, effective risk management, sound internal controls and value-added outcomes.
If internal audit gets it right, the company wins
This may not sound exactly the same as an average soccer match, but it boils down to this: if internal audit gets it right, the company wins.
In both cases, achieving the objective depends on each member or component of a team performing their role well. Let’s look at a few key positions and set pieces.
Goalkeeper
In football, the goalkeeper is the final line of defence. In my world, it’s the internal audit charter.
The charter defines the purpose, authority and responsibility of internal audit, protects it from management interference and grants unrestricted access to records, systems, assets and personnel. Just as a reliable goalkeeper builds confidence across the team, a strong audit charter establishes credibility, authority and trust across the organisation.
Defenders
The defenders’ job is to prevent the opponent from advancing and scoring. Their discipline and good positioning reduce the likelihood of the team conceding goals.
Weak or poorly enforced policies are like defenders out of position
In business, the organisation’s policies, procedures and control frameworks are the first line of defence. When policies are well-designed, communicated and enforced, they significantly reduce control failures and fraud. Weak or poorly enforced policies are like defenders out of position – creating gaps that expose the organisation to risk. It’s internal audit’s job to make sure that the defenders of the business are working as they should.
Midfielders
Midfielders are the engine of a football team. They defend, attack and control the tempo of the team.
Risk assessment and continuous monitoring are the midfielders of internal audit, identifying emerging risks and control weaknesses, and escalating red flags. And, just as midfielders deliver precise passes to strikers, effective risk assessment delivers actionable insights that could have a significant impact on the business. The crowd may not go crazy, but it’s a potential win in both cases.
Forwards
Forwards and strikers convert opportunities into goals.
Goals, in the world of internal audit, mean value creation
Goals, in the world of internal audit, mean value creation. We create value by identifying financial losses, fraud or operational inefficiencies, and by making recommendations that enhance risk management and performance. Efficiency and decision-making improve as a result – and everyone wins.
Free kicks and corners
Free kicks and corners are often decisive moments that change the outcome of a match.
Our equivalent in internal audit are advisory engagements and other special-purpose or management-requested audits and investigations. These can deliver a high-impact outcome, such as early fraud detection, often with results far greater than the effort involved.
The manager
Who would be a football manager? They have ultimate responsibility – defining strategy, selecting players, adjusting tactics – and absorb most of the blame if something goes wrong.
Internal audit managers may have a lower profile but also hold significant responsibility – for allocating resources, developing the competence of teams and upholding the Institute of Internal Auditor’s Code of Ethics.
But the most important role for both is making sure that the goalkeeper, defenders, midfielders and strikers operate as a single cohesive unit. Because that’s what it takes to win.
