Internal audit creates the most value when it helps leaders see risk early—not when it is treated as an enforcement unit. The moment internal audit enters a department, the atmosphere can change. Files are straightened, explanations are rehearsed and people become careful about what they say. In some organisations, internal audit is treated like the police: a team waiting for someone to make a mistake, break a rule or fail to produce a document. That perception is understandable, but it is dangerous. It reduces a valuable governance function to fault-finding and fear. It can also make employees more likely to hide problems, defend weak processes and wait until risks become crises before speaking honestly. Internal audit is not meant to patrol the organisation in search of people to punish. At its best, it is an independent early-warning system: a function that helps the board and management see whether governance, risk management and internal controls are working before weaknesse...