He was not a criminal.
He was respected. Warm.
The kind of CFO who remembered your children’s names.
The data still said what it said.
Twenty years in this profession taught me one uncomfortable thing.
The most dangerous auditor is not the aggressive one.
It is the kind one.
The one who softens a finding because the auditee was generous.
The one who writes “opportunity for improvement” when he means “control failure.”
We call this maturity.
It is avoidance wearing a good suit.
In 1896, Lord Justice Lopes handed us our favourite excuse.
Re Kingston Cotton Mill: an auditor is a watchdog, not a bloodhound.
We have hidden behind that line for 130 years.
But the leash was cut long ago.
Section 143(12) of the Companies Act, 2013 does not ask an Indian auditor to be polite. It obliges him to report fraud.
Politeness is no longer a standard. It is an exposure.
A mid-tier manufacturer was expanding from Coimbatore to Jakarta.
Two places I know in my bones. One gave me my language. The other gave me my career.
Their internal audit file was clean. Three years running.
Not because nothing was there.
Because nobody wanted to be the one who questioned a regional CFO everyone admired.
We ran analytics across cross-border procurement.
No hunting. No theory. Just the ledger, read honestly.
14% capital leakage. Synthetic vendor invoices.
I did not feel brave that night. I felt sick.
The ground is shifting under all of us.
The IIA and AuditBoard surveyed 370+ senior North American audit leaders (Feb 2026):
85% rate AI-enabled fraud a moderate-to-high risk
Fewer than 4 in 10 believe their function is prepared to detect it
65% flag fabricated invoices as a top threat
In Indonesia, OJK’s Anti-Scam Centre has logged 636,014 fraud reports since Nov 2024. AI-indicated cases rose from 13 in late 2024 to 1,366 by mid-2026.
Your controls were designed for humans who make mistakes.
They are now facing machines that do not.
What an audit committee must settle this quarter:
Constrain AI audit parameters to factual anomalies. Tune it aggressive and your watchdog becomes a bloodhound.
Cross-reference source data. Never test management’s report against management’s summary.
Automate vendor master and invoice verification. Synthetic identity is now cheap.
Audit is not the art of keeping the peace.
It is the courage to let a transaction speak.
Do it properly and you will not be everybody’s friend.
You will be somebody’s protection.
To the CFOs and audit committee members reading this: is your internal audit stress-testing your governance, or delivering comfort?
Lift as you Rise.