I thought it was me... I was the internal auditor who would raise a lot of meaty actions which needed addressing.
But I saw a Linkedin post recently where the author said they are increasingly finding that they go into sites and see minimal internal audit actions raised. Often less than 10 across all audits in a year.
Their interpretation, which I think I share is that people are focusing on getting the audit done, getting the actions done (as that is what they are judged on rather than how good the audit is.)
When I've gone to sites there has been at least one thing (often more) where I've thought "this is beyond a fresh pair of eyes, why have you not seen this?" It's rare I don't at least raise a recommendation that internal audits could be more challenging.
But then I think back to all the business I have left as I've not been prepared to do something I've felt is not ethically sound. I'm starting to wonder. These businesses that have the massive outbreaks, was it, as many of us have assumed here, that the technical people raised issues and weren't listened to? Or is it perhaps that at least some of our techie colleagues (who, let's face it probably aren't on this forum), are now just letting things go, having an "easy" life because otherwise their jobs or sanity will be threatened?
I don't know. I just get the sense with techies I meet in the real world that many started out idealistic but now have given up and gone too far to pragmatism, just to pass the audits, get the tick in the box and go home. It's probably better than burning out at least for them but...
