One of internal audit's values is to tell management when the controls to manage risks and assure opportunities aren't working.