Impatience to Get Going Can Result in Difficulties and a Lack of Value Focus

I have every sympathy for CAEs and auditors who are under pressure to deliver the audit plan and who feel that they must “get on with” starting each assignment. There is no doubt that some audit functions can spend too long on research and thinking about what they should do, which is neither efficient nor value adding.

However, I know of a number of audit functions that have had a culture of principally using prior assignment scopes and plans, making a bare minimum number of changes and issuing these without significant management engagement. However, a number of functions that do this face subsequent problems, such as:

• Delays and inefficiencies later on in the assignment; and/or
• Disappointing feedback from stakeholders about the value from these assignments.

Not Fully Thinking Through Assignment Resourcing

An associated problem with starting assignments quickly is that the amount of resource and time allocated to an assignment is pre-determined by what was done in the past, rather than the correct cost/benefit balance on this occasion.

One CAE explained to me:

“When I first started in auditing, if you got 25 days for an assignment, you used 25 days.

You might think ‘I can probably do that assignment in 15 days’, but there was limited incentive to free up the time. So with a spare 10 days of time it used to encourage me to do things that were not particularly essential, but of personal interest, or to tidy up my files, or go home early!”

Disagreements or Changes in Relation to the Assignment’s Purpose and Scope

With my clients and at audit workshops we discuss the reality (Gemba) of assignment scoping. Many different issues emerge:

• Not being able to get any real engagement from management in relation to the scope of the assignment;
• Encountering the opposite problem: where management have very strong preferences about what the assignment should (and should not) cover;
• Encountering questions and disagreements about who is accountable for managing the risks in relation to a particular scope area;
• Finding out later in the assignment that the assignment scope needs to be changed because of a misunderstanding about its purpose.

Often Information is Not Forthcoming on a Timely Basis

Typically internal audit needs to review certain background information (e.g. business plans, risk updates, etc.) in order to develop the most value adding assignment plan.

However, some auditors experience difficulties and delays getting this information, for example:

• “Do you really need that?”
• “I need to clear that with my manager.”
• “When I get the time next week, I will dig that out for you.”

All the while the audit staff are waiting – a very clear sign of Muda.

Planning Just the Fieldwork Can Result in Issues Later on

Greg Coleman (CAE, ITG) reflects on a common problem:

“I’ve worked in teams where there wasn’t a structure of tightly planned audits, perhaps the timing of the fieldwork was planned, but not the timing of the closing meeting or final report.

However, if these final deadlines are not established early on it is very easy to end up with scope creep, with auditors wanting to do more work to be comfortable, or delays in holding closing meetings and long debates about the wording of the final report.”

These perspectives illustrate how weak assignment planning can often be a root cause of waste later on in the execution of an audit assignment.

Invest Sufficient Time in Focused Assignment Planning

A fundamental hallmark of lean, progressive auditing is an ability to purposefully plan each assignment. Here are several supporting perspectives:

Karen Dignan (CAE, Group Head Office, OMG):

“Planning an assignment is key because when I see things going wrong, including delays in delivery, it is often because we didn’t think enough up front. It can be as simple as not recognizing a key contact is travelling or on holiday for 2 weeks during the assignment.

Unless people have really thought about what they want and sufficiently planned and been rigorous in engaging the business, problems will arise.”

Andy Weintraub (experienced internal audit leader):

“I love issuing an audit report at the end of an assignment, and getting management to improve the business, but good planning is a crucial step to ensure this happens.

In an earlier company I worked in, the CAE said planning should represent two-thirds of the time for the assignment. Of course, it depends where you draw the line but his message was that it was extremely important to have a good assignment plan if you wanted to deliver a valuable assignment.”

Chris Baker (Technical Manager, IIA UK):

“Good audit departments put a lot of effort into thinking about and agreeing the scope of their audits so they are addressing important points; and as a result key findings will then be meaningful to the organization.”

That said, assignment planning should be focused and purposeful and not be a black hole of wasted audit time.

Actions for Internal Audit to consider:

• If assignment planning is relatively quick, or rarely affects the planned scope and resourcing, consider whether the planning process needs to better consider value-adding questions;
• If assignment planning is taking a long time, pay close attention to what is expected in the assignment methodology as well as how staff are interpreting these requirements.

Be Explicit about the Added Value of Each Assignment

Taking a fresh, value-added perspective to each assignment will typically encourage audit to look at each assignment beyond simply assessing risks, controls and processes. One CAE explains their perspective on the value-adding mindset:

“Before you start an audit, you’ve got to ask yourself, when you come out the other end, what might be the particular outcomes from this audit? Look at that and say, will anyone care? For example, if you’ve issued a red report and everyone goes, ‘So, what?’ you should ask yourself: why did we look at that? Finding a risk that is not well controlled is not adding value if the risk doesn’t really matter to the organization.

The question to ask is – if we come up with a finding will it be a unit level issue, a regional issue or a group issue? If you know at the start it’s unlikely going to be more than a business unit issue you should think hard about whether the audit is worthwhile and properly scoped. It might add value to a particular unit’s management, but is it right for the Group as a whole, in terms of resource allocation? It’s all about understanding IA’s role in assessing the control environment at the correct level.

There may still be a valid reason to go and audit a unit level issue, perhaps to do some root cause analysis and share that more broadly. So the value of this assignment is going to be greater than addressing specific issues in that location.”

Taking a value adding perspective links closely to the question of understanding management’s risk appetite; progressive ways of working pay close attention to potential differences between auditors and management in relation to risk appetite at the planning stage, rather than seeing these differences manifest themselves in the “so what” reactions of management described earlier.

Jonathan Kidd (CAE, UK Met Office) provides advice about planning that seeks to head off these sorts of difficulties:

“I think it’s really important in the planning stage not just to focus on what controls we expect to see. Think ahead also about what we think good might look like, and what would bad look like? If this was going to be a report rated unsatisfactory, worthy of senior management or audit committee attention, what kind of things would we expect to see?

The answer would be more than just whether a specific system is not being password protected, because it would all depend why it was not protected. It would probably be more serious if audit discovered problems around the culture and attitude of people within that part of the organization.”

Taking this approach means that if management don’t believe that certain controls are needed, or don’t believe that monitoring is important, or don’t believe it needs to be documented, audit may already have potential “design level” or “risk and control culture” observations that may be of real value to key stakeholders.

Developing a theme discussed in an earlier chapter on the audit planning process, thinking about the likely value add of the potential outputs from an assignment can be helpful when considering what resources to allocate to the assignment. If an audit is going to cost (say) $10,000 is there a good chance that points with a value in excess of this are going to be found?

How to quantify the value of audit outputs can be straightforward in some instances and more judgmental in others. The most popular progressive approach I see is to be clear whether findings are going to be of significance to just the unit or process being examined, or to the organization as a whole.

Having a mindset of “what is the value of this finding?” requires auditors to be grounded in the organizational context, raising their sights towards important matters and moving audit away from “nit picking” – unless there is a clear connection with something that really matters.

Actions for Internal Audit to consider:

• Ask what the value from each assignment is going to be and make this specific (e.g. unit level importance or organizational level importance);
• If appropriate, engage management or other key stakeholders on the potential outcomes of the assignment and see whether they would regard these as being of value.

Engage with the Assignment Sponsor During the Assignment

Earlier in this book I discussed the importance of being clear who is the customer of audit work. Ideally, the needs of senior management and the board should be gathered during audit planning, so that any assignment delivers their needs (and, ideally from a lean perspective, the needs of the external customer).

I also explained that for key assignments one increasingly popular practice is to agree an assignment sponsor at least one management level above the “auditee”, so that audit does not miss an opportunity to deliver value to other stakeholders. However, it is important that once a sponsor is identified they are properly engaged. One CAE explains:

“I ensure that every single audit we do has a sponsor. I’m not expecting them to be that involved in everything, but I want them sufficiently involved in what we are doing so we don’t get a value gap. We always have an opening meeting where they are invited and we will liaise with them at intervals during the assignment so that we can get feedback concerning the extent to which we are providing insights of value.”

The sponsor can also play a helpful role in driving a timely assignment. David Whitehouse (experienced audit professional) explains:

“If you have a senior sponsor it gets the attention of the person being audited, it also provides an excellent reminder that things can be escalated quickly if there are any doubts about the timing or the scope of the assignment.”

Actions for Internal Audit to consider:

• Where possible, select an assignment sponsor and engage them on questions of the value that the assignment will deliver;
• Engage sponsors during the assignment as issues emerge to explore the “so what?” aspects of what is being found;
• Use the sponsor if there are any uncertainties about accountabilities in the area being audited, or delays in the progress of the assignment.

Think about Key Risks and Key Controls

A useful approach to help internal audit gain clarity about the scope and value add from an assignment is to clarify the key risks, rather than all of the risks, and the key controls, rather than all of the controls, that should be examined during an assignment.

Greg Coleman (CAE, ITG) offers the following advice:

“I think it’s useful, during the assignment planning process to consider explicitly up front: what are the key risks we need to address and what do we expect the controls to be to manage the risk to the risk appetite that has been set?

We generally use template Risk & Control Matrices, but it’s important these are not used simply as checklists, because it is so easy to miss the issue of: what is the key risk on this occasion and what controls must be working really well at this point in time? We then share our view of key risks and expected key controls in the draft scope document, which goes to senior management and other managers, giving them the opportunity to add or remove controls.

Obviously, when we go and do an assignment, if there are controls that we haven’t thought of in the expected controls, we’ll assess those and test them as necessary.”

The ability to focus an assignment on key risks and key controls is becoming an increasingly common hallmark of progressive auditing. Lean encourages auditors to look at them from the perspective of what will add value to stakeholders and the external customer. In particular, are the key risks and controls for an assignment important for just this assignment, or are they important from an overall organizational and external customer perspective as well? (Consider the notion of the “key key” controls to highlight the most important control activities for the whole organization).

Being clear about the “key key” controls can help significantly when an audit function is seeking to connect the results of individual assignments to any overall assurance opinion that might be required. In particular, this approach challenges the practice of taking an average control effectiveness rating (from audits across a range of more and less material areas), and thinking that this can be used to extrapolate the effectiveness of risk management and controls effectiveness for the organization as a whole.

Actions for Internal Audit to consider:

• Do audit assignments make a clear distinction between all of the risk areas and controls and the key risks and the key controls?
• Where it is helpful, make key risks and expected key controls clear in the assignment plan, so that management can comment on these at an early stage;
• Ensure there is clarity about the overall organizational importance of key risks and key controls and consider ways of making this clear on an ongoing basis (e.g. using terminology such as “key key”);
• If required to offer an overall opinion consider the extent of the audit coverage or other assurances in relation to “key key” controls to ensure it is based on the effectiveness of the risks and controls that matter the most.

Consider an Initial or Working Hypothesis

When I was CAE of AstraZeneca, taking a lean approach offered many fresh insights in relation to our standard auditing practices. A particular approach that we developed was the use of a “working hypothesis” for each assignment.

The origin of this idea came from David Powell, one of the Audit Directors, (who started us along the journey of lean), who looked at an earlier assignment and analysed how we had spent the time on the assignment compared to the eventual findings we had come up with (notice the interest in resource expended compared to added value). His analysis was that only 35% of the time spent on the assignment actually resulted in the most important findings. Of course, we recognized that all assignments will have a degree of waste and it was not wasteful to establish that an important risk or process was working effectively. However, there was something important in what David had found, particularly since we realized that we already had a good idea what the findings would be before the assignment had even started!

The audit management team realized that, if we could make better use of our hunches, there was a good chance we could drive more productivity in assignments. We called these hunches the “working hypothesis”. As a result, when we were revising the internal audit assignment methodology to be more oriented towards lean principles we incorporated a step that was to ask the auditors working on an assignment to consider whether they had a working hypothesis concerning what the key weaknesses might be (see Figures 13.1 and 13.2). We subsequently discovered that this technique is used by consulting companies (such as McKinsey) where an “initial hypothesis” is encouraged.

Phil Gerrard (CAE, Rolls-Royce) explains why the use of a hypothesis can be of value:

“The reason a hypothesis is important is twofold. It helps clarity as you start and progress the assignment because it makes you ask yourself the ‘So what?’ questions. If you hypothesize about the petty cash getting stolen, you need to be clear whether it’s important in the scheme of things. It makes you really think about what matters. It can help you to do a sort of reverse stress test.”

The power of the working hypothesis in an audit context goes beyond helping to fast track assignments, it can also help auditors become clearer about whether they have preconceptions (or even prejudices) in relation to what might be uncovered during an assignment. The benefit of this can be to make the auditors more mindful of a lack of independence and objectivity during the assignment. That said, a hypothesis must be used with care; Rania Bejjani (CAE, Colt Technology Group) explains her approach:

“Sometimes I do express my concerns and views about an audit to the team when they are planning their work. However, at times when an assignment is complex where there could be a range of issues, I would explain the context and the interdependencies, but I may not always voice my hunches upfront to the team. The reason is that I do not want to influence the objectivity of my auditors or insert a bias and undue influence in their judgment. I want them to assess the situation objectively, independently with an open mind.

However, my questioning about the progress of the assignment and what is being found would be informed by my hunches. I won’t necessarily put these on the table upfront for each assignment, but they are present in my mind and I would voice them when I believe it is appropriate. Again, that’s because I want the team to do a thorough diligent job and I want them to have an open mind when looking at an area rather than pre-judging the situation or jumping too early to unsubstantiated conclusions.”

The source of a good working hypothesis will normally be developed by good audit planning; considering relevant key performance indicators and other intelligence, combined with the insights of experienced auditors. Using a range of inputs to inform the working hypothesis will normally help to reduce the risk of personal auditor biases about what the issues might be. The role of gathering and assessing intelligence as a key source of audit added value will be discussed further in a subsequent chapter.

Actions for Internal Audit to consider:

• Pilot the use of a working hypothesis to prioritize the work done in assignments and review the results obtained;
• Recognize that the working hypothesis may also reveal auditor preconceptions and may not be correct, so try to establish whether there is a factual basis for the concern.

Revisit the Scope and Resourcing of Each Assignment as a Fundamental Part of Assignment Planning

A common practice in lean progressive audit functions is to adjust the scope and approach of each assignment in accordance with what emerges during the assignment planning process. Nicola Rimmer (former President of the IIA UK) explains her preference:

“I prefer an approach in which, when we have done some planning work, we will rethink the size of the assignment ahead and the likely completion deadlines. At one end we might realize we’re going to finish in 15 days, so that goes into the plan and our completion milestones. Or you might realize there is a big issue to be addressed across a number of departments, or more work is going to be needed to look at root causes, which may take you twice as long, in which case we plan for that.

The discipline of managing an assignment as a series of mini-projects is good, but it needs to be based on the actual needs of the assignment that emerge from assignment planning and not some standardized resource allocation set at the time of the audit plan. The benefit of this approach is also in the savings you can get when you recognize the original resource allocation was too generous.”

Thus, a fundamental part of planning an assignment should be to give consideration to its purpose, value and resource the assignment accordingly.

Actions for Internal Audit to consider:

• Ensure that an integral part of the assignment planning process includes a reassessment of the correct resources and milestones in the light of the benefits being sought.

Plan Assignments like Projects Throughout

One of the key changes we made when we transformed our approach to internal audit in AstraZeneca was to plan assignments all the way through to an issued report, and not just a closing meeting. Each stage had a milestone and auditors reported progress at each stage that helped to keep assignments moving forward, and allowed for the early escalation of issues that were causing delays. This practice is gaining ground and Greg Coleman (CAE, ITG) explains the benefits that result:

“I favour having very clear structure for most assignments, particularly an agreed date for the closing meeting and then the final report. We put proposed dates into people’s diaries quite early on in the planning of an assignment, so they have it in their diary. They are then told that they will get a draft of the report 24 hours before the meeting, and they’re encouraged to make sure they’ve got some time to review it.

Occasionally we do have to move this closing meeting, but it’s rare. Generally speaking we’re able to hit the deadline. It does mean sometimes that the audit team has to work quite hard in the two or three days prior to the meeting, to make sure that the draft report is ready for the 24 hour deadline. But I don’t think that’s a bad thing, and I think it keeps people focused on the key areas. In previous organizations where there was no firm assignment plan, in addition to scope creep, it was common to see meetings slipping since people weren’t always available if you tried to book them at the last minute, and you can end up in a situation where audits just drag on.”

Phil Gerrard (CAE, Rolls-Royce) also adopts this approach:

“We aim to set an end date after our assignment planning and get time in the diary of key stakeholders, because on a practical level if you don’t get it in the diary up front you won’t get the right people there. So you set the milestones early and manage achievement of them actively. We will explain that we plan to issue a draft audit report on a given date, so it’s important management are not on holiday, or away then.”

Of course, the planned timescales for delivering each assignment will differ based on the likely complexity of the assignment and other factors, and some deadlines will slip, but the lean, progressive approach to auditing is about creating a forward pressure in relation to the need to bring assignments to a conclusion without unnecessary delay. When this sense of purpose and energy is an integral part of the auditing process, it becomes visible to management, typically resulting in reduced prevarication and fewer delays on their part.

Actions for Internal Audit to consider:

• Set milestones for all key stages of the assignment and track progress;
• Create a discipline in which key meetings with management are booked well in advance and papers circulated ahead of time wherever possible;
• Within audit, champion a sense of purpose and energy in the auditing process in order to create a culture in which audits are delivered on time as a rule, rather than as an exception.