Transforming Internal Audit Through Critical Thinking

Norman Marks, CRMA, CPA, is an evangelist for better run business, focusing on corporate governance, risk management, internal audit, enterprise performance, and the value of information. The views expressed in this blog are his personal views and may not represent those of The IIA.


Congratulations to KPMG for taking on this topic in a new publication (PDF)!

I have been a big believer in the need for internal auditors to become better at using their native assets, writing about using their eyes, ears, and the space in between.

In my presentations on world-class internal auditing, whether to IIA institutes or chapters (including my upcoming keynote for IIA–Chicago), or in a formal training session, I explain that most internal auditors are trained not to think! Most come out of the public accounting firms where they are told to follow firm standards and established audit programs. They are not told to use their judgment — that is reserved for partners and some managers (even then, not always exercised by them).

If internal auditors are going to understand what they are seeing and experiencing as they perform their audits, they have to free their minds from the chains of “do it my way,” “you must follow this methodology,” “you are too young,” and “you don’t understand my business.” They have to learn to find the time to think — which requires, in most cases, quiet reflection.

Would you rather see an auditor busy poring through documents, ticking and tying as he goes, or sitting (perhaps with eyes closed) thinking about what he has been seeing?

Auditors need to find the time, after obtaining information, to think about what they have found. Does it make sense? Is any information missing? Is this the best way to perform that activity or that control? Have I seen this done a different way somewhere else; was it done as well or better then? Is there a risk doing it this way? Are they spending too much time and resource given the level of risk?

How can you answer the question “What do you think?” if you are not taking the time to think?

Some internal audit departments seem to reserve the privilege of thinking for managers and directors. World-class internal audit departments not only allow but demand that every member of staff, from the most junior to the most senior, think!

In particular, we must learn to unchain our staff and ourselves from the thinking of the past, our prior experience and bias.

Just because something was the right answer last time, doesn’t mean it’s the right answer here and now.

KPMG correctly points out that organizations want “internal audits that are insightful, forward looking, and go beyond preserving value to creating value on a departmental, divisional, or organization-wide level.” That requires thinking and the exercise of our professional judgment!

Some are scared of using that judgment and saying what they think. My answer is that as professionals, we must be prepared to form and express our professional opinion.

The KPMG report is interesting and useful. It focuses on the need for internal audit to come up with creative ideas for process improvement but doesn’t address sufficiently, in my opinion, the need to nurture thinking skills.

CAEs and everybody in audit leadership must change their approach to supervision if they are to encourage and grow critical thinking skills.

For example, when reviewing an audit engagement, put the report and working papers aside. After asking questions about what the audit team found, ask questions like “What do you think about how the department is run?” “Do you think the process is efficient?” “Do you think risks are managed well?”

The most important follow-up question is “Why do you think/say that?”

Audit leaders must not fall into one of these traps:

  • Giving a staff member the answer to their question instead of helping them find it themselves.
  • Telling somebody they are wrong, instead of asking them “why do you think that” and helping them see the correct answer themselves.
  • Not allowing people time to think, even scolding them when they pause for a quiet moment of reflection.
  • Failing to show respect for the thoughts of even the most junior and inexperienced individual.
  • Assuming that just because somebody came up with an answer you agree with that they got there the same way. Explore why they think that way, because they may just be telling you what they think you want to hear.
  • Not providing people with the training they need in critical thinking skills. Many years ago, I attended training from the American Management Association and would highly recommend it.

So what do you think?

Posted on Mar 15, 2014 by Norman Marks

Share This Article:    

  1. Norman, I completely agree with your thoughts on thinking and internal auditors. Apart from the organization's cultural issues and finding time to think or ponder, the other challenge is finding staff capable of thinking. My experience has been that finding technically competent staff, while challenging at times, is much easier than unearthing the curious, questioning, wondering, sometimes pain in the you-know-what staff who rethinks the status quo. This talent, whether innate or taught, is even more valuable when analyzing risks than in performing an audit program.
  1.  Norman, Not only are internal auditors taught not to think critically, but traditional education teaches us to stop thinking critically. After completing a lot of research on the topic, Critical Thinking Skills for Auditors is my most popular course, often combined with a few notable areas where we MUST think more critically in auditing. The problem is, attendees come to class expecting an "answer" when really the anwers lie within themselves. I get rave reviews on my course, particularly from those who attended the leading competitor's course, and participants are surprised when I tell them my secret to critical thinking success: engage your creativity first...

  1. Raven and Karl, you are both absolutely right. More people should engage their creative side, but that means leadership has to loosen the shackles.

    Finding people who can think starts with the interview process. HR interviews, unless its an exceptional interviewer, won't help. So its up to the audit executive.

    I use scenarios that I expect the candidate to understand but not be an expert on (an expert stops thinking once he decides he is an expert). Then I ask them to describe how they would go about the project.

  1.  In my experience as both an audit executive and other roles, critcal thinking is something that is lacking in general. Many people don't like thinking critically because it is hard. I recently started started teaching part time at the University level and see it in the students as well. Many want you to do the learning for them!  So the question is can you inspire critical thinking in a professional or is it an instrinsic quality you must hire for?

  1.  Dennis, in my experience you can encourage and inspire critical thinking by:

    - Showing respect for the opinions of all. Making time to listen to them

    - Asking "what do you think" instead of :"what did you find"

    - Asking "why do you think that" when auditors come up with an opinion

    - Explaining why you think something and listening to answers to your question "what do you think?

  1. Normal, I suspect one of the major hindrances to critical thinking is the slavery to the budget and the bad appraisal (and prospects) if budgets aren't met. If critical thinking is to be encouraged, the budget must allow time and one appraisal target should be that there is evidence of critical thinking and innovation.

  1. 'Time to think' - an interesting topic to set against budget constraints. I remember my worst experience of a SOX review, in a small subsidiary of a US Corp here in Germany, where we were visited virtually on an hourly basis (No joke!) and were asked if we could perform faster and get out of their hair - release their opertaional staff from this bureaucratic burden (?!) Curiously, this brought about only one result. I was forced to report back that their were acting so strangely it was almost as if they had something to hide! They were consequently subject to even more onerous bureaucratic burdens, sponsored by the Corporate Controller. Oh well! Such is life!


Leave a Reply