A Bigger Lie Than We're Here to Help You

I’m going to worry this bone to death, I know, but I keep coming back to the whole issue of a kinder, gentler approach to auditing destroying our effectiveness (and future). And this latest was a trap I found myself falling into. 

We consistently state that the purpose of our audits is to ensure controls are adequate (or something to that affect). I’m not arguing with the basic concept. But I’m wondering if we get so focused on proving controls are good that we forget our job is to also find the chinks in the armor. Let me steal a page from the Association of Certified Fraud Examiners’ training (and if I misquote, my apologies). Fraud investigation is intended to prove two things — that fraud has occurred and that fraud has not occurred. This mutually exclusive approach ensures that all parts of the puzzle have been considered. Similarly, while we still want our customers to understand that we are trying to prove that controls are effective, we need to also attack every audit trying to prove that controls are not effective.

Yes, I know that is anathema to what many believe — that it makes us look like we are working on a quota system or that we are all about finding the mistakes and errors — but if we don’t include that approach in our audit work, we will not be providing the due diligence our audits require. Recently I was doing some background to determine if we should complete an audit and whether we should cancel other planned audits to complete this one. As I looked at the policies and high-level procedures — and as I began looking for expected controls — it looked like everything was there and we probably didn’t need to change our audit plan. Then I realized I had fallen into the trap; I realized my assessment was trying to assure that everything was okay. I then began trying to think of the loopholes and gaps in the procedures, rather than trying to think how good the procedures were. Suddenly, the need for the audit became much more apparent.

It is probably apparent from the way I keep coming back to this subject, but I’ll restate it: I truly believe we have to learn to have teeth again. I’m not saying we bayonet the wounded. But I am saying that we shouldn’t sheath those bayonets — rather, keep them sharp for the battles ahead.

Posted on Aug 5, 2009 by Mike Jacka

Share This Article:    

  1. I totally agree on the whole "we have to have teeth".  And the only way we can have teeth is for executive management to commit to seriously implementing our recommendations.

Leave a Reply