When you go to conferences, you may notice an interesting thing. The conference may have a slogan or they may have titled tracks or they may have myriad other ways they are trying to "define" what the conference is all about. However, no matter what approach they have, you will generally find that your own theme develops.
I've noticed this numerous times; situations where, by the end of the conference, I noticed a certain "direction" in the sessions I was attending. Now, that may be as much a function of the ones I chose as anything. But I believe that, as the profession evolves, these unspoken trends will surface during a conference.
So, what did I see this year?
For me, I happened to notice, time and again, how many of the speakers were talking in terms of auditors looking to the future. No, not trying to predict it; but focusing audit work on the impact of events in the future rather than reporting on problems from the past.
Now, maybe I'm just a bit behind, (and believe me, that is the kind of old news they quit reporting in my family newsletter years ago) but it is the first time I've really thought of our work that way. And maybe that is why it became the theme I noticed, because it is one of the more profound understandings of our work I've heard in a long time. Not ground-breaking, not earth-shattering, but profound.
Synthesizing what I've heard, here is the point. People (auditees, clients, etc.) are tired of hearing what they did wrong. And very often our reports and findings are focused backward. "Caught you. Here's the control that was missing." And all efforts are then expended on making good for the sins of the past.
Instead, we need to first be looking for the future concerns. (In other words, are we making the mistake of looking at something that doesn't matter anymore.) Then, if we are looking in the right direction, we need to ensure that the corrective action arising from our findings relates to how to keep the issue from occurring in the future.
This latter seems fundamental. But I have seen a few too many instances where, because the audit was focused on the past, the corrective action had little impact on future activities.
Again, I have the feeling I am just late to this party. But that doesn't mean I can't throw my noisemaker into the mix. Look closely at your risks. Are they focused on the important, impactful risks that can hurt the organization in the future? Look closely at your audit work. Is it focused on what will be occurring? (Even if it is testing past events, it has to be about future concerns.) And look closely at your results. Will they make the organization better in the future?
That is how you truly move from (get ready for an old phrase here) cops to consultants.