Norman Marks, CRMA, CPA, is a vice president for SAP and has been a chief audit executive and chief risk officer at major global corporations for more than 20 years.

Almost everybody has excellent tools for risk monitoring and internal auditing, but as with any software solution it is necessary to learn how to use them well. These tools don't come with a user manual.

They are not sold by Microsoft, SAP, or Oracle.

No, they are built in capabilities:

• Our eyes
• Our ears
• The spaces in between

I can walk into a warehouse and by being alert to signs of neglect and poor operations I can quickly identify likely risk and control issues. I may see boxes scattered around between instead of in storage racks, or layers of dust on inventory (OK, I may have to use another tool — my fingers — to measure the dust), or employees that appear either to have too much or too little work. I can see posted operational metrics, and by checking the dates of the last entries and reading notes of the last team meeting see whether they are being maintained and discussed.

I can listen to employees and management talk — about their operational problems, their feelings about the company and their managers, and their working conditions.

The space between the ears and eyes has to be trained but then has extraordinary capabilities for analyzing and interpreting what you see and hear.

Use these tools, and use them all the time. Nobody says you can only use them when you have an "official" audit or risk assessment in progress. If you see, hear, and understand there to be an issue, take action now. It may be necessary to start an official engagement to perform additional testing, assessment, etc. But, usually that will just confirm what your brain has already concluded.

Keep these tools finely honed and trained. They can be wonderful, as long as you don't let that other "capability" (your mouth) get in the way — when all you hear is the sound of your own voice.