A funny thing happened on the way to the latest blog post. At the end of my latest post I mentioned I would have more to say on creativity. Over the weekend I wrote up the draft of the post, put it through a few edits, and then began the final polishing. (Yes, as hard as it may be to believe, I actually try to polish these things up before I present them for your enjoyment.) And, when I thought I was done, I realized what I had was a good fit for my Internal Auditor column.
What that means to you is that the previous post has become the world's longest teaser. You're going to have to wait until (hang on a minute; let me figure this out..okay, got it) October for the further thoughts I have on this subject.
But the whole process got me thinking about an interesting trait of internal auditors. In homage to Alex Trebek I will phrase the situation in the form of a set of questions. How often, in the middle of an audit, do you find something you didn't expect? How often do you stumble across something that doesn't quite fit the plans of the audit, but is important nonetheless? How often does the work you are doing during an audit reveal the need for the audit to become something different than you thought it would be. And how often do you let those new discoveries take their head and allow something different (maybe even better) to occur? On the other hand, how often do you look at the new discovery, realize it is important, but put it on the back burner because the current scope/schedule/approach of the audit you are performing doesn't allow for that area to be reviewed?
Really think this one through. Think back over some of the audits you have recently conducted, think about all the things you learned, and be honest about the number of interesting points you thought warranted additional work but you just didn't think you had the time for. (Side comment: If you are doing good interviewing, fact find, and testing, you should be able to find a lot of instances where something interesting but unrelated popped up. If you go back and say to yourself "Nope, we covered everything perfectly" then you are lying to yourself, not identifying the risky areas, or just doing pretty mediocre audit work.)
Auditors have a hard time moving from their preconceived ruts. And the stricture of our approaches only enables those tendencies.
Let's take the most rudimentary of examples. You are doing audit work and find something of interest that doesn't quite fit into the original plan of the audit. The first phrase that springs to mind is "scope creep" and we tend to shy away. Even if the auditor decides it is worth bringing up, the supervisor/manager/director's immediate thought will be to find a way to avoid the scourge of scope creep.
Don't worry, I'm not saying we should waste our time scrambling down each hidey-hole of information we spot. But I am saying that we should not get so bound up by the boundaries that we described at the outset of the audit that we ignore important discoveries.
It's a little like the way we have adjusted our approach to annual planning. In the good old days (when Cyndi Lauper was singing "Auditors Just Want to Have Fun") we would have our plan for the coming year done in the 2nd or 3rd quarter. That meant that (for example) the work we were doing in December of 1984 had been planned sometime in July of 1983. You don't have to have read George Orwell to know that things may have drastically changed in that time and the audit you planned over Soma production is no longer as relevant as the review over Beta activities in the Reservation. (Extra points for those of you who caught the mixed literary allusion.)
And so we all (rightly) changed our approach by building an expectation that annual plans should change and that we should instead be doing quarterly (and sometimes monthly) updates.
So why do we shy away from using the same principals in our audits? I know there are exceptions, but most auditors (and audit leaders I'm talking about you, too) think that the original scope of the audit is sacrosanct and not to be violated. "I don't care what we found. We don't have the time necessary to expand the scope of the audit and look in that direction."
But if it is relevant and important, then either the audit or the schedule (or both) must be changed to accommodate this need.
Here's an example snatched from the pages of "True Auditing Tales". A department was in the midst of a reorganization and, as part of the process, they had teams of three people evaluating all members of the departments. Management asked us to come in and verify the process effectively ensured this was getting done in a timely and appropriate manner
As we worked through the audit we found the entire operation was working well. However, in our discussions, we also learned that some of the evaluators were unexperienced in such evaluation processes. Not part of our original scope, but definitely a significant risk to the process (both from an accuracy standpoint and even from a legal standpoint.)
We quickly found the time to expand the audit to include this critical aspect of the process.
Should we have seen this right off the bat and included it in our original scope? Of course. Should we then have just ignored it because it was scope creep? No way.
It seems obvious in hindsight, but knee-deep in the throes of the audit it would have been very easy to say, "Just do what we planned. These are not the process risks you're looking for."
Ultimately, it is (as it always seems to be) the need for auditors to do their work with their brains somewhere in the vicinity of the work area. We have all fallen into the trap of conducting work by rote. (I could go on for hours about examples from my own work.) But by being aware of the problem we can watch for it and change. And by being aware of the fact that we will find new issues and risks in the midst of the audit work, we can watch for it and make the necessary changes. And by paying attention and making those changes, we can be the effective auditors we know we need to be.