One goal shared among attendees at new auditor seminars is learning the best ways to get things done. They are thirsty for information about how to perform their new jobs correctly — how to do things "right."
But as an instructor, my initial response to their questions can be frustrating. They ask what The IIA's International Standards for the Professional Practice of Internal Auditing require, and I answer that they provide guidance but do not specify exactly what to do. The right answer, I tell them, depends on individual circumstances and the requirements of the organization. They ask how best to handle a certain situation, and I say it depends on the circumstances and the department. They ask how best to accomplish an audit step, and I say it depends. Eventually, they ask a question, I smile back, and they say, "I know; it depends." I am not being flip; I am trying to help them see the realities of working in the internal audit profession.
Students are trained to always expect a right answer. They are graded on the absolute correctness of their exam responses, they hear real-life case studies that have a single solution, and in accounting, they memorize rules and concepts that lead to correct outcomes. At the end of their studies, they graduate assuming that the business world is built on the existence of such right answers.
Thrust into the real world, they learn that shades of gray dominate. And this is just as true for internal auditors as it is for anyone — except that the profession doesn't always act that way.
Auditors do not like to make mistakes. Maybe it's because we're supposed to be the masters of controls, maybe it's because we are supposed to know how to mitigate all risks, or maybe it's just because we think making mistakes hurts our credibility. But whatever the reason, we act as though there has to be a single right answer to everything — one right way to test, one right way to assess risk, one right way to write a report, one right way to correct an identified issue, and one right way to audit.
That is not the real world. And that is not real internal auditing. There are better answers, but not perfect ones.
Talk to five chief audit executives about their No. 1 risk and you'll get five different answers. Talk to 10 auditors about how to write a report and you'll get 10 different solutions. And talk to any client about his or her idea for a "perfect" solution to an identified issue and it may be 180 degrees from yours.
No one is right. And everyone may or may not be wrong. Internal auditors must recognize that there may be any number of answers. Our challenge is to help clients determine what answer might be best.
And how do we solve that problem? Well, it depends. …