Okay, this one isn't my fault. I had the entry all done and ready to post having worked on it at the Orlando airport during a four-hour wait necessitated by my inability to really figure out what time I should schedule a flight. And then the computer started doing weird things, and posting was no longer an option. But it all got figured out. And so, after a delay that wasn't my fault — really — I present to you the last in what has turned out to be a five-part series
So far in this rather long and convoluted discussion about agreement, we have been taking a look at the many and varied situations where auditors should be obtaining agreement. The basic concept underlying all of this is that, if we have agreement up front, we will have fewer challenges throughout the audit process. (If you have been reading along, this should sound familiar; it is the mantra I've been chanting time and again throughout these epistles.)
We've talked about agreement on the findings, we've talked about agreement throughout the audit process, we've talked about agreement among ourselves, and we've even talked about agreement with the audit committee and executive management. "What could be left?" you might ask. Well, there is a whole group of people out there who do not work for the organization, but are key to the organization's success.
Yes, I'm talking about customers — the external customers to whom the organization is providing goods and services. "Fine and dandy," you respond, "But what kind of agreement can internal audit have with the nameless horde upon whom the fate and success of the organization counts?"
Now, I will freely admit that, at this point, I am about to stretch things more than a little in this whole "reaching agreement" thing. But I am using it to drive home an important point about our audit work — a focus that we often overlook.
Let's start with a basic principal about reaching agreement. At the core of successful agreement is the ability of the two parties to find how they can both benefit from the agreement. In the best situations, this results in the two parties developing a partnership with each other — acting as partners who want to ensure the other's success. If you take a close look at the major failures experienced by various corporations and organizations you will see that a major cause of their destruction comes from the failure to remember the role of the customer in the work that was being done — to act as if the organization can stand alone without its customers/partners. (And an entire treatise could be written on this subject, but I'll leave that to anyone out there who wants to make a fortune putting together that history.)
Therefore, as part of the organization, internal audit also has a partnership with those customers. And it has a responsibility to help understand and nurture that partnership. Without recognition of the partnership that exists, we are losing focus just as surely as those organizational sabertooths that sank into their customerless tar pits.
To repeat — customers equal partners, and partners represent people with whom to gain agreement.
Which leads to this concept: When internal audit is doing it right we should, at the very least, pretend to be having that conversation with the customer — having a conversation to obtain agreement about what is important to them. Why are they buying, what is the service they want, what is the value they are paying for, what can the company do for them?
By having this imaginary conversation with the customer — by coming to an imaginary agreement about the paying customer's objectives — we then have a better understanding of how processes, policies, and procedures support the ultimate delivery of value to the external customer.
And my experience has shown that this one area — recognizing the impact on the external customer — is where all internal audit shops — even the very best — could do more.
For a while at Farmers Insurance we had posters up in every meeting room. It showed a well-rounded group of individuals who represented our customer base. Printed on the poster was the phrase (and I am getting this wrong, but it was the jest of what was said) "Are you thinking about me?"
That imaginary agreement with the customer should play well into every conversation we have with the auditee. One more time — "if we have agreement up front, we will have fewer challenges throughout the audit process."
Of course, this is all predicated on the assumption that the auditee also maintains that customer focus in what they do. If they don't? Maybe you've got something important to discuss right there.
And one more thing to recognize. The minute we start talking about partnerships as a part of agreement and the need to reach agreement with external parties, then we have opened up a whole new kettle of casserole. Should we have agreement/partnership with regulators, the competition, the legal system, the press, insert your favorite not-often-thought-of-as-customer here. (One of my personal favorites within the world of insurance is the claimant who is not one of the company's insureds.)
There is a strong argument to be made that, in one way or another, we are partners with all these parties. Do we spend any time getting "agreement" with them? Do we within internal audit even try to understand their perspective?
Now, I'm not saying you go out and have monthly meetings with the regulators or your competitors or any of those we have just mentioned. But I am saying dig deeply enough that you understand the motivations of all these parties; get an understanding of what they are doing, why they are doing it, and how it impacts the work your organization is doing.
And, you know what; maybe I am saying you should meet with them.
Finally, 5,000+ words later, I've come to the end of this discussion. And as indicated above, there's still a lot more that might be said. But this whole thing was really nothing more than a call for awareness — for internal audit to recognize who we are working with and how we need to actually work with them.
There's been a lot to chew on. So if you can only start by getting agreement on the criteria you will use for testing — start there. But remember, there is a lot more to our audit work than a bunch of tests.