Internal Auditor’s blogs reflect the personal views and opinions of the authors. These views may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers’ employers or the editors of Internal Auditor.

Audit Plans Were Meant to Be Broken​​

Comments Views

What started as a simple blog post discussing a blog post from the Center for Creative Leadership and the parallels between entrepreneurship and internal audit has grown, eventually taking on a life of its own. (You can find the first two posts here and here.) The result is that, for the next few Fridays, I will be discussing the specific competencies and what they mean for internal auditors. I hope you'll join me on the journey.

Discussions during internal audit seminars are always interesting and will go off in directions you don't always expect. One topic that often comes up is the traits internal auditors need to succeed. You can probably guess the ones that come up most often: communication, report writing, detail-orientation, critical thinking, analytical skills, organized — as I say, you can probably guess most of them. But in my most recent seminar (you out there Gila River?), I got an answer I had never heard before.


Maybe it had come up before. But I couldn't remember anyone actually bringing this up or any group discussing it in depth. (Of course, at my age, I'm lucky to remember how to spell internal awditor.) I was gobsmacked by the obviousness of it.

The internal auditor who sticks to the plan, who mindlessly completes the ICQ, who listens but doesn't hear, who doesn't respond to evolving risks, who ignores changing environments, who is unaware of vague hints of disruption, who forges ahead in spite of the new reality, is an auditor who will find himself left behind in the aftermath of such change.

The first competency discussed in the blog post from the Center for Creative Leadership (the blog post that started all this) is "flexibility." That section begins, "Anyone entering the freelance world with the notion that they can 'plan their work, and work their plan' is in for a rude awakening." There was a time when internal auditors could, indeed, "plan their audit work, and work their audit according to that plan." But that was then; this is now.

From a broad perspective, the newly quaint idea of sticking to an annual plan is dying a very deserved death. Sticking to an annual audit plan will leave your department working on out-of-date and meaningless risks. Just how out of date? I don't know about your process, but our annual plan was completed in August. Meaning, by the end of the next year, we were doing audits over areas that were a risk a year and a half ago.

But that isn't really the headline when it comes to flexibility. No, flexibility is really about navigational change — mid-audit — in response to changing events, environments, and understanding. As the article further notes, "The needs of your customers, and sometimes events beyond your control, will eventually lead you in new directions." And those new directions can and will occur smack-dab in the middle of any audit.

I would go so far as to argue that any audit which is completed in exact accordance to what was planned at the start of that audit has, most likely, missed something.

In today's environment, nothing is what it was when you start out. And, even if things don't change, the main reason you spend all that time talking to people and trying to understand what the heck is going on in their operations is to gain a deeper and better understanding of what auditing is looking at. Things are never as they first seem. To achieve success, the auditor has to be flexible enough to respond to that new understanding, the audit plan has to be flexible enough to allow for that change, and audit leadership has to be flexible enough to trust the decision-making skills of its auditors when those changes become necessary.

Suffice to say, at this juncture, flexibility is a trait we seldom identify as necessary, and it is a trait that very few of us exemplify. But it is a trait that is necessary for the success of every auditor and every audit department.​

Internal Auditor is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.



Comment on this blog post

comments powered by Disqus
  • Your-Voices-Recruitment-January-2022-Blog-1
    • IT-General-Controls-Certificate-January-2022-Blog-3