One of the complaints we constantly hear is that internal
audit is too focused on the past, that it needs to be looking at future risks
rather than past mistakes.
There are a lot of cures for this — changing our risk
assessments, test approaches, overall audit objectives — and many audit shops are
successfully transforming the conversation.
But sometimes it can be as simple as a tweak, for example, a
small change to how we ask questions we have asked many times before.
The very first time I was introduced to the question, “What
keeps you up at night?” I was floored. What a great way to get clients
thinking about risks. And, just like many of you, I made this a primary weapon
in the arsenal of risk assessment.
Unfortunately, time has not been kind to this approach. The
question has become a cliché and is asked by many professionals in many
situations. And, if you are still using it, I’m willing to bet that it is
greeted with a knowing nod, a smile of familiarity, and, behind your back, the
rolling of eyes.
Been there done that. Same old, same old. Internal audit is
at it again. When’s my next meeting.
Here’s a suggestion from journalist Porter Anderson; a twist
on the question that breathes new life into what has become mundane.
“Never ask, ‘What keeps you up at night?’ Ask ‘What’s going
to keep you up tonight after this interview?’”
A subtle difference, but reframing the question leads to new
Now, I can’t say for sure it is going to be a well-spring of
new ideas, concepts, and risks, but I think it will give the interviewee pause.
It feels familiar, but it’s not the same question that has been asked time and
time again. And it has the feel of looking forward, not to the past.
I could be wrong, but I think A there is an excellent chance
you will get information you have never gotten before.