Internal Auditor’s blogs reflect the personal views and opinions of the authors. These views may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers’ employers or the editors of Internal Auditor.

Tell Me Why It Won't Work​

Comments Views

I’ve seen a lot of internal audit shops struggle with their audit schedules. (I lived knee-deep in that struggle myself.) Promises made face the reality of hours wasted resulting in an inability to accomplish what needs to be accomplished. Everything seems to take more time, nobody seems to be available when we need them, data is not residing where we expect it to reside, documentation isn’t where it was promised to be … the hours and the best intentions evaporate. We try harder, we work harder, we look for the process breakdowns, we try to solve them, and, invariably, we miss the mark. (There are exceptions — audit departments that have this nailed and continue to succeed year after year. Yet, I’m willing to bet even they would admit to a certain freneticism as deadlines, budgets, and the audit committee loom.)

But the cause may be more fundamental than we have led ourselves to believe, as may be the solution.

When we are doing our annual planning, our scheduling, and even plotting how we will accomplish an individual audit, we invariably assume things will go well. Oh, we may expect a couple of minor snafus and add a few hours for “just in case,” but we are continuously optimistic that we will overcome the problems we have had in the past, that things will run more smoothly, and that meeting our commitments, while a battle, will be a battle we finally win.

It never works that way, does it? Look back at the audits that have gotten delayed, the schedules that didn’t get met, and the plans that weren’t accomplished. First, I’ll bet it didn’t take you more than two seconds to come up with multiple examples. What does that say about your (our) success rate? Second, think about what caused things to go wrong and you will start to recognize that the normal pattern for the completion of projects is not one of success, but of things going wrong. Normal is not perfection; normal is a series of events and happenstances that hinder our ability to get things done. We plan for everything to go well, and it seldom, if ever, does.

To overcome that optimism bias, research psychologist Gary Klein uses an approach he calls a "premortem." Here’s how it might work in an internal audit environment. When all is said and done, and you are about to put the final okey-doke on the schedule (plan, audit, whatever the project), get together a group of people who are knowledgeable about the schedule (plan, audit, etc.) and pose the following: “It is the end of next year and, once again, we have not met our schedule (plan, audit, etc.) In fact, it has become an unmitigated disaster. Take 5 to 10 minutes to write a brief history of this disaster.”

Two interesting things should happen. First, because individuals find themselves no longer shackled by the expectation of success, they become much more honest and transparent about what may go wrong. Realism overcomes optimism.

Second, as you play with this approach a few times, you will begin to see a pattern of causes — repeating reasons why success, as defined by the original estimates, cannot be achieved.

With this information in hand, do two things. First, start doing a little risk mitigation. Look at the issues and determine how you can reduce the risk of them occurring. Of course, you are probably already doing so. But this exercise can help focus the need for change.

But, second, and perhaps most importantly, with a better understanding that not only is the deck stacked against you but the dealer is constantly changing the rules, go back and reevaluate what it is you think you can realistically accomplish. And then change your estimates to match that actual reality.

If you are wrong — if things go wonderfully — and you get more done than you promised, then let the celebration and the accolades follow. However, if this new estimate is a better reflection of reality (and I’ll place a little side bet — my 1973 copy of Sawyer’s Practice of Modern Internal Auditing against a signed copy of your audit schedule — that this is, in fact, what actually happens), then you will spend much less time explaining why you did not succeed and more on how you will do even better next year.

This works for any situation — the annual plan, the audit schedule, an individual audit — any of the various projects that make up our lives as internal auditors. For example, next time you are implementing something new in the audit department — new procedures, new analytics, new workpaper standards, new projects — take the time to bring a group together and ask the question: “In the future, why was this a disaster?”

And, once you’ve proven the success to yourself, bring the tool to others within the organization. In fact, as part of internal audit’s role in risk mitigation, maybe this is something we should always bring up. Not, what could go wrong (which never seems to quite elicit the needed answers,) but imagining a future where it has already gone wrong.

Of course, there is one other nasty thing which I have kind of shied away from up until now. Once you have the answers — once you understand the reality of the situation — you have to believe in them enough to make the necessary adjustments, no matter how unpopular that decision may be. Because it is far too easy to maintain that optimistic attitude in spite of what you have discovered. And it is hard to tell others that more time will be needed, less audits will be completed, and that expectations of the past are not the truth of the future.

However, if you don’t, you’ll just spend another year explaining why nothing seems to go the way you planned.

Internal Auditor is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.

 

 

Comment on this blog post

comments powered by Disqus
  • IIA GRC_APril 2019_Blog 1
  • IIA Guidance_April 2019_Blog 2
  • IIA CIA_April 2019_Blog 3