I’ve seen a lot of internal audit shops struggle with their
audit schedules. (I lived knee-deep in that struggle myself.) Promises made face
the reality of hours wasted resulting in an inability to accomplish what needs
to be accomplished. Everything seems to take more time, nobody seems to be
available when we need them, data is not residing where we expect it to reside,
documentation isn’t where it was promised to be … the hours and the best intentions
evaporate. We try harder, we work harder, we look for the process breakdowns,
we try to solve them, and, invariably, we miss the mark. (There are exceptions —
audit departments that have this nailed and continue to succeed year after
year. Yet, I’m willing to bet even they would admit to a certain freneticism as
deadlines, budgets, and the audit committee loom.)
But the cause may be more
fundamental than we have led ourselves to believe, as may be the solution.
When we are doing our annual planning, our scheduling, and
even plotting how we will accomplish an individual audit, we invariably assume
things will go well. Oh, we may expect a couple of minor snafus and add a few
hours for “just in case,” but we are continuously optimistic that we will overcome
the problems we have had in the past, that things will run more smoothly, and that
meeting our commitments, while a battle, will be a battle we finally win.
It never works that way, does it? Look back at the audits
that have gotten delayed, the schedules that didn’t get met, and the plans that
weren’t accomplished. First, I’ll bet it didn’t take you more than two seconds
to come up with multiple examples. What does that say about your (our) success
rate? Second, think about what caused things to go wrong and you will
start to recognize that the normal pattern for the completion of projects is
not one of success, but of things going wrong. Normal is not perfection; normal is
a series of events and happenstances that hinder our ability to get things
done. We plan for everything to go well, and it seldom, if ever, does.
To overcome that optimism bias, research psychologist Gary
Klein uses an approach he calls a "premortem." Here’s how it might work in an
internal audit environment. When all is said and done, and you are about to put
the final okey-doke on the schedule (plan, audit, whatever the project), get
together a group of people who are knowledgeable about the schedule (plan,
audit, etc.) and pose the following: “It is the end of next year and, once
again, we have not met our schedule (plan, audit, etc.) In fact, it has become an
unmitigated disaster. Take 5 to 10 minutes to write a brief history of this
Two interesting things should happen. First, because individuals
find themselves no longer shackled by the expectation of success, they become much
more honest and transparent about what may go wrong. Realism overcomes
Second, as you play with this approach a few times, you will
begin to see a pattern of causes — repeating reasons why success, as defined by
the original estimates, cannot be achieved.
With this information in hand, do two things. First, start
doing a little risk mitigation. Look at the issues and determine how you can
reduce the risk of them occurring. Of course, you are probably already doing so.
But this exercise can help focus the need for change.
But, second, and perhaps most importantly, with a better
understanding that not only is the deck stacked against you but the dealer is
constantly changing the rules, go back and reevaluate what it is you think you
can realistically accomplish. And then change your estimates to match that
If you are wrong — if things go wonderfully — and you get
more done than you promised, then let the celebration and the accolades follow. However,
if this new estimate is a better reflection of reality (and I’ll place a
little side bet — my 1973 copy of Sawyer’s Practice of Modern Internal Auditing
against a signed copy of your audit schedule — that this is, in fact, what
actually happens), then you will spend much less time explaining why you did not
succeed and more on how you will do even better next year.
This works for any situation — the annual plan, the audit
schedule, an individual audit — any of the various projects that make up our
lives as internal auditors. For example, next time you are implementing something
new in the audit department — new procedures, new analytics, new workpaper standards,
new projects — take the time to bring a group together and ask the question: “In
the future, why was this a disaster?”
And, once you’ve proven the success to yourself, bring the
tool to others within the organization. In fact, as part of internal audit’s
role in risk mitigation, maybe this is something we should always bring up. Not,
what could go wrong (which never seems to quite elicit the needed answers,) but
imagining a future where it has already gone wrong.
Of course, there is one other nasty thing which I have kind
of shied away from up until now. Once you have the answers — once you
understand the reality of the situation — you have to believe in them enough to
make the necessary adjustments, no matter how unpopular that decision may be. Because
it is far too easy to maintain that optimistic attitude in spite of what you
have discovered. And it is hard to tell others that more time will be needed,
less audits will be completed, and that expectations of the past are not the
truth of the future.
However, if you don’t, you’ll just spend another year
explaining why nothing seems to go the way you planned.