My wife invited a friend and her daughter over for Easter. We
also invited our son. (Our daughter is in California. The restrictions there
are much more stringent than here in Arizona, so we felt there was no need to offer
an invitation we knew would be declined.) Our son declined saying that he and
his wife felt it better to not be doing any visiting for a while.
In no time at all, our kids began informing us that they
were concerned about us having someone over. Note that I am 64 and my wife is within
the same range. (Shoot, she won’t care if I tell. She’s 63.) We are in one of
the identified risk groups.
The kids were definitely concerned and a text message exchange
ensured. At one point, I prodded my son, an internal auditor, with this text. “I
want a write up using the 5 C's.” In short order, his reply was received. (Reproduced
here with minor edits.)
Condition: You are actively meeting with people during a
pandemic
Criteria: The shelter in place order is in place
Cause: C’mon now
Consequence: Literal death
Corrective Action: Cancel plans
(At this point, let me interject that, when I received his
response, I advised my son that it might wind up as part of a post. He replied that
he was fine with it, but I should be ready for comments about why I was insane
to not cancel the plans. Please feel free to weigh in.)
Not too bad for a quick turnaround. And, other than not articulating
a real cause (I’m assuming he felt the true root cause was his parents were,
once again, being idiots — at one time or another the belief of any offspring
regarding their parents), it hits the mark.
Now, from an audit client perspective, I looked at this and began
my arguments. (Isn’t that the way it always goes?) We believed we were taking
into account not only the risks, but how those risks were being managed to an
acceptable level. In addition, the consequence seemed to be a bit much.
But my digging wasn’t over, and I found myself putting on my
internal audit hat. For example, while at first I thought the consequence was
overstated, closer examination showed it was probably accurate. Alternatively, it
might have been stated that someone would get sick or a disease would be
transmitted. But the most important impact on the “organization” that is my
life — an organization whose objective is continuance of that life — was, indeed,
death.
And then I began to see the real problem in this
conversation. And it ties into what I was talking about in my last blog post —
risk, probability, and uncertainty.
My wife and I were looking at the risk through the lens of the
probabilities and potentialities we perceived. Our kids were looking at it
through different, albeit just as justifiable, lenses. And, because of the amount
of uncertainty involved, we came up with wildly opposite but equally justifiable
conclusions. With those uncertainties, there was no “correct” answer.
Isn’t it fascinating when we take the tools of internal
audit and start to actually apply them to the real world? As an example, let’s take a look at what is going on around
us right now.
As I type this, the various states in the U.S. are taking
decidedly different approaches in opening their economies. The decision is a nigh-on-impossible
balancing act. A friend and I were discussing a situation in his neighborhood
where people literally could not afford food, and he articulated the situation
perfectly: “We are balancing the potential of deaths caused by a virus with the
potential of deaths caused by a plummeting economy.”
Different situations and different interpretations result in
different decisions. And each leader views decisions through his or her own
risk lens. Someone living in Manhattan is facing different situations and
different risks than someone living in Truth or Consequences, N.M. And,
even in the same state, differences abound. The governor of Florida feels one
approach is correct for his state; the mayor of Miami feels a different
approach is necessary for his city.
Leaders are making life-or-death decisions based on the best
information they have. But the best information does not provide absolute
certainty. In fact, risk is being evaluated and decisions being made in a
culture of almost total uncertainty. Some leaders are willing to accept what
they consider to be low probabilities and begin to move forward; some act more conservatively
in the belief that the uncertainty means the unknown probabilities have to be
respected. Without the necessary information, it is hard to say which, if any,
approach is best.
Tom Peters recently articulated it best:
“What an imbroglio
we are in the midst of. This is not a once-in-a-lifetime event; this is a once-in-three-lifetimes event. And the data are still so incomplete and conflicting
that we don’t really know ‘what we’re in the middle of.’ All bets are literally
off.”
I’m not trying to say who is wrong or right. I don’t have
the information, I ain’t smart enough, and I wouldn’t want to be in the
position to be making these decisions. What I’m trying to show is, in the real
world, risk, probability, and uncertainty play an active role in the decisions
that need to be made, whether or not that is articulated.
(Wow. Internal auditors don’t often get to see our concepts
so dramatically exhibited.)
Which leads to the real challenge for the internal auditors
in our midst. As your organization weighs in on decisions about whether or not to
open, you need to be there helping your leadership understand what needs to be
considered. It is not whether or not the government will allow your
organization to be open. Instead, it is understanding, given the
information available, what the risk is and whether the action that will be taken is worth
that risk. And preaching to them the impact of uncertainty on the evaluation of
the risks.
Finally, you’ve heard this a lot these days, but
let me say it, too. Be safe out there. This is an important time for everyone. And
it should be an important time for internal audit. A time to step up and help
lead organizations toward the right decisions. But don’t do anything stupid.
And try not to let anyone else do anything stupid, either.
