Last week, because of what I perceived as a particularly flawed episode of Saturday Night Live which starred Justin Bieber, I started what has (surprise, surprise) turned into a rather long discussion of the lessons internal audit can learn from that show. Last Monday we talked about how progress comes in fits and starts, and everyone has to take responsibility for pushing past the slow times to ensure overall progress. On Tuesday, we talked about the impact of trying to do too much with too little, and how it can degrade the department. Today we are going to move on to a discussion of how chasing the latest fads can negatively impact risk and audit planning.
This isn't the first time SNL has jumped on a popularity bandwagon to its own detriment. Let's face it – the process of finding guest hosts for the show is not about ensuring the finest talent, it is about how many eyeballs will come running to the television screen.
And so, with the mindset of "stardom equals success", Justin Bieber appeared on the show because he is popular and the girls swoon and he might bring in a younger audience and, quality-be-damned, it is the thing everyone else is doing so we'll do it to. (Don't get me wrong; popularity can succeed. Psy's appearance on the first show this year was hilarious. And I still can't believe no one has posted a YouTube video of "Audit Style." I've got a great idea for the video if there are any investors out there that would like to help me...what? Get back on topic? Okay. If you insist.)
Following fads makes some twisted sense for the television world. Often, it can be a disaster (as I would argue the Bieber show was), but that is what television is about – pandering to the viewer.
However, pandering to our customers can be detrimental to internal audit. Developing our plans, we walk a thin line as we identify the important risks to which we should respond. And that means we must discern the difference between real risks and "vapor" risks – that is, risks that, while they seem real, just don't exist.
Now, if I were to speak with each of you, I'm willing to bet that you would indignantly assert that your risk assessment process is thorough and leads to the inclusion of only those reviews which represent the highest risks. You would say you are always focused on the work that must be completed to provide the best overall assurance. You would say you don't have resources to waste (see Tuesday's post) and so you always do the most important work. At the very least, you might concede a very occasional slip, but you always get to the core, to the quick, to the meat of your risk universe, and you have nothing but unfrittered hours of audit work.
You would tell me you have no "vapor" risks.
And to you I would say "Pshaw" (because it is a word that can be repeated in a family-oriented blog like this one – that is, assuming you have some kind of warped family that reads internal audit blogs – which reminds me of the story of a friend/co-worker of mine who indicated his wife was reading my blog to which there was much discussion about her need to get a life.) Again, I say "Pshaw." And I'll provide two examples of why I pshaw you.
First, if you have any kind of positive relationship management process with your auditees – directors, senior executives, board, whomever – I defy you to prove that every review you completed in response to their requests was more important than the reviews you cancelled to make room for those requests; I defy you to prove that every single time you said "yes" it was because of a risk greater than that related to the audit you delayed.
Yes, I know why you did it. Yes I understand relationship management. And, yes I understand that the one you put off wasn't really that important. But, nonetheless, you have sacrificed, however slightly, to the whims of popular taste and ill-formed concepts of risk.
Again, I am not condemning the practice; I am just indicating that all of us have slightly sullied hands. And it can be a slippery path; the more we succumb to these requests, the more likely we are to start chasing fads and vapors rather than the real risks.
However, I think there is an even more egregious type of "fad chasing" for which we have to be careful. Here's an example.
A few years ago, when the economy was taking its rather infamous nosedives and everyone was realizing the word "recession" was being set free to roam the landscape, a large number of organizations (including the one I was working for) began doing recession risk analysis. That is, a specific analysis was being conducted to look at the impact a recession would have on the organization.
Phrases containing words such as horses and barn doors spring instantly to mind.
I know of other companies that did a lot of work – in some cases a year's worth of work – on such analysis. Quite possibly these exercises led to the recognition of issues which still had an impending impact. But, generally, they appeared to be studies in identifying risks that had already become manifest.
Was it an important assessment to complete? Yes. How was the timing? Uh, can I get back to you on that one?
So, as we sit here today, the economy seems to be recovering and everyone is wiping their figurative hands across their collective brows saying "whew". And audit life goes on as it did before. And no one seems to be asking the follow-up questions. If this was an important exercise during the recession, how is it less important now? How many departments are going back to that recession risk assessment exercise and updating it? How many departments that did not do recession risk assessments are now thinking "you know, that's not a bad idea – maybe we should put one together?" (I'll guess the answer to those last two is close enough to zero that the difference can be measured in micro-give-a-darns.)
The time for a recession risk assessment is before the events. And mark my words – it may not be today, it may not be tomorrow, it may not be for another ten years – but there will be another recession. If audit wants to prove it is providing value, then it may want to be there helping the organization prepare for the storm rather than showing up after the house has blown down explaining they should have put up storm shutters.
Fads in popular culture or internal audit have something in common – they help show a mindset that is going on throughout the country or the profession. And they can provide deeper insights into what is occurring. But the chasing of fads will seldom lead to success. Rather, lessons learned from fads have to be engrained to ensure they make things work better in the future.
Tomorrow – one trick ponies and a wrap up.