The root cause of almost every internal control issue is people. See this earlier discussion.
It could be that individuals charged with designing or performing the control lacked judgment, experience, training, or simply under-performed. It could also be that they had too great a workload and were therefore unable to perform at required levels, or had failed to perform their duties on a timely basis.
Often, individuals under-perform because their managers are ineffective. Low morale clearly impacts performance, as does inadequate supervision. If individuals do not have the required experience or training, or are overwhelmed by their workload, that is the fault of their management.
Another issue can be that individuals do not have the information required to perform their work. Again, that may be due to their inability to perform, their manager's failure to communicate, or a broader issue within the organization — a failure of teamwork, sharing, etc.
Organizational issues also include a failure to clearly assign accountability and responsibility. A document (such as a corporate standard or delegation of authority) is not enough. People need to know what they are accountable and responsible for — and have the necessary authority.
When internal auditors, you or I, perform an audit do we always assess the organization and staffing, and whether people have the knowledge, training, experience, information, etc. to perform their assigned work? Do we assess whether managers and staff have time to do everything asked of them, with quality products? Do we evaluate and comment on employee morale?
When is the last time you recommended additional staffing because the root cause of a failure to perform reconciliations on time was the lack of sufficient staff? What about commenting on an organization that is so complex, with multiple matrix reporting lines, that it was unclear who owned what?
I can remember a great commotion when I included in an audit report the finding that the issues related to an accounting group were due to a poor manager, who withheld information, tyrannized his staff, and created an environment where mistakes of significance were likely — and occurred.
In addition to tackling the people issue in every audit, I believe we need to re-think the importance of performing audits of a) human resources processes, including hiring, performance evaluations, etc., and b) organizational design, including whether accountability and responsibility are clearly defined and communicated, staffing levels are appropriate, and individuals receive the information necessary to perform their work.
Are you a people auditor?
I welcome your comments.