Congratulations to KPMG for taking on this topic in
a new publication (PDF)!
I have been a big believer in the need for internal auditors to become better at using their native assets, writing about using their
eyes, ears, and the space in between.
In my presentations on world-class internal auditing, whether to IIA institutes or chapters (including my upcoming
keynote for IIA–Chicago), or in a
formal training session, I explain that most internal auditors are trained
not to think! Most come out of the public accounting firms where they are told to follow firm standards and established audit programs. They are not told to use their judgment — that is reserved for partners and some managers (even then, not always exercised by them).
If internal auditors are going to understand what they are seeing and experiencing as they perform their audits, they have to free their minds from the chains of "do it my way," "you must follow this methodology," "you are too young," and "you don't understand my business." They have to learn to find the time to
think — which requires, in most cases, quiet reflection.
Would you rather see an auditor busy poring through documents, ticking and tying as he goes, or sitting (perhaps with eyes closed) thinking about what he has been seeing?
Auditors need to find the time, after obtaining information, to think about what they have found. Does it make sense? Is any information missing? Is this the best way to perform that activity or that control? Have I seen this done a different way somewhere else; was it done as well or better then? Is there a risk doing it this way? Are they spending too much time and resource given the level of risk?
How can you answer the question "What do you think?" if you are not taking the time to think?
Some internal audit departments seem to reserve the privilege of thinking for managers and directors. World-class internal audit departments not only allow but demand that every member of staff, from the most junior to the most senior, think!
In particular, we must learn to unchain our staff and ourselves from the thinking of the past, our prior experience and bias.
Just because something was the right answer last time, doesn't mean it's the right answer here and now.
KPMG correctly points out that organizations want "internal audits that are insightful, forward looking, and go beyond preserving value to creating value on a departmental, divisional, or organization-wide level." That requires thinking and the exercise of our professional judgment!
Some are scared of using that judgment and saying what they think. My answer is that as professionals, we must be prepared to form and express our professional opinion.
The KPMG report is interesting and useful. It focuses on the need for internal audit to come up with creative ideas for process improvement but doesn't address sufficiently, in my opinion, the need to nurture thinking skills.
CAEs and everybody in audit leadership must change their approach to supervision if they are to encourage and grow critical thinking skills.
For example, when reviewing an audit engagement, put the report and working papers aside. After asking questions about what the audit team found, ask questions like "What do you think about how the department is run?" "Do you think the process is efficient?" "Do you think risks are managed well?"
The most important follow-up question is "Why do you think/say that?"
Audit leaders must not fall into one of these traps:
- Giving a staff member the answer to their question instead of helping them find it themselves.
- Telling somebody they are wrong, instead of asking them "why do you think that" and helping them see the correct answer themselves.
- Not allowing people time to think, even scolding them when they pause for a quiet moment of reflection.
- Failing to show respect for the thoughts of even the most junior and inexperienced individual.
- Assuming that just because somebody came up with an answer you agree with that they got there the same way. Explore why they think that way, because they may just be telling you what they think you want to hear.
- Not providing people with the training they need in critical thinking skills. Many years ago, I attended
training from the American Management Association and would highly recommend it.
So what do you think?