​​Transforming Internal Audit Through Critical Thinking

Comments Views

​Congratulations to KPMG for taking on this topic in a new publication (PDF)!

I have been a big believer in the need for internal auditors to become better at using their native assets, writing about using their eyes, ears, and the space in between.

In my presentations on world-class internal auditing, whether to IIA institutes or chapters (including my upcoming keynote for IIA–Chicago), or in a formal training session, I explain that most internal auditors are trained not to think! Most come out of the public accounting firms where they are told to follow firm standards and established audit programs. They are not told to use their judgment — that is reserved for partners and some managers (even then, not always exercised by them).

If internal auditors are going to understand what they are seeing and experiencing as they perform their audits, they have to free their minds from the chains of "do it my way," "you must follow this methodology," "you are too young," and "you don't understand my business." They have to learn to find the time to think — which requires, in most cases, quiet reflection.

Would you rather see an auditor busy poring through documents, ticking and tying as he goes, or sitting (perhaps with eyes closed) thinking about what he has been seeing?

Auditors need to find the time, after obtaining information, to think about what they have found. Does it make sense? Is any information missing? Is this the best way to perform that activity or that control? Have I seen this done a different way somewhere else; was it done as well or better then? Is there a risk doing it this way? Are they spending too much time and resource given the level of risk?

How can you answer the question "What do you think?" if you are not taking the time to think?

Some internal audit departments seem to reserve the privilege of thinking for managers and directors. World-class internal audit departments not only allow but demand that every member of staff, from the most junior to the most senior, think!

In particular, we must learn to unchain our staff and ourselves from the thinking of the past, our prior experience and bias.

Just because something was the right answer last time, doesn't mean it's the right answer here and now.

KPMG correctly points out that organizations want "internal audits that are insightful, forward looking, and go beyond preserving value to creating value on a departmental, divisional, or organization-wide level." That requires thinking and the exercise of our professional judgment!

Some are scared of using that judgment and saying what they think. My answer is that as professionals, we must be prepared to form and express our professional opinion.

The KPMG report is interesting and useful. It focuses on the need for internal audit to come up with creative ideas for process improvement but doesn't address sufficiently, in my opinion, the need to nurture thinking skills.

CAEs and everybody in audit leadership must change their approach to supervision if they are to encourage and grow critical thinking skills.

For example, when reviewing an audit engagement, put the report and working papers aside. After asking questions about what the audit team found, ask questions like "What do you think about how the department is run?" "Do you think the process is efficient?" "Do you think risks are managed well?"

The most important follow-up question is "Why do you think/say that?"

Audit leaders must not fall into one of these traps:

  • Giving a staff member the answer to their question instead of helping them find it themselves.
  • Telling somebody they are wrong, instead of asking them "why do you think that" and helping them see the correct answer themselves.
  • Not allowing people time to think, even scolding them when they pause for a quiet moment of reflection.
  • Failing to show respect for the thoughts of even the most junior and inexperienced individual.
  • Assuming that just because somebody came up with an answer you agree with that they got there the same way. Explore why they think that way, because they may just be telling you what they think you want to hear.
  • Not providing people with the training they need in critical thinking skills. Many years ago, I attended training from the American Management Association and would highly recommend it.

So what do you think?

​The opinions expressed by Internal Auditor's bloggers may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers' employers or the editors of Internal Auditor. The magazine is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.



Comment on this article

comments powered by Disqus
  • IIA Quality_July 2020_Blog 1
  • IIA Online Testing_July 2020_Blog 2
  • IIA Training_July 2020_Blog 3