Audit cycle – How we actually work

7 Oct

I value this diagram from Scharmer’s “Theory U” (2009) and recommend it for use within the Internal Audit (IA) community:

ia-practice-pic

Based on the insight that IA is not the decision maker, IA is not the one that will ultimately change things, IA can only inspire people to change. That requires a healthy level of modesty; asking questions rather than assuming expertise; being open-minded and respectful in regard to the organization; and acknowledging that IA is just one part of the organization, requiring the rest of the organization in order to succeed.

On that basis, this audit cycle starts with appreciating what is:

1 – SEE WHAT WE DO:

IA first sees and appreciates what the company (the process owner/s) do (does). IA is on site and views via, for example, talk-through and document based walk-through what is actually happening, not what should be happening.  Then,

2 – RECOGNIZE WHAT WE SEE:

IA puts things into perspective, compares observed practices with company standards or best practices (to extent known), analyzes, summarizes, synthesizes etc. When possible, in doing so leveraging IT, e.g. via using Process Mining as a tool analyzing big data and unearthing patterns in the digital traces in the ERP systems. Then,

3 – SAY WHAT WE THINK:

IA then states what it saw and thinks it says, thereby pointing out control weaknesses and/or unexploited performance potential. The written audit report is the typical vehicle for doing that. IA considers providing other means of communication as appropriate.  Eventually, and that matters most,

4 – DO WHAT WE SAY:

IA then follows-up on topics and actions as ultimately agreed with management in the closing meeting. In doing so, IA can only trigger action, and help remediation and improving things, but it cannot act on behalf of the key process owners themselves as it has no operational responsibility.

Views welcome.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: