Constructive challenge. This is the mantra of any good internal audit service. The critical friend, supportive auditor, constructive supporter. Of course these conceptualisations of the relationship between the auditor and the audited are important, accurate and helpful. Is it worth thinking, however, about how the auditor is challenged?
I have been lucky to work for some great bosses during my career so far. Some have really understood internal audit, others less so, but the consistent theme has been a mutual respect and an understanding that I, as an independent auditor, was not ‘managed’. For some this seems to have been quite freeing for them, in that we have had a really good debate and discussion on a ‘no win, no lose’ basis, without the burden of having to play the roles of the manager and the managed. If you like, being seen as a peer and a confessor or mentor.
I have also been very blessed with some great staff and colleagues. I have a view that all people’s views are important, whether senior or not. How many times have you found the best and most useful information from the cleaner, PA or secretary; the ‘real’ way things are. As a consequence I like to think of my team’s audit opinions to be formed by the team. Sure I am the boss who is accountable for it all and must ultimately be comfortable with the opinion issued, but very rarely have I found a review process never to yield something of value or additional benefit to that I presented.
Opinions are formed, based on evidence, and are tested, reviewed and challenged. It therefore mystifies me how, therefore, some auditors give ‘limited assurance’ or other such wordings based upon pseudo-scientific methodologies such as one major and two minors = limited, three minors = satisfactory etc. This assumes a level of scientific and statistical rigour that is not consistent with the underlying work, unless of course you have a statistical model of risk like banks (should) do for their investments.
I would, therefore, encourage all of my colleagues to be open to having their work reviewed, their views and opinions challenged and their writing critiqued and edited; it is the pruned plant that grows strongest. There is always a risk that a CAE can become detached, full of self belief and run amok when allowed to be truly independent of management. I think, because of this risk, a CAE should therefore make themselves more open to scrutiny, challenge and review, not less.
I hope that you agree. How do you ensure that you are challenged?