As the new year gets back into full swing and we all return to work I’ve managed to have an audit epiphany (I like to be liturgically correct). I will give due credit, this epiphany moment came courtesy of my PhD supervisor and his excellent book. When reviewing research methodology it occurs to me that internal audit is just like research.

Research is about looking at a problem, issue, phenomena, and seeking to understand and explain it. This explanation comes in the format of an opinion. Like any opinion, its strength and explanatory power is bounded by the breadth and depth of evidence underpinning it. Like all opinions it should be put in its proper context with a set of caveats, of an increasingly robust nature, where the evidence base is smaller.

Now all of this I have hinted at before in my previous blog posts. The real epiphany for me though was, reading my supervisor’s excellent book on research methods, that the research method chosen (whether positivistic scientific, idealist or realist) has a set of assumptions ingrained within it. In other words each methodology is consistent with those assumptions. Indeed, the research methodology will only be effective where the methods are designed to test and identify the data regarded as important according to the assumptions.

What are these assumptions about? They are about two key things; the theory of being (ontology) and the theory of knowledge (epistemology). Or in other words, ontology asks the question whether there is anything outside of the human being. So is there an objective reality outside of the existence, mediation and perception of humans? Epistemology is different and asks, what is knowledge? In other words how do we know what we know?

It is the combination of the ontological and epistemological assumptions thus means we can ask questions such as, can knowledge be identified as being outside of human beings’ experience? So a scientific, positivist approach would argue that there is an objective reality of knowledge outside of humans and human experience. Research’s purpose is, therefore, the process of discovering this reality and knowledge. An idealist approach would argue that there is no objective reality of knowledge, that all knowledge is created and mediated through humans’ views and experience. As such there is no correct answer, merely a series of interpretations which have equal validity and weight.  An approach between these two, a realist approach, would recognise that there is an objective reality but that humans interpret and understand it differentially, thus understanding these interpretations is important.

How does all of this apply to internal audit? Well, if internal audit is analogous to research, then it is important to understand the ontological and epistemological assumptions underpinning the audit plan. In my view the profession, as it has become more strategic, more focused on the social and descriptive aspects of organisations, has not moved its fundamental assumptions. We all know internal audit used to compliance check operational financial controls, that was its birthplace; yet the advent of a risk-based audit requirement forces auditors to get into more judgemental strategic areas, to form a view and opinion over systems, processes and risks, understood, managed and mediated by people. Wonderfully interesting, messy, complex, challenging and variable, people.

Yet what I would call ‘old school’ internal audit still has the old scientific, positivist, approaches to internal audit work. Assumptions of a controlled environment, clear and proximate causality. A sense of right and wrong. I think that these are actually different schools of internal audit.

As my supervisor points out the nature of the work done differs under each assumption. A positivist auditor would see an audit like a scientific experiment with a theory to be tested by representative sample testing. A realist would see an audit much like a police investigation with various points of view being identified and a conclusion drawn. An idealist would see an audit as describing the organisational reality like a novel, leaving the reader of the report to form conclusions. I would not argue that any approach is wrong per se but that each approach has its time and place and the assumptions underpinning need to be understood by auditors and those receiving the resulting work accordingly.

Now this revelation in my thinking is still be worked through by me and I think presents an interesting challenge to the leaders of our profession. I hope to provide some ‘so whats?’ in the next few blog posts.

What assumptions do you have and what type of auditor are you?