In my last blog post I outlined my audit epiphany regarding internal audit, namely that the underlying assumptions you have to understanding how client organisations work should be matched by an intellectually consistent method. Having thought this through I think there are some interesting points arising from this.
First I want to outline my view that I believe the two extreme ontological and epistemological assumptions don’t seem to work for me in a real-world setting. That is, a purely positivist, scientific approach does not capture the messy and complex social reality I see at my clients. For me the assumption of a single scientific reality just waiting to be discovered, certainly at strategic and tactical layers of an organisation, feels wrong. It is this same approach that I believe banks applied to their risk management, believing it to be scientific, with the results we have seen. Some understanding of qualitative and judgemental factors is just as important to internal audit as it is for risk management. The idea that organisations face a series of right and wrong answers speaks to me of the internal audit of yesteryear. This positivistic internal audit with its auditor right, auditee wrong, must-do recommendations, is just wrong on so many levels.
Similarly though, the other extreme of an idealist approach with its view that everyone is right, as there is no objective knowledge, just that as created and seen by others’ point of view, seems wrong too. Surely not everyone can be right? Surely there must be a better answer than just opinions. This too has some view of old internal audit, with its subservience to the ‘expert’ management; the view internal audit can’t and shouldn’t have an opinion over the ‘management’ issues of the day. Managers are no different to internal auditors, particularly senior managers. They face the same risk and management challenges over which they need to evaluate and take a view, as do we as auditors. At a senior level, management experience that makes them ‘expert’ in the view of this style of internal audit, is in fact the same judgements and decisions that are taken by internal audit when providing an opinion in this area. Internal audit often has a wider range of experience to draw upon than some functional managers.
So what view makes sense to me? Well a realist view. A view that there is a reality that is external to us. I also recognise that different people have different views of the same thing. In other words, this external reality is mediated through others’ views. I see this every day when working with clients. I have seen the same facts and events assessed completely differently by different people. I do believe also that the independent internal auditor is uniquely placed to make an assessment of these views and put forward an authoritative analysis of the situation.
Thus realist internal audit is neither the identification of the right answer in a positivistic manner, nor the collating a set of management narratives and providing a subservient, lacking authority, narrative of ‘potential risks’ caveated to death (often the result when you ask a positivist-scientific internal auditor to work at a strategic level). It is the sense of providing an objective analysis which recognises that the right answer may appear differently to different parties. Thus it is a professional analysis, presenting a plausible opinion, that addresses the various views and adopts a narrative that is recognisable and supportable with evidence.
What approach do you have?