I heard an interesting phrase this week – ‘we get stuck at the analysis phase’. This got me thinking. Perhaps internal audit does this? We, as internal auditors, are bound to analyse the situation. In a risk based world this analysis is effectively a risk-based analysis. You could use other criteria to analyse the world though, morals, ethics, financial cost, loss of profits etc. But, for me, in a professional setting it would be risk analysis.
Now, as a regular reader of my blog (if there is such a thing) would know, one of my great criticisms of the internal audit profession is that it does not analyse enough. Specifically, it does not really engage meaningfully with the business and the complexity it is trying to audit. So many of my professional colleagues are happy to either remain in the operational and compliance ‘basement’ or to avoid holistic risk analysis and instead simply go with the approach of ‘I’ve got enough points in the report, it’s fine’.
But for me, I wonder if I do make enough of an impact at the analysis phase? Or do I get stuck at that point? Is analysing the situation (as we do from a non-executive standpoint) enough? Is this the dreaded ‘added value’?
Well I consider that this is added value in, and of, itself. If I were running a business, having a unit that was incisive, was able to really understand where the business is and to report the risks it faces would be of value. What, though, if I wanted to sort out the business problem, would I go to internal audit? I’m not so sure at present.
This non executive thing is a problem – I would want to be able to commission the actions. So what is the solution, as being non executive is a red line from an auditing standards viewpoint? Well, I would suggest that the solution is for an audit report to have a good set of suggestions and actions plans for delivery. Then it could be handed across to the business as a consultant does for their work’s delivery.
For these recommendations (or suggestions as I call them) must be more than ‘management need to sort out the problem X identified’. This is not helpful nor useful and makes the whole point of auditing disappear. So if a strategy is missing, say (not an unusual position for many organisations), let’s make a meaningful observation first. Something like, a strategy, by that a meaningful diagnosis of the situation supported by a set of supporting objectives, and an ascribed to individuals, action plan is missing. This needs to then be followed by a reasonable, context-dependent, recommendation or suggestion. Something like, we recommend X Y and Z work on development of an analysis of the strategic position using X Y Z management tools. This could then be discussed by X group and approved by Y group or board. A supporting action plan that allocates resources to specific activities should be put in place etc etc…
So does internal audit get stuck at the analysis phase? No, not in my view. First because a great majority of the profession do not analyse in the first place. Second those that do, could and should provide a reasonable and clear set of instructions to be applied by executive management.
So do you get stuck at the analysis phase?