Is audit cultural? Is there a sense in which we, as auditors, both need to understand the cultures we’re auditing and also accept and understand that our auditing viewpoint is also culturally conceived? I’ve written about internal audit culture before: https://chiefauditexecutive.wordpress.com/2012/06/10/culture-club/
Taking internal audit culture first. I think that there are five elements of culture that are relevant. First the culture that is specific to internal audit and its training. A colleague of mine described internal audit as a mindset. A very specific mindset. They described being in a restaurant and instead of just accepting the meal and enjoying the place, they were ‘auditing’ the business – this could be better, this control is weak, this process is wrong etc. So I do think we as internal auditors do have a common culture.
I would like to the see internal auditing as a positive culture. One that looks for improvement, is challenging of the status quo, is thinking things can be better and we can come up with reasonable suggestions for improvement. There are downsides, however, perhaps an over attention to detail; a need to get things best, rather than just better; an overly strong focus on control rather than risk management; and a rather naive belief that people want to get things better and do the right thing (which is not always the case).
Then there is the second element. Do we as internal auditors have cultural elements to our approach borne of our geography or our business sector, or our own department? I suspect that we do. For example the British approach to internal audit appears to me to be more principles based than our US colleagues (yes I appreciate that is a huge generalisation) but it generally holds true in my experience. Also the UK approach is more about risk mitigation (holding risk related to risk appetite) rather than controls based as in the US. It is inconceivable, in my view, that a UK Government would ever introduce Sarbanes Oxley or anything so draconian and unreflexive in its approach.
Then there is the third element – do we need to understand the cultures we’re auditing? Does it matter? I have argued in my previous blog post that we as internal auditors do (see https://chiefauditexecutive.wordpress.com/2013/09/21/do-we-need-to-understand-the-business/). Culture affects how organisations see the world and understand it. It allows organisations to not ‘see’ risks and problems, or ignore problems over a long period of time – the international banking community prior to 2008 perhaps? It also affects how organisations tackle problems. Some put in lots of guidance and controls, others take a more sanguine approach to risk management, still others do very little.
The fourth element is our own version of internal audit and the models we use to underpin our work. For example, I was asked to think more about the three lines of defence model in the last few weeks. I am not uncritical of it (see https://chiefauditexecutive.wordpress.com/2013/07/07/attacking-the-three-lines-of-defence-model/). In thinking about it, however, it struck me that some people saw it as a perfect and un-challengable objective truth. It struck me that in some geographies and organisations the three lines of defence is becoming almost religious and totemic in its use and application. For the record I think it has some uses but is a long way from an objective description of the objective truth. Yet irrespective of the model, it does fundamentally affect how organisations are advised and tackle risk management.
Another element is our internal audit methodologies and processes . As CAEs we impose our view and model of the internal audit world on our departments. We set and define the methodology. These methodologies do contain some element of our cultures, viewpoints of the world and perceptions. Thus, analogous to research, our world view, both epistemologically and ontologically, matters, at a fundamental level, to our work (see https://chiefauditexecutive.wordpress.com/2013/01/12/audit-epiphany/). Are we really able to exercise strong objectivity over our own perceptions of the world? Can we really know what it is that shapes our views, fundamentally, without us even recognising it? For like research, it is not that we are either right or wrong in our assumptions (perhaps right and wrong do not exist, merely different viewpoints), it is that we should try to be aware of these assumptions and acknowledge and be aware and critical of our work based upon them.
For as humans we naturally summarise, simplify and generalise in order to help us make sense of a complex, difficult world. We do this in business through models, through mathematics in formulae and social interactions through prejudice and classification. I attended a great training session the other week asking about ‘unconscious biases’, the discrimination we all apply, unthinkingly, in our day-to-day interactions at work and home. The key point is to work on awareness, how we can reduce our unknown prejudices. If you like reduce the unknown and unconscious element of our personal ‘johari windows’. The trick is to get the balance between having a useful process to help us understand the world and being over-reliant on a single or limited view, that distorts, unhelpfully, the world.
So, what does this tell me as a CAE? I need to challenge myself more, get challenged more (by my team and management), and really think, when forming my professional opinions, is there a cultural distortion here?