Jurassic World – where would internal audit have been?
I have imagined where internal audit fitted into a number of historical situations, for example in the building of the Boeing 747 and in the White Star Line when the Titanic sunk, but I thought it might be helpful to consider where internal audit might have been in films.
So I went to see the latest film in the dinosaur franchise, Jurassic World. I was not the only one by the reports of the opening weekend’s box office figures. Can I just say, it was fantastic, it totally captured the quality of the original. The film, for those who have not seen it, does not have a storyline much different from the original. You know: dinosaur theme park set up or rebuilt, dinosaurs all amazing, dinosaurs escape and wreak havoc. Yet these parks are run by commercial companies (and eccentric billionaires) so have a real-world feel about them. In this film much is made of the park’s need for customer satisfaction, a need for investors and star attractions to make it happen. In fact it is this commercial imperative that appears to seed the park’s self-destruction. So where would internal audit be in this melee of activity?
Let’s consider the facts as set out in the film. Well, we know the park is run by a company and a US company at that, ‘we’ll be in chapter 11 by tomorrow morning’ is a line from the film. So Jurassic World Inc. exists. Although funded by an eccentric billionaire, it seems unlikely that these resources would rescue the park following the expected carnage (I won’t say why, as it will be a spoiler, but needless to say accessing this wealth will be challenging at the end of the film). We know that the company board has some sense of control and ethics. When discussing the genetics work of the company, it appears the board want some ethical stance. We also know that the company has some form of risk management system. The character played by Chris Pratt appears to be some ranger who has a risk management view over the containment risks for dinosaurs. Similarly the park is well controlled with cameras, sensors, trackers, tagged dinosaurs and containment arrangements that are well considered and tested. There is also a unit of forces, the ACU (Asset Containment Unit) whose role it is to contain the ‘assets’ (dinosaurs).
So how does it go wrong? Well, the park needs a star attraction. The genetics guys take this is a clue to go off piste and create a super tyrannosaurus rex. I won’t go in to detail, but needless to say they create something the park cannot control.
So where is internal audit in all of this? Would a good internal audit function have prevented this disaster? Well, needless to say an internal auditor is not shown in the film (why not? I hear you cry!). Well first there is the fact that, being a US company, the internal auditors will have spent quite a lot of time auditing financial risk and financial (SOX) controls. None of this work would have impacted this risk.
Second the internal audit function should have audited the risk management system. The company clearly has a system. This appears to be relatively strong. They may well have audited the management information system. If I’d looked at the MI the company had over operations, including customer satisfaction etc. I would have thought it reasonable.
I would have sought to audit park operations. I know many auditors never get to the core business of their clients, but this would seem to make sense. Had we audited this, we would have found well thought through manuals, well thought-out systems. We see the orderly evacuation of the park during the film, warnings to customers and even the most junior staff seem to have access to operations manuals. So I would have probably given it a clear light.
So what about dangerous dinosaurs? Would internal audit have audited these systems? Well possibly. Under my watch; yes. Most internal audit functions, I doubt it. Why? Well most audit functions don’t have permission to wonder into the front end of the business. The usual arguments – you’re not qualified, you don’t understand, it’s specialist etc. Well internal auditors are not ‘qualified’ in anything. They are qualified to internally audit, that is their qualification.
So had I audited dinosaur risk systems, would I have given it a clear light? Possibly. The walls and fences looked reasonable, the gates strong, the control room impressive. I may have picked the real risk, the new super dinosaur, the new super secret experimental dinosaur. I would have sought a risk assessment of all species and data about incidents. At this stage the Jurassic franchise has quite a lot of data to draw on.
The system that I can guarantee most internal auditors would not have picked, was the genetics business. This would have regarded as unauditable. Yet the park’s ethical, moral, and business risk is intimately tied up in this part of the business. Yet it would not have featured on the top of most audit plans. It appears from the film as if this is the bit of the business that had gone wrong for the longest period of time. I wonder if this had been audited? If it had, then the real risks of inter species change, the lack of understanding about what this meant and the lack of behavioural understanding of the resulting animals must be high.
I would say I would have audited it because I have done it before. I have looked into the regulatory controls of use of human material for research in a research client. It’s interesting and hugely challenging work. Would this audit have prevented the disaster? Possibly not as the head of the genetics department was clearly working outside of authority, but it may have limited their scope for going out of control. A good auditor would not have just picked up the systems though, they would have picked up the culture. I suspect in the period prior to the disaster a whistleblower may have raised concerns (in my view scientists are an ethical bunch of people), so the CAE would have had some data to support a challenge needed in this area.
So where was internal audit in Jurassic World? Nowhere. And I’m still waiting for a blockbuster film about internal audit. I do think a good internal audit function would have avoided a dinosaur disaster; but it may not have made for such a good film!