So there is always a balance in audit. A balance between summary and detail. Evidence and efficiency. Cost and value. As a CAE I feel this balancing act most acutely when deciding where to pitch a report. A report should try to tell the broadly ‘right’ story (I don’t believe in absolute right and wrong, only relative versions). Yet within this broadly right story, there are a set of messages, the tone of messages, and how tough the message is and how it might prompt or prevent change in your client (the ultimate point of audit).
There is a balance then between being ‘tough’ and making a report ‘crunchy’ enough to deliver the message forcefully enough to get noticed and create change; and the need to be ‘vanilla’ enough to deliver the message in a way that will be heard, will be respected, will be engaged with, and will not appear critical. The vanilla crunch balance is one that I wrestle with.
I have to be honest, it’s not always one that I get right. Sometimes when I think something is fairly obvious and no one could possibly disagree or challenge the narrative, the report lands with a hard crunch. Other times when I think the message is quite complex, or a difficult context for change and improvement of controls is needed, I find that I pitch the report too softly and it does not prompt the debate and discussion it needs to.
So what factors do I consider when deciding on the vanilla crunch. Well being an ‘internal’ internal auditor helps. I am cognisant of the current management and organisational narratives, pre-occupations, cultural norms and totems. These are essential elements of ‘soft knowledge’ to be able to decide whether a message is one that will be understood, individually, collectively and organisationally. I will also try out messages with the top of the organisation. Socialise some findings very early on to find out whether there is a strong need to course correct or change my strategy. My audit team has a reports ‘rating panel’ consisting of the senior management team. This provides a logic check against my individual perception, brings to bear our full internal audit department knowledge of the organisation, and ensures that reports are consistent irrespective of the drafting and reviewing team.
I do find that the ability to understand and connect to top organisational politics is one that is often limited to the CAE. I am not sure why. Perhaps it is because top level peer to peer conversations only occur with the CAE. If a CAE is any good, they should be treated as a helpful sounding board for senior officers of an organisation in any case. So I encourage my senior auditors and audit team to engage in organisation-wide conversations and client conversations. These are essential so that, when you are writing your assurance report or presentation or message in whatever form, that you are considering how the audience will react.
I would caution about being too client-oriented. Some of the best reports in terms of final outcomes and change have come from the most challenging ‘crunchy’ reporting. Sometimes an audit team, and CAE must tough it out to get a sensible position. Don’t forget, the CAE and the internal audit function are the only points of real organisational accountability and change and are uniquely placed being both independent but internal to deliver vanilla crunch. For regulation is a blunt and tough tool. Yes it can stop the worst excesses or organisations and risk, but as the dialogue is normally played out ultimately in public, there is an adversarial and closed nature to the process. It is not a conversation, more crunch and no vanilla.
So if we reflect on our personal experiences, the most significant change has come from someone we trust telling us difficult messages. Our best friend, a family member, a trusted partner. Why? I think because there is an openness to really listening that is not open to those less trusted.
So how do you deliver optimal vanilla crunch? I think it is not, as so many auditors and audit reports try, to wrap up bad news in sugary coatings or cotton wool. Nor is it necessarily about balancing the report with ‘well on one side this, and the other that’. These approaches merely obfuscate and confuse the storyline.
It is about deciding, before putting pen to paper, fingers to keyboard, or slides to projector, what the actual storyline is and then telling it in an authentic and straightforward way in language and cultural totems the client organisation will understand. You really do need to be internal to an organisation to do this effectively.
I find the more straightforward, logical and most importantly authentic, a narrative is, the more crunch can be delivered whilst maintaining enough perception of vanilla to make it be adopted and engaged with by your clients.
So how do you deliver your vanilla crunch?