• About

chiefauditexecutive

~ The thoughts, interests, challenges and debates of a professional chief audit executive.

chiefauditexecutive

Monthly Archives: November 2017

Star baker

13 Monday Nov 2017

Posted by chiefauditexecutive in Cake, Cake, Consultancy, Global audit, Internal Auditing, Ontological and epistemological assumptions, Positivist, Reporting, Reporting, risk based audit, Uncategorized

≈ Leave a comment

Tags

audit committee, control, Internal Audit, internal audit function, internal auditor, internal auditors

Unknown

So it’s just been The Great British Bake Off  season again. A quaint British baking competition on television. Each week one baker comes last in the judging of their baked goods and one wins; the star baker.

So what makes a star auditor or a star audit function? Well I’ve written lots of times about audit quality and also the traits of good internal audit. My recent period of work has brought me in contact with many other audit teams and their outputs. The one thing that bothers me about those that are less good, is their inability to be truly risk based.

What do I mean by that? I mean that they do not provide a risk based opinion. For me this is the entire point of internal audit. For if we cannot be risk based how can we preach it to our clients? This means forming an opinion (which many audit shops don’t, either at an annual or assignment level). It means delivering an opinion that expresses a view based upon risk and stated in risk terms. It means linking control to risk; that is good control means managing risk to within a target risk or risk appetite. It means giving an opinion that accounts for risk appetite. I’ve written loads about this, but I find myself still surrounded by auditors and audit functions that still do not do this, and many that don’t even understand it.

I presented to the UK Institute of Internal Auditors’ annual conference last month. I made these points again. I am not sure whether the points echoed agreement or echoed into an unreceptive void. I hope the former. I know from my many roles that fully risk based internal audit works. It adds value. It makes a real difference the quality of he organisations to which it is applied. It works for governance committees. Yes it is complex. It requires our two dimensional scientific positivistic models we use in our profession to grow. It moves IA up the business value chain.

We are not the poor relation to finance. We are internal organisational consultants that are the guardians of ethics, good governance and organisational achievement of objectives. Done right, risk based IA is the senior management team’s best friend.

Returning to my cake theme. Too many auditors think rough, dry, unappetising cake is fine in terms of their product. We should aim for a ‘showstoppers’, fully iced and beautiful creations that our management colleagues want more of.  Sure it takes hard work, effort and expertise. That’s what anything of value requires. This means that the thing needs not only to look good, but also needs to taste good, that is to say for an audit report it needs to be meaningful.

I genuinely think our profession is scared of risk. We as accountants, many of us, have been brought up in a world of laws and rules, right and wrong. When faced with complex and uncertain risk we struggle. For only once we let loose our fixation on rules and control defined independently of risk, we will add real value.

It is said that management science does not exist. Management has no right and wrong, just a complex set of choices. We as auditors should recognise this and be more ‘management’ in our approach. This means engaging with risk and celebrating its complexity and in most cases the lack of a right or wrong answer.

So back to baking – we as auditors need to use our CAKE (cumulative audit knowledge and experience) to make better products, more appealing products, more complex products. We need to have reporting that compares the tough choices our management colleagues make and makes some contextual sense of them. Done well these ‘showstopper’ products move an organisation forward in a way that it cannot do through any other function or governance activity. We are an essential part of any organisation’s eco system.

So when is your next showstopper bake?

Advertisements
Advertisements

Subscribe

  • Entries (RSS)
  • Comments (RSS)

Archives

  • January 2019
  • December 2017
  • November 2017
  • August 2017
  • July 2017
  • June 2017
  • April 2017
  • March 2017
  • January 2017
  • December 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • April 2016
  • February 2016
  • January 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • May 2015
  • April 2015
  • March 2015
  • February 2015
  • January 2015
  • December 2014
  • November 2014
  • October 2014
  • September 2014
  • August 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
  • August 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • October 2012
  • September 2012
  • August 2012
  • July 2012
  • June 2012
  • May 2012
  • April 2012
  • March 2012
  • February 2012
  • January 2012
  • December 2011

Categories

  • Auditing
    • Cake
    • Data audit
    • Financial reporting
    • Follow up
    • Global audit
    • Guidance
    • HR
    • Internal Auditing
      • IT audit
      • risk based audit
    • Leadership
    • Lean
    • Professional development
    • Project assurance
    • Reporting
    • Scoping
  • Cake
  • Consultancy
  • Culture
  • Effectiveness
  • Efficiency
  • Ethics
  • Fraud
  • General
    • Reporting
  • Governance
  • independence
  • issue management
  • Marketing
    • Branding
  • objectivity
  • Ontological and epistemological assumptions
    • Idealist
    • Positivist
    • Realist
  • risk management
    • Health and Safety
    • Risk Appetite
      • Health and safety risk appetite
    • Short termism
  • Scepticism
  • skepticism
  • Soft controls
  • Uncategorized

Meta

  • Register
  • Log in

Create a free website or blog at WordPress.com.

Cancel
Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy