So I have a mentor. For any CAE out there I would suggest you do so too. I would suggest, like mine, they are excellent, experienced, and understand the area of audit and business you are working in.
In my recent chat to my mentor they provoked, using their objective viewpoint, my thinking about what I thought internal audit should do theoretically compared to practice. In other words they were able to see that the intellectual purity of audit has to be tempered by organisational reality.
Interfering with the intellectual purity of audit is something I am always uncomfortable about. It always feels to me that organisations should do the right thing on a principled basis, irrespective of organisational politics etc. This is something I have had professionally drilled into me in my big four professional services firm audit training. For the task there was always to get the ‘right’ answer. Right was always defined in terms of accounting and auditing standards (all of which provide a basis in law of what must and should happen).
Internal audit is, however, a much more complex activity and proposition. As I, and my career, have evolved and I became an internal auditor (which for the record is completely different role from external (financial statements) audit), I realised that there is no right and wrong. Well at least I took a realist ontological and epistemological position that there is a macro right and wrong, but that the right can have a number of legitimate interpretations.
But the leap my mentor helped me to take was to recognise that internal audit needs to take account of the organisation, its culture, its capacity and its ability to deliver what needs to happen. Internal audit’s role is to be ethnographic (a social science and anthropological research term that means studying a group of humans and their behaviours as part of the group, whilst remaining objective and independent of it as a researcher).
So internal audit is about: divining what needs to happen (the right / wrong answer); divining what the organisation can do possibly do; divining what the organisation is willing to do; and then forming a set of suggestions that work with this. In other words, internal audit becomes a problem solver using its ethnographic position.
So the CAE and senior management team whose roles do seem a little esoteric and disconnected from day to day audits, actually have a complex social and intellectual task. This is of working with the organisation and assessing not just what the audit work is telling them, but also of how to manage its delivery in the organisation to effect positive change.
So if an auditor is an ethnographer, where should internal audit pitch its findings? Is it something that professionally should be ‘pitched’. i.e. is it the role of internal audit to decide how far to challenge an organisation? Our institute has little formal advice on this matter. In fact this is, I think, the biggest challenge I have found as an CAE. If a CAE challenges too much the organisation pushes back, too little and the audit team feels their findings are not being pushed enough by the CAE and the CAE loses credibility with his / her team. Also too little challenge risks not pushing an organisation beyonds its comfort zone to make it grow and get better.
So there it is, the biggest real challenge a CAE faces. Balancing challenge. Yes a CAE has to develop a good audit methodology. Yes they have to develop an audit team that picks out the findings. The core challenge is always to balance challenge and deliver the messages from internal audit work in a way that an organisation can digest. For the first line of criticism when something goes wrong always seems to be ‘where was audit’ (rather strange since audit is the third line of defence). I think too few management colleagues appreciate that a CAE has to be ‘right’, so they are not open to criticism if things go wrong, yet deliver a message in a way that promotes organisational change and development.
For ultimately a CAE is not meant, in role terms, to be popular. Too many people confuse this with professional respect, i.e. ‘I don’t like or agree with the CAE, therefore they can’t be performing well’. For me, a good CAE, is not necessarily popular. They say the unsayable, point out the difficult, address the ignored, champion the marginalised, push the counterfactual.
I am lucky that I have generally worked with senior management teams that get the real value of audit. They value and engage with its challenge and support the different perspective brought by internal audit. It takes a good dose of internal audit objectivity for management teams to support and endorse this approach.
So how far does ethnography feed into your audit approach? How do you pitch your findings?