I was asked by a management colleague this week – how do you train your team to see things my team don’t? The premise behind the question was why internal audit continues to see issues and risks and propose solutions that the management team doesn’t.
Honestly I am not sure I have the answer. For me common sense is just that, common sense. I think what I train my auditors to do is think and apply common sense. So no matter what the business challenge or question – I ask auditors just to think through what would the reasonable person on the apocryphal ‘Clapham omnibus’ do. Now I know that common sense is not common and that one person’s common sense is not another. I do genuinely think that auditors’ best professional tool is just to think and ask obvious questions.
So how do I do train my auditors?
Well I think surrounding them with the other experienced and great auditors in my team helps. It is important to ensure that any audit function retains a core of knowledgeable, professional trained and experienced auditors, who know the business they are auditing.
Second I think it is important to provide constant leadership and support of professional discovery and continuing professional development. I provide a diet of masters courses, IIA qualifications, ACFE and other counter fraud qualifications. I supplement these with a diet of experiences, conferences and workshops. In addition I ensure that an underlying base of ethical training, professional behavioural expectations and high standards of propriety are expected and enforced through oversight and quality assurance of work and the processes through which that work is produced. Can I micromanage and be a perfectionist? Yes, a little, but this ensures that my auditors work to the produce the very best they can, all of the time.
Third, I train auditors to challenge the status quo. I ask and encourage them to free their mind and be inquisitive and challenging. This means I ask them to audit not only what is there, but much more importantly to audit what should be. I tell all of my auditors that their views (even when training) are valid, sensible and value adding. I say to them to feel free to challenge and to put their views across, to ask the stupid question (for the only stupid thing is not to ask the question), to feel supported to go ask, do and investigate anything reasonable thing they think important. When I trained at a big four firm I always felt there was a risk that these firms spent lots of money recruiting bright people, and then spent three years training them not to think. I do my very best not to do this. I want my auditors to feel as if there are no cages or walls oppressing them.
So why do I think my audit team picks some issues the management team does not always manage? Well I think this is primarily because internal audit is objective and independent and is set up to take a risk based approach. Most management teams get too wrapped up in issues and the here and now to take real time to analyse why they do things.
Update – I’ve taken some time to finish this blog post, as I’ve normally got an opinion or a view on the question at hand. I usually use my blog to expound and refine this view. In this case, as you read above, I was genuinely not sure of the answer.
I’ve had a damascene moment today though that made this clear to me.
The real reason why I think internal audit sees things is in that I had always assumed organisational discourse, that is the organisational ‘press lines’ that we articulate on our organisational intranets was generally recognised to be nonsense. i.e. that we all had a real understanding of how things really are: complex; messy; driven by personalities, culture, currencies of power, resources and political position. Yet it I appear to be wrong. apparently this world is not clear to others. This reality is not one that people really see. When we have what I thought were organisational ‘press lines’, lots of people in organisations actually believe them.
How can I best describe this? Well if you’ve ever seen The Matrix franchise of films, the main character, Neo, has the ability to see past the computer-generated code that constructs a false reality which he was being fed in order for the evil machines (that had taken over the world) to use his body and brain (along with the rest of the enslaved human race) as a battery. I think good auditors see enough of organisations, both in depth and width to really understand how organisations actually work. They think in terms of analysing, objectively, and as an intellectual research exercise, how the organisation works (I of course mean this of fully risk based and in-house internal audit services – not externally provided – for they never really know their clients – or compliance based auditors – for they never really challenge to any depth).
Perhaps I am lucky, or perhaps my team are, that we have these real conversations and do not buy into the computer-generated false reality of organisations. Perhaps I am lucky in that I deal mainly with the top of the organisation, those senior managers that know all too well, and have to deal with, the real reality the organisation faces. They know when their constructs and organisational press lines stretch truth or test credulity, for they construct them. Perhaps I am lucky that I can be open, honest and helpful in supporting and challenging them in both the real world and the use and deployment of those constructs.
I think great internal audit functions train their auditors to see the ‘stream of numbers’ behind organisational constructs (another Matrix reference). This means that even fairly junior members of my team are inducted into seeing the world in this way, the ‘code’.
So perhaps this is something I had not ever appreciated or understood because I had always thought it obvious, at least to me, and it did not need saying. Or perhaps I am just odd in my perspective (as one of my team called me like Sherlock from the Elementary TV series – I think it was meant as a compliment but it was hard to tell!).
As an auditor, do you see people and 20th century America or the code that the machines use to construct them?