Tags
assurance processes, Internal Audit, internal audit function, internal auditor, internal auditors, leadership, management frameworks
I am an avid consumer of news. The global news is depressing and sad at present, nevertheless I think an understanding of the currencies and flows of global events is helpful context for life. So I engage, whilst at the gym, and with a reputable source, the BBC.
This story struck me in particular: https://www.bbc.com/news/world-asia-68738694 It’s a post event analysis of why the recent Taiwan earthquake did not cause so much damage, in contrast to the devastating earthquake in Turkiye or even in the last Taiwanese earthquake of 25 years ago. The article patiently and consistently narrates how a serious of coherent actions in relation to planning and building codes, backed up with consistent oversight and enforcement, also training of the population, building of sensors and establishing disaster response protcols mitgated the impact of this quake.
In a world where creating deep and lasting change seems hopeless and impossible, it is a good, and practical lesson in how this can, and should, be done. I consider the same is true within any signicantly complex or sized organisation. There is a need to take time to analyse the problem, set out some principles within which action can be organised, then develop a plan of consistent and coherent actions, deployed over time, to enable success. This for me is what a control framework is.
The internal audit profession, where it sees controls in either process, legal, or transactional terms, is only engaging with half of the point. Sure a rules-based approach is possible. McDonald’s, most airlines, miltary organisations, show it can be done. Most organisations, however, lack the resources, time, capability and need to enforce such a level of command and control. Most organisations rely on a mix of rules, legal controls, processes and cultural controls. Auditors must understand the latter in particular, for culture eats all other controls for breakfast. If the centre of cultural gravity of an organisation is towards X then it is highly unlikely that anything other than either being rigid in setting, overseeing and enforcing those controls, over an extended period of time, will make any difference.
So for me, I think a control framework is a complex web of activities, actions and processes that requires consistency and application over a period of time. That is not something we, especially in an internet world of immediacy and gratification, are willing to hear. In other words, good control to achieve a difficult or complex objective is likley a marathon, not a race.
Of course, there are things that can speed up change and enhance control. Prioritisation is one – focusing on an overall goal and making it visible and clear to everyone in the organisation. Being proactive and thoughtful about the cultural aspects of control – those that enforce and those that detract from the goal at hand. Good oversight – ideally by managment themselves, but supplemented by good third line oversight. Also a strong commitment to enforce those actions, especially when the actions or overall plan of work becomes tough, for example where money is limited, or the strategic horizon for the organisation is challenging. I recall when I first worked for a professional services firm, it had a strongly traditional male-dominated and toxic culture. This did not change through rules or training or internal communication. It changed when the organisation was brave enough to sack senior staff for not being more humane, diverse and modern in their approach to work. This sent a cultural signal that no amount of all staff emails could replicate. I am glad to report that I see professional services firms now, and corporates more generally, are beacons of diversity and commitment to humane workplaces. They benefit now from ‘seeing’ the many employees they never knew before and never attracted in great numbers previously.
So what’s my point here? My point is that a control framework is marathon, not a sprint. Big change takes time and, like the amazing results in Taiwan, is well worth the effort and energy expended. So next time you are doing an audit, audit longitudinally, not just at a point in time. Let me know how you get on!