Home > Risk > Perhaps the greatest and least practiced skill for internal auditors

Perhaps the greatest and least practiced skill for internal auditors

Whenever I see papers or presentations by consultants on the evolution of internal auditing, usually by adopting new technologies, I am at once amused and frustrated.

What these papers ignore is that so much more can be achieved by ensuring internal auditors perform the basics well.

For example, in my experience few internal audit departments focus on the more significant risks and stop auditing issues that would never have a serious effect on enterprise objectives.

You see this when audit thought leaders and practitioners talk about agile internal auditing, where they break down a lengthy audit (perhaps multiple man-months in length) into sprints. They prioritize the sprints, auditing the more significant areas first and the less significant ones in later sprints.

The problem is that those later sprints involve auditing issues that wouldn’t rise to the high-risk level on their own.

The lengthy audit should be cut down dramatically so that it only includes in its scope those issues of significance to the success of the enterprise as a whole.

Another example is the need to sit down and have a constructive discussion with operating management when potential issues surface. The first priority should be to agree on the facts and whether there is a problem. Once that is achieved and we can agree on the significance of the problem, then we need to focus on what needs to be done (if anything). Sometimes, the risk is one that should be taken!

Auditors should stop prioritizing reporting issues and instead prioritize helping the organization succeed!

Before adopting new tools, lets optimize the ones we already have.

Let’s optimize out ability to LISTEN!

I have admired Tom Peters for decades. He challenges us with provocative statements and ideas, most of which are fundamentally accurate. I gave a copy of his book, The Pursuit of WoW!, to each of my direct reports at Tosco.

As an aside, I adopted his principles in designing a WoW! Audit Department:

WoW audit department

But let’s get back to listening, perhaps the greatest and least practiced skill.

We need to listen to each other. The CAE needs to listen to management and the board, but especially to his or her team! I don’t see that as a strength of many CAEs.

Individual internal auditors need to listen to everybody as well, especially to those they are auditing – from the department head to the most junior employee or contractor. In fact, find a way to listen to suppliers, customers, and others in the extended enterprise.

I advise everybody not to “go and talk to people”. Instead, “go and listen”. If you are talking more than 40% of the time, you are not listening enough.

Active listening, paying attention, is a rare and very hard skill to learn.

I have exchanged messages on Twitter with Tom (we follow each other). When he wrote about Managing by Walking Around, I persuaded him that we should be Managing by Listening Around.

Here is a recent short (3:37 minutes) video you should listen to, The Little Big Things: One More Way to Pursue Excellence.

I welcome your thoughts.

  1. August 29, 2022 at 11:02 AM

    Well, who could possibly argue with your post? It all seems so obvious to me. Ask simple, open-ended questions, then shut up and listen carefully to what’s being said … and not said. It’s the most fundamental skill for an auditor. Thanks for your post.

  2. djallc
    August 29, 2022 at 12:01 PM

    Technology changes, but what determines success of internal auditors does not. Of course we need to leverage the best new technology (because it helps us, not because it is a shiny new bauble), but you rightly point out that the basics (understanding risk, relationships, communication, unrelenting process improvement, right people, etc.) are often the critical elements not being addressed.

    • Norman Marks
      August 29, 2022 at 1:20 PM

      Doug, you are nearly old enough to remember when there was a call for internal auditors to have calculators instead of slide rules, then computers of their own! Nothing new about the idea of leveraging tech.

      • djallc
        August 29, 2022 at 2:27 PM

        Nearly. I got my first calculator as a senior in high school. Before then – a slide rule. I also remember when I first had access to a copy machine, fax machine, a PC (with VisiCalc), a car phone… In all cases, we looked to see how to best use and implement. None of them radically changed the fundamentals. They just made tasks easier and quicker.

  3. Debashis Gupta
    August 29, 2022 at 9:59 PM

    Norman, this hits the nail on the head! It’s frustrating to see people in a position to do something focus on the ‘next bright shiny thing’, whether it be Analytics AI or Agile, without ensuring first that the basic fundamentals are taken care of. Does IA have sufficient resources, and of the right kind (both as to range of disciplines/domains and mindframe, including listening skills)? Does IA have the mandate to look into the really strategic aspects of business (rather than being bogged down in routine low-risk areas)? Does IA have the ear of management (the proverbial seat at the table)? Maybe not, any of this, but some still persist in treating tools as objectives, and then are genuinely surprised when such IA efforts don’t move the needle! Hope sometime in near future those who really care for IA get their priorities right.

  4. Joseph Kassapis
    August 30, 2022 at 2:39 AM

    Another terrific post. Like all your posts conceptually/theoretically sound but so practical/applied/empirical too.

    Absolutely right about technology tools/”solutions” and their place in the IAA shop- just tools, with potential good uses and risks, and a starting COST that needs to be justified/recovered and so often is not. If all the others are there, the skills, in the tool users, we can talk about IT “solutions” mattering …

  1. August 29, 2022 at 11:03 AM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: