Internal Auditors : Beware of the "Risk Management" Syndrome !

When I am asked  what brought Arthur Andersen down ( I am a former AA partner) , I always say : "The Andersen Consulting " Syndrome!The start of the end of the firm began when the AA leadership decided that they want to be consultants rather than traditional auditors!This happened as a  result of the divorce with Andersen Consulting. The idea was simple: we have created Andersen Consulting and we are capable of creating another consulting arm ! The catastrophic result of this policy was to convert the partners to "salesmen" and for the firm to lose its professional compass and to head for disaster !

With that in mind and with the ever increasing importance of risk management , some internal auditors may get too excited and try to act as risk managers! This could happen because ,among other things :

  - they think they can do a better job in managing risks
  - filling a vacuum in the risk management process ,
  - asked by management to do so
  - lack of understanding of the internal audit boundaries when it comes to risk management

Although this is not happening at an alarming scale, I am just trying to give an early warning , based on my observation of few cases, that some internal auditors may fall into this trap!

As internal auditors, our job is to provide management with assurance regarding the effectiveness and efficiency of its risk management process and not to duplicate or replace it. While this is obvious to the vast majority of internal auditors ,this post is directed at the very few who suffer from the risk management syndrome !

How "Continuous " Mindset Helped in shoveling My Driveway ?

I have just completed "another round" of shoveling my driveway and maintaining its reputation as the " cleanest " driveway in the neighborhood during snow seasons !

The key to this reputation is in the word " continuous " which I have learned from applying continuous" auditing " and continuous "monitoring " of risks in my professional life ! I learned to always be on top of things and never leave a room to surprises and accumulation of problems /risks. Applying this concept to my household was a blessing (despite the wife's complains ) !

Continuous " anything" requires commitment ,determination and finding the time for it . Not every body can do that ,but at least they should put the effort .

Another lesson that I learned from my professional life is that " outsourcing" does not always work . I used to "outsource" the shovelling to snow removal companies over the years ,and found myself unsatisfied with their services and ended up cleaning after them ,that is if they show up when you need them ! If you can do the job efficiently ,don't outsource ! And this is an advice from someone who makes his living from outsourcing !

 

CAE: Do you Have A Succession Plan?

As a CAE, you know that one day you will leave your position to either " pursue other interests", retire or be absent due to any other reason! When you audited the HR function in your organization, you have most probably included the organization's succession planning as part of that audit. If there was no succession plan, you most probably have recommended one. Now, let's see if you practice what you preach! Do you have a succession plan for your  Internal Audit Activity? If your answer is yes, you may stop reading this post! If it is no, keep reading!

Be proactive and initiate the process!

If there is no succession plan for your IA activity, be proactive and start the process yourself. This is how you may start:

• Discuss your proposal to adopt succession planning with your stakeholders (audit committee, CEO, HR,..etc ) and seek their support and commitment. Once this is done, talk to your staff and explain the importance of having a succession plan.
• Identify which positions need to be included in the plan (CAE, Director, Manager ..etc)
• Identify the required competencies.
• Assess internal candidates (talents) and determine if outside candidates need to be recruited.
• Select and train the successors and keep them engaged at all times!
• I also like the idea of putting the successors through what is called "stress tests" to ensure their preparedness.
• Monitor and update the plan on a timely basis.

When do you start the process?

The short answer is now! Whether you are planning to vacate your position now or after 10 years, the time to start the process is now. Preparing a successful successor takes time. Some reports suggest that it may take up to five years. Moreover, you need to be ready for any emergencies or disruptions that may prevent you and/or key personnel from performing assigned duties.

What's in it for you?

We all know the benefits of succession planning to the organization, but why would the CAE have a personal interest in it? Simply put, it is his/her chance to protect his/her legacy and have a say on who gets to continue and protect his/her hard work.

Start drafting your succession plan!

These are my thoughts, please share yours.

Internal Audit is not A Desk Job, Keep Moving!

In today's IIA webinar "An Outlook of the Internal Audit Landscape for the Year Ahead ", the following slide was presented:

While all the above mentioned resolutions are important, the one relating to " Build Deeper Relationships" is , in my opinion, of extra importance and could be the most difficult .

Yesterday, a report in Canadian television stations discussed the negative health effects of desk jobs and suggested that employees should move and stand while doing their jobs! I am calling on internal auditors to keep moving ,not only for health reasons ,but for the health of their relationships.

Building deeper relationships can't be achieved through emails, memos and telephone calls alone,it requires  personal interaction and face to face meetings. I fully understand the time constraints ,but make sure your audit plan includes time for personal interactions and treat it as an investment in the achievement of the internal audit objectives.

A successful CAE is that who makes it his  mission to meet with his "customers" at every possible opportunity.This does not have to be an official meeting at all times ,but the types of " watercooler talks",  I am not referring to gossip here, but to small talks that help build professional relationships . This is not limited to the CAE ,but applies to all levels of auditors who should attempt to do as much work at the "customers" offices as possible and practical.

Those who follow my writings have probably heard about my 4 P's in conducting audits:

Professionalism
Patience
Persistence
Personalization

Personalization refers to the fact that people are different and internal auditors need to develop a personalized plan to approach and deal with them. During my long audit career ( external and internal) ,I used to invest few minutes collecting information about the people I plan to meet with to discuss planned audits. I looked for what their interests are and I used it as an opining to our meetings and an ice breaker. The first thing I do when I enter an office is to scan its contents for family pictures and other contents that may indicate a hobby or an interest area. Even the most difficult "customer" would love to talk about his/her kids!
This approach never failed me in the 35+ years of my professional career .You need to be careful though not to engage in controversial subjects such as politics and religion!

You can't get to know people's expectations without knowing them (the people) first!

Your new year resolution theme should be " leave your office and mingle with your customers!

These are my thoughts ,please share yours!

Internal Auditors: Don't let Technology Turns you into Robots!

Those who follow my posts know that I always encourage internal auditors to become tech-savvy. This is because I strongly believe that IT knowledge is a "must-have" skill for internal auditors to survive, add value, and be relevant.

In this post, however, I want to warn you of a possible side effect: becoming robots! And by this, I mean losing your human touch!

Technology should make our lives and jobs much easier, but it should not control us and dictate our behavior.  More than ever before, we are dependent on electronic communication(if not addicted to) with others for social and business purposes. Emails, text messages, WhatsApp, Facebook, and other social media applications are becoming an integral part of our lives, and they are gradually replacing face-to-face interactions and phone calls.

Internal auditors need to have "soft skills," which include people management and communication skills. These can not be acquired and practiced through electronic communications alone.

The basic advice here is :

• Don't forget that you are a "human" first and a "user" of technology second.
• Don't let technology make decisions for you. Use it to make better decisions for yourself. 
• Don't let technology control you. Be in control.
• Don't "hide" behind the technology. Talk to your audit customers in person and by phone whenever possible.
• Don't put in writing what you can't tell your audit customers in person.
• Your audit customers are humans, and they expect you to treat them as such.

When was the last time you paid an audit customer a courtesy visit or picked up the phone to discuss an issue with him/her?

And finally, if you have to become a robot, be one with a heart!

These are my thoughts, please share yours!

Picture source: http://www.qwertechpost.com through Google search

2015 Internal Audit Horoscope !

 Internal Audit, here is your 2015 horoscope  :

• January : It's normal to question why you are still in internal audit ,there is a more rewarding career in your future !
• February :You are still confused about the difference between risk appetite and risk tolerance. Simply put, the former is the amount of food you want to eat when you are hungry (or fasting) , the latter is the maximum amount of food you can eat before you end up in the emergency room ! *
• March : Your CIA certificate is valuable , but consider obtaining a CPA and/or a CISA  certificates if you consider a career change in the future .
• April : keep pursing your independence ,but keep in mind that the CEO will always be the boss !
• May :You still don't know the difference between LinkedIn and Facebook. Keep working on your IT and social media  skills !
• June: Cyber risk is real. Your spouse will always try to access your data and browsing history.
• July: Quality assessment is not an intellectual luxury. Revisit IIA standards 1300 -1322.
• August : Keep dreaming ,one day you may have a seat at the table !
• September :Integrity and objectivity are your bread and butter ,don't leave home without them.
•  October : Being courageous is not a risk, but an opportunity to another career !
•  November: Posting 100 tweets and Facebook  status updates daily does not improve your communication skills .
• December: Seriously, why did you become an internal auditor ?

The above is my attempt to be humorous ! I hope I have not offended anyone .If I did, please accept my  sincere apology.

 

Although I am not an internal auditor per se, I remain a strong internal audit advocate !

 

Wishing you all a happy ,healthy and prosperous new year .

*This is not a technical discussion, but rather an over simplification for the purposes of this  humorous presentation !

Internal Audit : Do you Apply " Self Root Cause Analysis" When you Fail ?

This post was insipid by a recent post by Norman Marks entitled " Why Internal Audit Fails at Many Organizations " and a training document presented by Larry D. Hubbard  entitled "Reporting Audit Issues and Root Cause Analysis " . I thought of combining the two subjects in this post !

First, we know that internal audit fails from time to time ,
Second, we know that IIA standard 2320 stipulates that Internal Audit must base conclusions and engagement results on appropriate analysis and valuations .Practice Advisory 2320 - 2 deals with root cause analysis for internal auditors .

Internal auditors are encouraged to perform root cause analysis to provide a meaning to their audit findings and recommendations.

Before I get to my point, here is a quick reminder:

What is Root Cause Analysis ?

Think Reliability website defines it as "  an approach for identifying the underlying causes of why an incident occurred so that the most effective solutions can be identified and implemented. It's typically used when something goes badly, but can also be used when something goes well."

Root Cause Analysis Techniques :

Some of the widely used techniques are :

• The famous five why's analysis .Remember by the fifth why, you should be able to identify the root cause !
• The Pareto analysis ( also known as the 80/20 rule)
• Fishbone diagram
• Fault Tree Analysis
• Flowcharting of process flow, system flow and data flow .

The following document provides comparison of common root cause analysis tools and techniques.

Now ,when  internal audit fails , do internal auditors take a moment to perform a root cause analysis of their own failure ? I honestly ,doubt that ! It is easy to blame the failure on the lack of audit committee oversight and  lack of management support ( and these are very legitimate reasons) ,but the key to identify the root cause of the failure should start with soul searching and hard look at the internal audit activity itself !

Let's get into a hypothetical  scenario and assume that your internal audit activity has failed and you decide to perform a root cause analysis using the 5 why's .What will your why's be ?

Please participate in this mental exercise !