Spring Cleaning Tips for Internal Auditors

It's that time of year again. Spring is just around the corner. This year, Punxsutawney Phil did not see his shadow, thus predicting an early spring.

Getting back on track, with spring arriving early this year, it's time for some spring cleaning tips. A quick Google search provides you more articles with spring cleaning tips for your house than you'll know what to do with. If that's what you were looking for, you're in the wrong place. In this article, we're talking about cleaning up our audit processes. When was the last time you took a thorough look at your own processes and threw out things you no longer needed? That's exactly what we need to start doing as auditors.

That's How We've Always Done It

During our audits we interview audit clients and ask them why they perform certain activities. Inevitably from time to time (hopefully not often) we get an answer that goes something like this: "That's how we've always done it." In digging deeper we find that either the reason behind doing the activity (the value the task brings) is no longer clear to the person performing the task. It's still a valuable task, but it isn't clear to the performer why it's important.

Another reason behind this type of response is that the task is no longer adding value. Either the task was was added to the process "because the auditors or regulators told us to" without understanding the 'why' behind it, or it was truly valuable at one point, but something changed, and it is no longer valuable. Yet the task continues to be performed.

We hear this from our clients, and if we listen closely, we also hear it from our own audit teams. We are not immune from losing sight of why we're doing things or from doing things that no longer add value.

Clean Our Own House

It's time we turned the spotlight on ourselves and led by example. We've got a lot of experience evaluating processes in other parts of the organization and identifying duplicative or non-value added work, so let's put that experience to work in our own house, so to speak. Let's evaluate our own processes to identify and eliminate duplicative activities or things that just don't add value anymore. To do this, we need to make sure we understand the "why" behind our activities. Why do we do this or that? Why do we do it that way?

Norman Marks recently shared a video where he addresses this exact point. He challenges what he calls "auditing from memory", which he describes as auditing the way we have always done it. He encourages auditors to audit themselves much in the same way that we audit our clients, by questioning why we do what we do, and why we do it the way that we do it. He gives us some great questions to ask ourselves:

"Why are we doing this?"
"Where is the value of what we're doing?"
"What can we do better?"
"What can we stop doing?"
https://youtu.be/IH19liswj8U?si=lB6yx0nBqTkqYvaE

Norman encourages us as auditors to question everything we're doing and determine whether the things we're doing should be prioritized. This is applicable both to the scope of our audits, as well as the tactical tasks we perform within the audit process itself (documenting certain things, holding meetings, etc.).

Cleaning up the Scope of an Audit

In his video, Norman Marks brings up a great point that if we fail to challenge the scope of our audits, we could be failing to provide assurance and advice on what's most important to the organization. We could be investing our time, and our clients' time, in something that doesn't add as much value and missing the opportunity to provide assurance and advice on things that actually pose a risk to the success of our organization.

In Beyond Agile Auditing, you'll find some questions to help you do this during an audit, including:

• "What has to go right for the organization to be successful?"
• "What value would the organization get from knowing whether or not this controls is effective?"
• "What's the worst thing that would happen if this control was not effective, and could that affect the organization's ability to achieve its objectives?"

Cleaning up the Audit Process

Robert Berry - host of the Audit Bites podcast, audit trainer, and keynote speaker - wrote a blog post titled "Bad Audit Processes are Delaying Your Audit Projects". In the article, Robert emphasizes the importance of eliminating waste in our own processes as auditors so we can focus on doing what really matters. He also says "Audit departments must ensure that their audit processes are well-designed and efficient to ensure the best outcomes for the auditor and the organization." I couldn't agree with that more. Robert hit the nail on the head with that.

So we know we need to clean our own house, but where do we even start? If you're like me, I can get easily overwhelmed with a big task, like cleaning my entire house (now back to the original idiom of cleaning a literal house in the spring). The way I get past that overwhelm and actually start making progress when cleaning an entire house works in this not-so-literal instance (cleaning up our audit processes) as well. Start small. Identify specific desired outcomes of your cleaning, and focus on one at a time. Let's say for example, you want to comply with the Institute of Internal Auditors' (IIA's) new Global Audit Standards and you want to automate some of your repetitive and manual tasks. Great! Start with one of those outcomes and finish the review using that lens before moving to the next desired outcome/lens.

Speaking of the new Global Audit Standards, this is a great trigger point for cleaning up our audit processes. Many of us are going through the process of reviewing our internal audit policies, procedures, and methodology to determine the extent to which we they align with the Global Audit Standards, recently published by the IIA. Our first thought when going through this review is likely to make sure we aren't missing anything. That's a great starting point. We should also review with the the lens of spring cleaning. Said another way, once we determine whether we are missing anything, we should then start asking ourselves what we should remove from our policies, procedures, and methodology. Most policy reviews (regardless of whether they're audit policies or other organizational policies) tend to be additive in nature. This is one potential root cause of performing tasks without knowing the value behind the tasks or performing tasks that add no value.

Another trigger point for challenging whether we need to continue to perform a task, or whether we should continue to perform the task the same way we have been, is when we look to automation. Just because we can automate something doesn't mean we should. When we turn to automation as the answer, sometimes it's because we really don't want to have to keep doing that manual task. The first question we should be asking ourselves is whether we still need to do that task. If the answer is yes, then we can start exploring whether it's a good candidate for automation. But if we automate tasks that don't add value, we're still investing time to build and maintain the automation of something that doesn't add value. Not a good return on investment.

When was the last time you felt like you were just going through the motions with your own work as an auditor? Whenever you find yourself just going through the motions, that's a great trigger as well. These are just a few examples of potential trigger points for starting a "spring cleaning" of your audit processes. What others would you suggest? Post below in the comments.

Helping Your Neighbors Clean House

I would be remiss if I passed up the opportunity to encourage you to continue to help your clients clean up their processes while you're working with them. That's part of our value proposition of auditors - to help improve our organization's efficiency. We can do this by identifying waste in processes throughout our organization and highlighting opportunities for greater efficiency.

Again, Beyond Agile Auditing comes to the rescue with some questions you can ask your clients (and for my audit clients reading this, you can ask yourself and your team these questions too - you don't have to wait for internal audit to arrive):

"What prompted you to do this control in this fashion?"
"If you had a magic wand and could do your work differently to accomplish the same goal, what would you do or how would you do it?"

Identifying and reducing waste is a win for our clients as well because it reduces their workload, enabling them to focus on tasks that truly matter to the organization's success.

Conclusion

We don't have to wait until the first day of spring on March 19th to start eliminating waste in our audit processes. We should start today. The longer we wait to clean house, the worse the mess will be; the more we'll pile on to the existing waste. This takes courage, which is actually one of the requirements of Standard 1.1 in the Global Audit Standards. But we're in this profession for a reason, right? It's time we use our super powers to improve our own processes too.

Happy Auditing!

Views or opinions expressed here are solely my own and do not express the views or opinions of my employer.