Perhaps the greatest and least practiced skill for internal auditors
Whenever I see papers or presentations by consultants on the evolution of internal auditing, usually by adopting new technologies, I am at once amused and frustrated.
What these papers ignore is that so much more can be achieved by ensuring internal auditors perform the basics well.
For example, in my experience few internal audit departments focus on the more significant risks and stop auditing issues that would never have a serious effect on enterprise objectives.
You see this when audit thought leaders and practitioners talk about agile internal auditing, where they break down a lengthy audit (perhaps multiple man-months in length) into sprints. They prioritize the sprints, auditing the more significant areas first and the less significant ones in later sprints.
The problem is that those later sprints involve auditing issues that wouldn’t rise to the high-risk level on their own.
The lengthy audit should be cut down dramatically so that it only includes in its scope those issues of significance to the success of the enterprise as a whole.
Another example is the need to sit down and have a constructive discussion with operating management when potential issues surface. The first priority should be to agree on the facts and whether there is a problem. Once that is achieved and we can agree on the significance of the problem, then we need to focus on what needs to be done (if anything). Sometimes, the risk is one that should be taken!
Auditors should stop prioritizing reporting issues and instead prioritize helping the organization succeed!
Before adopting new tools, lets optimize the ones we already have.
Let’s optimize out ability to LISTEN!
I have admired Tom Peters for decades. He challenges us with provocative statements and ideas, most of which are fundamentally accurate. I gave a copy of his book, The Pursuit of WoW!, to each of my direct reports at Tosco.
As an aside, I adopted his principles in designing a WoW! Audit Department:
But let’s get back to listening, perhaps the greatest and least practiced skill.
We need to listen to each other. The CAE needs to listen to management and the board, but especially to his or her team! I don’t see that as a strength of many CAEs.
Individual internal auditors need to listen to everybody as well, especially to those they are auditing – from the department head to the most junior employee or contractor. In fact, find a way to listen to suppliers, customers, and others in the extended enterprise.
I advise everybody not to “go and talk to people”. Instead, “go and listen”. If you are talking more than 40% of the time, you are not listening enough.
Active listening, paying attention, is a rare and very hard skill to learn.
I have exchanged messages on Twitter with Tom (we follow each other). When he wrote about Managing by Walking Around, I persuaded him that we should be Managing by Listening Around.
Here is a recent short (3:37 minutes) video you should listen to, The Little Big Things: One More Way to Pursue Excellence.
I welcome your thoughts.
Leave a comment
Norman Marks on Governance, Risk Management, and Internal Audit 
Well, who could possibly argue with your post? It all seems so obvious to me. Ask simple, open-ended questions, then shut up and listen carefully to what’s being said … and not said. It’s the most fundamental skill for an auditor. Thanks for your post.
Technology changes, but what determines success of internal auditors does not. Of course we need to leverage the best new technology (because it helps us, not because it is a shiny new bauble), but you rightly point out that the basics (understanding risk, relationships, communication, unrelenting process improvement, right people, etc.) are often the critical elements not being addressed.
Doug, you are nearly old enough to remember when there was a call for internal auditors to have calculators instead of slide rules, then computers of their own! Nothing new about the idea of leveraging tech.
Nearly. I got my first calculator as a senior in high school. Before then – a slide rule. I also remember when I first had access to a copy machine, fax machine, a PC (with VisiCalc), a car phone… In all cases, we looked to see how to best use and implement. None of them radically changed the fundamentals. They just made tasks easier and quicker.
Norman, this hits the nail on the head! It’s frustrating to see people in a position to do something focus on the ‘next bright shiny thing’, whether it be Analytics AI or Agile, without ensuring first that the basic fundamentals are taken care of. Does IA have sufficient resources, and of the right kind (both as to range of disciplines/domains and mindframe, including listening skills)? Does IA have the mandate to look into the really strategic aspects of business (rather than being bogged down in routine low-risk areas)? Does IA have the ear of management (the proverbial seat at the table)? Maybe not, any of this, but some still persist in treating tools as objectives, and then are genuinely surprised when such IA efforts don’t move the needle! Hope sometime in near future those who really care for IA get their priorities right.
Another terrific post. Like all your posts conceptually/theoretically sound but so practical/applied/empirical too.
Absolutely right about technology tools/”solutions” and their place in the IAA shop- just tools, with potential good uses and risks, and a starting COST that needs to be justified/recovered and so often is not. If all the others are there, the skills, in the tool users, we can talk about IT “solutions” mattering …
I agree 100%. We tend to ‘listen to respond’ rather than to learn, which in the long run, we tend to lose valuable information that was not said, cos their response/ thoughts mattered most. Something we all should exercise and build to assist us in our role, most often overlooked. Come to think of it, no wonder we have two ears and one mouth. We listen twice more than we speak.
Thanks for the reminder. A listening culture is important