When I was Head of Internal Audit I became increasingly interested in two key questions:
How to be sure the internal audit function was adding the maximum value it could?
How could I be sure the internal audit function was as efficient as it could be – moving beyond benchmarking, and going back to first principles?
Whilst I was HIA I learned about lean ways of working, originally developed in Japan, which directly addresses these questions in a systematic and proven way. Over the course of a year my audit team developed a lean auditing approach that achieved efficiency improvements of around 20%. In 2010 I started to work as a freelance consultant and took what I had learned as an HIA and applied and enhanced it with numerous clients and at many lean auditing workshops all over the world. Eventually I was asked to write a book on the topic: “Lean Auditing” (published by J Wiley in January 2015).
Here are just a few ideas about what it takes to be lean: What do you think about these ideas from those quoted in the book? And what advice / other ideas do you have to share with others?
“Planning an assignment is key because when I see things going wrong, it is often because we didn’t think enough up front. It can be as simple as not recognizing a key contact is travelling or on holiday for 2 weeks during the assignment. Unless people have really thought about what they want and sufficiently planned and been rigorous in engaging the business, problems will arise”.
“Good audit departments put a lot of effort into thinking about and agreeing the scope of their audits so they are addressing important points; and as a result key findings will then be meaningful to the organization”.
“IIA Standards say that you need to gather sufficient evidence and have sufficient relevant information to be confident about what you are concluding. However, that's often translated into a whole load of advice about how many records you need to look at and how many tests you need to do to substantiate everything, when, in point of fact, if we are focusing on risk and adding value it should be different from that. It’s wrong to stick to sample requirements in a rigid way”.
Root cause analysis:
“I think that reporting the findings in terms of symptoms and then stopping is ridiculous. If you just report the reconciliations are not being done, without asking more questions that may be needed to identify the root cause, the issues don't go away. You're actually not curing the patient. You're just pointing out the problem”.
“Before we put pen to paper and waste our time, let's write up a list of findings and first of all decide whether we agree these are all important. After that we can look at the findings and the proposed corrective actions and start to see whether there are patterns, so that they can be combined. This approach makes sure that audit reports are more focused, with less need of rewriting. It also helps you to combine points making reports as concise and readable as possible, and also helping stakeholders better judge the relative significance of what is being found”.
One CFO explained:
“I’m looking for Internal audit to have a really good business and commercial understanding. You want people to be able to translate the dry accounting and control terminology in a meaningful way that they can engage their internal customers. You don't want them using technical speak - you want them to put them into common sense. This is what it means to your business area or your business unit”.
Other areas worthy of attention include:
What have you found to be most successful?
To hear more about lean auditing in more detail to hear how it might be used in your organization, contact jcp@RiskAI.co.uk