The truth is rarely pure and never simple – so wrote Oscar Wilde in his 1895 play, The Importance of Being Earnest. The play, which is a farcical comedy, mocks Victorian traditions of false seriousness and social customs. We, internal auditors certainly do not mock traditions and practices, but earnestly go about the not-so-simple path of seeking the truth to achieve the audit objectives. There are dilemmas faced by us as we go about conducting internal audit. This blog is an attempt to how we can earnestly conduct our internal audits while dealing with dilemmas.
Let’s reflect on our experiences when we draw up the audit plan. Whether based on a risk assessment or not, we do get conflicting thoughts on where to focus more and where not to. Business is dynamic and we realise that something seemingly as simple as drawing up an audit plan requires us to do a bit of back and forth in our minds till we conclude earnestly what the plan finally is. Whether we should focus on a high risk item once or twice in a year or with greater frequency in the audit cycle? Whether an audit area can move from moderate to high or vice versa? How do we keep our plan flexible and agile enough so as not to lose out on any changes to business processes and systems?
Similar thoughts come through while designing the scope of each area of audit; while executing our audit; while discussing our audit conclusions; while deliberating over our draft report and finally, when we prepare the final report.
The dilemma of what is good for business and what is required for adequate controls seems to be from time immemorial. It is easier said that the cost of controls should not surpass the benefits the controls intend. Calculations to quantify costs/ benefits are based on probabilities (nowadays, simple probabilities have been replaced by complex weighted average probabilities) that could swing either way. While all these calculations are done and decisions justified, do we not get a feeling that perhaps we should let the process be, not tweak it greatly and appeal to the human instinct of good behavior and the corporate instinct of good governance to ensure that the originally designed and / or recommended controls fall in place? How often, in our discussions do we tell the auditee, “Leave alone what I am saying, what is your opinion?” or “Just step back and tell me, what do you think?” That is our way of trying to impress upon the basic good human thoughts. Sometimes this works as a clincher in discussing our observations and recommendations and getting the auditee to agree with us. But many a times, it does not.
So, as internal auditors, what are we supposed to do? To arrive at an earnest result of internal audit, we need to be true to ourselves. We need to look at the situation from both sides – the auditor’s view and the business view. Many a times when we understand the business view, we are able to better articulate our auditor’s view. We are then able to traverse that path of adequacy of control and tweak our recommendation appropriately. This way the objective of audit is achieved as well as the perspective of business is not lost. Is this the elusive ‘golden mean’? Wonder whether this term emanated from an auditee-auditor conversation sometime in history? Well, that would be a topic for another blog, another research!
The other dilemma is when we need to present our audit findings to the Top Management or the Audit Committee of the Board. Do we tend to get carried away by our own recommendations? Do we underplay our own recommendations? Do we allow the business to sway our communication? Do we override the business and say, this is my privilege and I will report it in my way ? Do we think that our next internal audit assignment / tenure will be influenced by what and how we say? Do we think, to hell with it, let us just go out and say what we want to say? Reality is, nothing like this happens; reality is, a bit of everything happens! Our earnestness enables us to find, once again, the golden mean. And with each experience we realise that we are communicating better. We are communicating the right things in the right manner. Effectiveness and efficiency, both achieved. This sincerity of approach is always well appreciated. It leads to a better acceptance of our observations and recommendations. And then we are satisfied that objectives of internal audit are achieved.
The position of internal audit is vital in any business entity and carries immense responsibility. The Peter Parker (a.k.a Spiderman) Principle (with great power comes great responsibility) applies equally to internal audit. It has been the experience of many of us internal auditors that only because we say so, the Top Management and the Audit Committee believe in the proposition we put forward. This is because of the faith reposed in us; an outcome of our unbiased work. This reflects an outcome of years of performance of internal audit across businesses, sectors and entities. And that, to my mind is our single most attribute that keeps us performing the way we are expected to perform.
We will not belie the expectations of our stakeholders if we perform our role as internal auditors with the expected sincerity and earnestness. Unlike sportsmen, we cannot afford to have an off-day. We need to perform every day. This can be done by imbibing the principles embodied in global and domestic standards of internal audit and performing by them. This in turn will lead us to delivering sound recommendations for business process improvements. The synopsis of our recommendations remains, however, within the troika of parameters – time, money and people – which I found in the writings of Pu La Deshpande, perhaps one of India’s greatest literary genius whom I quote verbatim:-
प्रोब्लेम्स नसतात कोणाला? ते शेवटपर्यंत असतात. पण प्रत्येक प्रोब्लेमला उत्तर असतंच.
ते सोडवायला कधी वेळ हवा असतो, कधी पैसा तर कधी माणसं.
या तिन्ही गोष्टीपलीकडला प्रोब्लेम अस्तित्वातच नसतो.
Loosely translated (and with apologies to Pu La):-
Who doesn’t have problems? They remain right until the end. But each problem has a solution.
To solve the problem sometimes you need time, sometimes money and sometimes people.
Beyond these three resources, there is no problem that cannot be solved.
As internal auditors, if we detect a problem within the control system and attempt to solve it with these three resources, I am sure our earnestness of internal audit will be seen, accepted and appreciated by business, regulators and all stakeholders.
The Blog solely reflects the personal views and opinions of the author(s).
