Calling Out Unhelpful Patterns and Cultural Problems

During a discussion with a chief audit executive (CAE), we examined the proposed audit plan and looked for resource headroom to enable them to look at some new areas. There was one audit, which took a considerable amount of time and was repeated year after year. The audit concerned various secure facilities that contained valuable and sensitive materials and therefore went beyond a straightforward check of basic security arrangements. I was advised that this had become an annual audit four years earlier because of significant audit committee and executive interest.

The CAE explained, ‘I get kudos for doing the assignment, but many of the things we find are similar to what we have found in the past. The risk and control environment is only improving slowly. Still, I could probably write 70% of the audit report without doing the audit. They are making some fixes, but not really shifting their mindset about what it would take to make a step change in what is being done’.

I commented, ‘It seems a bit like the organisation has become dependent on you to do its monitoring. It has become accustomed to “the same old” findings and – to some extent – so has the audit team. So, what about sharing the themes of what you have found in the past and your thoughts about the causes and suggesting that yet another audit is not going to add that much value’.

After various discussions, the CAE went to the Chief Executive (CEO) to talk about stopping doing the audit. The CEO was initially unhappy with the suggestion, saying, ‘But you've got to look at it!’ However, after discussion, they conceded that there were fundamental questions to consider, explaining why audit was essentially identifying ‘the same old findings’. Finally, the CEO said, ‘I want you to present your analysis of the key themes over the past years and – in discussion with the relevant managers – work through the underlying difficulties and constraints to establish how we can get this area working at a better level’.

The CAE did the analysis, worked with the relevant managers and presented some improvement action options, which were then discussed and agreed upon with the Executive Committee and the Audit Committee. Of course, there was a resource dimension to the changes agreed upon, but the result was that the CEO, relevant managers and the CAE got positive feedback from the board for initiating a step change in an important area.

And the CAE did not have to do the repeat audit for the next year, saving time to then work on some new areas. Henceforth, assignments on the secure facilities were much shorter, looking in depth at specific aspects from time to time, rather than just repeating what had been done in the past.

This is not the only example I have encountered where the brave thing has turned out to be to call out situations when audit is becoming an almost permanent substitute for things management should be doing.

If an audit assignment is ‘going through the motions’ and you can predict its findings from year to year, ask which underlying causes remain unaddressed.