Outside the box: The race for pace

If you only ask one question this week, make it this one: Could we move faster and work more flexibly without compromising internal audit credibility?

A: It’s one thing to pull out all the stops when there’s a crisis and another to work out how to make rapid responses part of everyday working life. Internal audit departments in all sectors have repeatedly demonstrated their ability to adapt and change to provide timely responses to fast-moving circumstances over the past 18 months. Now is the time to look at how this speed and vigour can be embedded into internal audit business as usual.

Fortunately, there are pioneers who were experimenting with ways to make traditional audit processes faster without cutting corners long before COVID-19, and many more teams have tested new approaches on a temporary basis in the past year. Some have incorporated Agile techniques – including breaking large audits into short chunks and offering regular real-time updates to auditees – while others have turned to software to automate time-consuming processes and request pre-audit information.

As in other areas, things that were previously seen as best practice and cutting edge are becoming more common, shifting the bar up a level (meaning that those who have not changed may find they’ve moved from the middle to the back of the pack without noticing). Annual plans are being supplemented with, or replaced by, rolling plans that are easily and swiftly adapted as and when new risks emerge. Risk-based auditing, in some form, is now standard, not exceptional. Boards, audit committees   and internal audit customers in many sectors are starting to expect faster feedback, more regular updates and dashboards that highlight at a glance the most important issues of the moment.

Everyone is at a different point on the scale, but all can make progress, particularly if we learn from each other and from what works elsewhere. Technology is, of course, helpful – many would say, essential – for most internal audit teams today, but this doesn’t need to require a large investment immediately. Incremental change, especially when this involves training team members and increasing management’s expectations, can take you further in the long term.

The key questions to ask now include: have we made our processes faster and more responsive over the past two years? Are we doing labour-intensive or time-intensive things today that we shouldn’t be doing tomorrow? Do we do things from habit and to meet demand rather than because they add real value? Do we need to do more consultancy or advisory work to provide a faster response to a new risk, or highlight an emerging issue? Do we need to communicate more with stakeholders about what a faster, more responsive internal audit function could achieve for them – and what needs to change to facilitate these improvements? Who is already doing things that we can learn from and can we talk to them?

Trying to do too much too fast can cause more problems than it solves, but internal auditors should be well able to assess these risks and challenges. It’s just as critical to consider the risks of falling behind the rest of your organisation or of providing out-of-date assurance on issues that haven’t been important for many years. We should ask whether we really do risk-based internal audit or whether we audit particular topics or areas of the business just because they have always been on the plan.

The risks of falling behind, of providing false or inaccurate assurance, or of simply auditing familiar topics (because we always do payroll, for example) are likely to have a significant impact on the future credibility of the profession. 

This article was first published in September 2021.

Where to start

How to change is a big question. There are no simple answers – which is precisely why making time to think and explore the options is vital. What makes it more difficult is that thinking or reading about alternative ways of working and unfamiliar technology is not something that can be done well when you’re tired or short of time.

This is why many people have their best ideas on holiday or in the bath – times when they allow their minds to wander. In fact, there is evidence that unstructured thought is essential to creativity as well as to the assimilation of new ideas and mental resilience. However, to have valuable creative ideas about how to take internal audit work forward, you also need time to research what others are thinking and doing and this may require a more structured approach – for example, marking off time in your calendar to read or to attend a webinar and deciding where to start.

Making time to think and explore ideas should be a regular commitment, not a one-off event – and it should be as sacrosanct as an important meeting. It’s human nature to think that time spent alone reading or watching an online presentation is more “indulgent” than meeting other people. It’s seen as a “luxury” or “optional” and is too often pushed back to be done on a train or aeroplane, or after supper.

However, thinking is an energy-intensive activity and, unless you are a night owl who regularly schedules important meetings in late evening and enjoys working with people in other time zones, you are unlikely to get the best results when you are tired and distracted.

It also doesn’t have to be done alone. One way to put pressure on yourself to explore options, generate ideas and research what others are doing is to ask others in the team to do the same thing. Arrange a workshop to discuss what everyone comes up with. If there is extensive literature on a topic, you could allocate one document to each person and ask them to summarise it to everyone else. This puts pressure on everyone to bring something constructive with them. Making time becomes a necessity, not a luxury.

It’s also important to overcome common psychological barriers. Recognising that you are not spending enough time thinking and that you have not changed the way the function works sufficiently is a good start. Putting it on the to-do list immediately gives it a status that can be prioritised.

Whatever you do, thinking has to be put on a par with (or made a higher priority than) actions. If you can’t see beyond what you’ve done in the past, you will be doomed to do more of it, whether it is productive or not. Worse still, you will get into a vicious circle in which inefficiencies increase the workload leaving you even less time to think of alternatives. Something to think about. 

This article was published in November 2022.