Lean Auditing (Part 3): Rethinking Internal Audit Using Lean Techniques to Enhance Value and Improve Productivity

This is the last in a three-part article on Lean Auditing by by James C. Paterson, Director of Risk & Assurance Insights, Ltd. In part one, Mr. Paterson briefed detailed the principles behind lean and provided some useful examples of using the methodology in audit work in part two. Here, he provides additional examples of using lean and its positive effects. 

Add your thoughts in the comment section and be automatically entered to win one of four free copies of James C. Paterson’s book.

By James Paterson

Then during assignments there are other important areas productivity that can be improved:

Testing:

Chris Baker the technical director of the IIA UK explains:

“IIA Standards say that you need to gather sufficient evidence and have sufficient relevant information to be confident about what you are concluding and in order to be able to express an opinion. However, that’s often translated into a whole load of advice about how many records you need to look at and how many tests you need to do to substantiate everything, when, in point of fact, when we are focusing on risk and adding value it should be different from that. For example, it’s wrong to stick to sample requirements in a rigid way”.

The key message is to better understand when to continue testing, change the testing approach or to stop testing. In the book Richard Chambers explains: “I think part of our problem as a profession is that sometimes we have a tendency to over-audit. Sometimes we do things in the audit process and try and validate things that aren’t really going to be important”.

Root cause analysis:

With the time saved from more intelligent testing, additional added value can be derived from a solid root cause analysis (which is also a series of techniques developed by lean ways of working). One interviewee commented:

“I think that reporting the findings in terms of symptoms and then stopping is ridiculous. If you just report that reconciliations are not being done, without asking more questions that may be needed to identify the root cause, the issues don’t go away. You’re actually not curing the patient. You’re just pointing out the problem ”.

A key clue in relation to whether root causes are being properly identified is to consider how many issues seem to repeat from year to year. Another is to challenge the idea that there is a single root cause for each audit finding.

Drivingvalue in effective Audit Reporting:

One senior auditor explained:

“Before we put pen to paper and waste our time, let’s write up a list of findings and first of all decide whether we agree these are all important.

After that we can look at the findings and the proposed corrective actions and start to see whether there are patterns, so that they can be combined.

This approach makes sure that audit reports are more focused, with less need of rewriting. It also helps you to combine points making reports as concise and readable as possible, and also helping stakeholders better judge the relative significance of what is being found”.

The key message is to think carefully about what is important in the audit report and to focus on that, avoiding the demotivating and wasteful situations when audit reports are extensively revised or rewritten.

Audit team culture

The book provides examples of ways of working that improve the pace and energy of audit team assignment delivery and encourage a collective and proactive approach to learning after each assignment, driving improvements in both value orientation and delivery. Paradoxically this can include revisiting traditional metrics and considering whether these actually drive productivity or in fact focus audit time on the wrong things (for example making up time sheet records to align with what is expected!).

Norman Marks offers the following challenging observation, but very much in line with the insights from the book:

“The danger is that we have been trained not to think when auditing in the old way. We’ve got to break that. When you hire people you need to train them. Not only do you have to train them to think but you have to break the shackles that bind them. They are actually weighed down and handcuffed and chained to stop them from thinking for themselves, and exercising their own judgment. We’ve got to tackle this as a profession”.

Final reflections

My hope is that the greater understanding of lean principles can help the internal audit profession to become more confident in approaching our internal audit work in a professional but pragmatic way so we can deliver key insights productively without feeling like we are “cutting corners”.

Writing this article has felt like squeezing a gallon into a pint pot, and may have opened up as many questions as it has answered. However, I hope that those reading this article are curious to learn more about lean ways of working and how these can apply to internal auditing, perhaps starting by ordering a copy of the book (Lean Auditing – ISBN 9781118896884), looking at my website www.RiskAI.co.uk, or making contact with me at: jcp@riskai.co.uk, either to share their insights or to sign up to attend a lean auditing workshop.

Don’t forget to leave a comment to be entered into our Lean Auditing book giveaway. The contest will close and the winners announced one week after the third week in November.