Auditing hasn't changed much in recent years - it's still delivered by a people-based approach. Audit reports typically provide tactical detail, are text based, cover compliance rather than effectiveness, do not compare current practice with best practice - and rarely link to the drivers of business performance. But Senior Managers don't want tactical detail - they want strategic information. And they're starting to ask why they're not getting it.
When auditing business issues, it is essential to understand and assess the things that happen in the ‘real-world', which are often not documented - otherwise there is a risk that excessive detailed compliance auditing will hide the strategic overview that Senior Management Teams need to see and the risks that their organisation faces.
The result is that mangers feel disengaged from the audit and its results - there is a significant mismatch.
To audit effectively involves understanding a wide range of factors, enablers, constraints and behaviours (i.e. what people actually do in the ‘real world', not just what documents they can produce or what they say) that, in combination, drive the effectiveness, business performance and management of risk.
Audits therefore need to assess behaviours, which provide evidence of how such factors affect performance - something that traditional audits often fail to consider and have difficulty in quantifying. This includes the so-called "soft" issues such as motivation, culture and teamwork.
Although an auditor may provide a very high quality overall service, it is impossible that he or she will be an expert in every aspect needed to audit and report on how effective a business process actually is - and it is even more unlikely in the context of a whole management system. It is not surprising, therefore, that auditors are sometimes perceived, as a "weak link" in the auditing process.
What is needed is a complete reassessment about why - and how - auditing is done.
Firstly, the Why.
Compliance auditing is carried out to check that what documents say should be happening is actually happening. However, Senior Managers are not only interested in individual activities, but much more in the combined effectiveness of the whole business process to deliver results. Is this a possibility in most organisations?
Secondly, the How.
Whatever method is used, it must be able to gather in-depth information from a range of people and locations i.e. much wider than is possible with existing methods, relating to what behaviours are actually being displayed. Different people inside and outside the organisation see or experience the same activity in different ways and the auditor needs to understand this dynamic and gather information accordingly. It needs to be based on a statistically valid sample of those affected and expose risks, benchmarks and comparisons - as well as compliance issues. Use of technology enables this to be realised.
Technology also enables the required level and consistency of analysis, which is beyond what is possible with a human mind. Consistent analysis of data is critical if trends over time are to be identified. Reports setting out the results of the analysis need to be in terms that inform managers of key business risks, provide benchmarks and identify issues and areas for improvement, related to their targets and objectives.
Auditing will need to change from a tactical data gathering activity to a strategic management tool - and the role of the auditor will change, as new and far-reaching auditing methodologies are applied. The range of auditing applications, especially IT, will grow - and the deployment mix will change. But although IT will have an increasingly important role, there will always be a need for auditors - i.e. for those who can physically see things and question people.
Auditors who recognise that a revolution is happening will become a valuable resource in helping their organisations or clients deliver business objectives and drive improvement. Those who do not will continue to focus on compliance. They will therefore remain a tactical resource addressing tactical issues - and they will operate in business arenas significantly more limited than that of their strategy-focused colleagues.
Audits of the future will improve the limitations of current methods and focus on achieving greater effectiveness linked to business results.
Disagree? Tell us why and add to the debate.
Contact us if you want to hear more - firstname.lastname@example.org
Printer friendly version of this article: