Lean Auditing

As this book draws to a conclusion, I realize that it has not been possible to discuss the specific details of all of the various lean tools and techniques introduced at the outset of the book, nor to share the details of specific best practice methodologies and templates. This has partly been due to the limitations of space and partly because specific methodologies and templates that work for one audit function may not be applicable for another. However, if there is interest in sharing more lean auditing tools, templates and specific assignment methodologies, that is something I would be glad to contribute to in the future.Nonetheless, I sincerely hope that readers will have found something of value in this book. Perhaps some readers will have received validation that a number of practices they have in place are in line with, or perhaps even ahead of, the good practices suggested herein. Other readers may have identified some areas where there are opportunities to enhance value or improve productivity and may be considering taking action. In recognition of this, it seems appropriate to offer some reflections about where and how to approach the journey to becoming a progressive, lean audit function.

I can recall when I was CAE at AstraZeneca, that a review of our practices against lean principles suggested a number of areas for improvement and I was keen to implement many of them. However, with the counsel of my management team, we adopted a range of pragmatic lean techniques that enabled the function to move forward in a step-by-step manner. In particular, one of the biggest challenges for a hard-pressed audit function is to find the time and resource to make changes. In the AstraZeneca audit context we therefore started with a further streamlining of our audit methodology and our assignment reporting. We also worked to streamline the remediation tracking process, and became much more selective about what we did in terms of follow-up assignments.

I cannot guarantee this approach is suitable for all, but as a starting premise I suggest that thinking through what to stop or what to do less of is a crucial way to unlock time and energy within audit. Having done this, it should be possible to properly engage in other improvement opportunities.

Some of the improvement opportunities identified in this book are more strategic in nature and include the following:

Improving engagement with key stakeholders on the role of audit and how it can add value;
Strengthening the link between the audit plan, the delivery of value and management of risk;
Improving assurance mapping and assurance coordination, so that the work of key compliance and assurance functions, as well as that of management, is properly joined up;
Continuously reviewing team composition, training and development and ways of working.

However, there are a number of “quick win” areas for audit functions wanting to implement lean ways of working, and these are summarized below:

Getting the team to consider who is their prime customer;
Using a Kano approach, working to define the real delighters, satisfiers and dissatisfiers in relation to auditing and modifying ways of working to deliver more delighters and to avoid dissatisfiers;
Capturing more clearly the rationale for an audit at the planning stage and making sure this is understood as assignments are planned;
Prioritizing the scope within an assignment based on both risk and value;
Being clearer about the depth and breadth of assignments and consequently the appropriate resource that should be allocated;
Managing each assignment as a mini project with milestones for all key steps;
Improving disciplines for gathering data and documents;
Encouraging openness from management about known issues or areas of concern;
Pit stop reviews during assignments to keep auditors focused on value-add and delivery of the assignment to the time and budget allocated;
Looking at “how big” and “how bad” an issue is to prioritize any findings, and improving work on root cause analysis and the identification of “killer facts”;
Concentrating on strong communication with management throughout the assignment;
Removing the “to and fro” of written audit recommendations and management responses, with a focus on agreed actions as key;
Improving the assignment feedback process and post-assignment learning.

My experience is that most audit functions should be able to implement a selection of the quick fix action points within a few months, particularly if auditors are properly engaged and senior managers are sympathetic to making progress. I don’t suggest a few months as a macho challenge, but just to make the point that a “let’s give it a try”, “let’s pilot that and see what happens” approach is what the lean mindset is all about. Over-analysis in this context can just lead to paralysis and a continuation of the status quo.

In addition, I do not think that an internal audit function needs to secure an enormous pot of funds from senior management in order to become more lean. At AstraZeneca we made changes without requesting additional funds (we just used our existing resources and existing budget slightly differently) and the same is true for many of the audit functions I have worked with.

Of course “quick wins” have an important place in the lean journey since they can often be energizing for auditors and be seen positively by management. However, in making any quick win improvements, it is important that the CAE should engage senior management and the board or audit committee on what is being done since: i) sometimes their support may be needed and also ii) they are a key customer whose views about adding value must be taken into account.

However, I am personally a believer that actions speak louder than words and therefore my normal advice is to orient the audit function towards lean ways of working without an enormous fanfare. This can be useful where stakeholders are rather uncertain about some of the proposed changes (e.g. shorter reports), but start to see the benefits being realized (e.g. key messages still present and reports issued more quickly).