Over the course of this book I hope that the reader has gained encouragement that there is a considerable body of progressive, value adding practice in internal audit across many organizations and many countries. I happen to have chosen examples predominantly from the UK and Europe, the US and Australia, where I spend a fair amount of time, but I know I could fill another book with good practices from other countries. Progressive, value adding internal audit really is out there, right now, it’s just not evenly distributed across all audit functions or all countries at the moment!
At the time of completing the final manuscript for this book, the IIA have issued a consultation on a new mission for the Internal Auditing profession. In it there is a suggestion that there should be a clearer mission for the profession overall and currently it is proposed this should be to “enhance and protect organizational value” – suggesting lean principles and practices will remain relevant as the profession moves into the future.
For the avoidance of doubt, I am not saying that the future of internal auditing should solely be oriented around lean, but I hope that this book has made a reasonably strong case for taking lean principles seriously when thinking about how we might reimagine internal audit in the future. It is vital that we do not take lean so much to heart that we create a straightjacket for the audit profession. I hope that, throughout this book, the reader is able to see the spirit and philosophy that lean offers, and the practices that have been outlined are intended to be enabling and energizing for audit functions. However, I believe strongly that we should not develop a “fad” like interest in lean, rather we take the best of what it has to offer, alongside other progressive practices, and steadily integrate what works into our normal ways of working, so that we can move the audit profession forward.
Throughout this book the themes of leadership and courage within the auditing profession have recurred. Phil Gerrard (CAE, Rolls-Royce) sums up the lean, progressive mindset:
“It takes confidence and courage to say no, I’m not doing any more audit work. It takes confidence and experience to say I’m not going to drill down any further. I’ve got my point. Management have said yes, we agree, we’ve got an issue, we need to do something about it.”
I hope that I have highlighted many of the key lean principles that may be of relevance to auditing. I also hope that I have managed to identify most of the key opportunities to add greater value and drive efficiency. However, I fully recognize that others in the audit profession will be able to build on what I have set out herein. Indeed, one of the most exciting things about writing this book has been the thought that it may act as a catalyst within the internal audit profession to stimulate other ideas and proposals that will help us all move forward.
Speaking personally, I believe there may be a number of areas we need to give greater attention to as an internal audit profession. I know that the IIA standards continue to evolve and I wonder whether they will address some of the key areas highlighted in this book, notably:
I would also like to see us, as a profession, improve the ways we can help CAEs (and auditors) navigate the many dilemmas they face. It seems to me that some CAEs have become “tamed or captured” by powerful figures in their organization and lack the political savvy and other stakeholder support to stand up for what is right, whilst other CAEs can be a little too brave and end up leaving their role or exiting their organization because they could not take others with them. The way I see it, these compromises and these departures are happening across the world on an ongoing basis, and can easily fall below the radar screen. The best CAEs use formal and informal contacts and networks to help them navigate through sometimes dark and dangerous waters, but in my experience these contacts and networks are not always sufficient.
Consequently, I hope that we can better use techniques such as ethics or practice advisory committees to give CAEs a clearer forum to think through the problems they face. Note my main emphasis is on support for CAEs to navigate through the challenges and dilemmas they face, not disciplinary action (although I appreciate that there is a place for this as well as in any profession).
I appreciate that there are challenges and difficulties with such forums (confidentiality is most commonly cited as a barrier), but – by the same token – I think it is essential we develop better mechanisms to talk about and develop a deeper body of practice about how to navigate our way through the challenges and dilemmas that we face.
In addition, whilst standards and principles go a long way, I am convinced, from my work on Action Learning for auditors, as well as coaching CAEs, that it is through confidential, candid and thoughtful conversations that the best solutions emerge, or at least, the least worst solutions, as is often the case!
I will conclude this book by offering final words of encouragement about the lean auditing journey from Norman Marks (GRC thought leader):
“Becoming lean is a kind of quest, understanding what we are about, which is deliver services that our customers need and will gladly pay for.
Delivering to them with quality and timeliness and efficiency and effectiveness is where you start. Then everything from that flows. Because then you look at everything else and say, why am I doing this? Is there a better way to actually deliver what I need to deliver?
You rethink everything.
Now some things may not get changed, but you may well find that not only do things have to change now, but next month and next year, where you will you’ll probably be able to use technology, or other methods to change them yet again.
Lean is basically a continuing process where you are constantly examining what you are doing and saying, is this the best that I can do?”