Internal Auditors: Almost Nothing Matters

Problem: Many internal auditors focus on trivial minutia, thinking that they’re being busy and productive. In fact, they’re being entirely inefficient and unproductive by focusing on the wrong things.

Solution: Focus on what matters. What matters? Almost nothing.

Here’s what you should and should NOT be focusing on.

Let’s start with why you’re there in the first place. By ‘there’, I mean working for your company as an internal auditor.

One way to look at it is you’re there to help deliver your organization’s product(s).

What is your product as an internal audit organization?

Generally, it’s your audit report. Great. So now we know one of the reasons they hired you was to help them deliver their key product — auditor reports.

What does your ideal product, your audit reports, look like?

Generally, it’s a quality product, delivered on time.

Okay. A quality product delivered on time. Let’s see, quality and timeliness.

Let’s start with quality.

How do most internal audit organizations measure quality?

Alright. Here we go again. This is another commentary that will set some internal auditors’ and audit managers’ hair on fire.

Ready.

They don’t measure quality.

What I mean is they don’t really measure quality, or measure it in any meaningful way.

Sure, they may see if any words are misspelled in the audit report, or they may look at formatting, or they may look at how many QR comments they get. Heck, they may even look at outcome measures to see how much their findings found in lost revenue or expenses.

Misspelling and quality review comments aren’t what I would consider any meaningful determination of quality. Sure, they’re indicators. But take grammar or spelling. If your internal auditors can’t spell or properly use grammar, especially considering those quality reviews are staring them in the face inside Word, then you’ve got bigger problems.

Outcome measures? Great. That’s useful. Sometimes they’re even meaningful.

But here’s the reality.

Many, if not most, outcome measures aren’t as accurate or as meaningful as we think.

Don’t get me wrong. Some are cut and dry. For example, let’s say we have a finding where a programming glitch sent out erroneous invoices which underbilled clients by 10%. Perfect. We have a hard number — a hard outcome measure. That’s excellent and awesome.

But for every outcome measure like that, I’ve seen an equal number that made assumptions or extrapolations that were aggressive and questionable to say the least. For example, I’ve seen variations of the following: “by implementing this cybersecurity control, the organization can prevent annual losses from data breaches, totaling on average, $1 billion”. Obviously this is an exaggeration to make a point, but not by much.

The larger point I’m trying to make is that by definition, quality is subjective, and therefore harder to measure than non-subjective measures such as time and budget.

So, here is the hard reality. The hard metrics are the most important, not because I say so, but because they’re implicit in the data the organization collects and the performance ratings that they provide are heavily favored in the hard metrics.

Don’t believe me. Take a look at your performance reviews in terms of evaluating your auditing. What are they measuring?

It’s usually NOT what people tell you. It’s what matters to your internal audit manager and your organization. Hint: It’s what they’re measuring.

Internal audit managers and internal audit executives will tell you the quality is important. But it’s difficult to measure these subjective or soft metrics.

What does this also tell you?

It should tell you that any time spent on anything else except those hard metrics is not an efficient and effective use of your limited time.

Similarly, if you overlook those hard metrics, and try and focus on quality findings, and by doing so, your hard metrics suffer, you open yourself up to criticism.

Don’t believe me?

What metrics do you use to determine quality of reports? How hard are those metrics? Are they subjective in any way? Are they by their nature open to interpretation by the internal audit manager who is rendering the opinion or measuring the quality?

Here’s an example of how subjective quality is.

Throughout my career, I witnessed findings that I thought were highly significant. Findings that put the organization at significant risk, or had significant financial impact, or had significant cost savings. However, many of those findings were met with yawns by internal audit managers and internal audit executives.

Conversely, I witnessed findings that were obviously weak, incomplete, and insignificant. However, I found that many times those findings were met with great enthusiasm by internal audit managers and internal audit executives.

Overall, there was no rhyme or reason or consistency as to what internal audit managers and internal audit executives considered a quality finding.

When considering what’s important in your particular organization ask yourself the following questions:

· What is your organization measuring?

· What are their key performance indicators?

· What are their key metrics?

· What metrics are in your performance review?

· What metrics are in your internal audit manager’s performance review?

· What metrics are publicized or touted in your annual report to stakeholders?

Here are some common hard metrics/KPIs that you’ll find in most organizations.

Organization wide

· Audit reports issued per year

· Audit reports issued by department or functional area

· Audit reports issued by audit manager

Individual audits

· Individual audit financial budget and actual

· Individual audit staff day budget and actual

· Individual audit calendar day budget and actual

· Individual audit travel budget and actual

· Outcome measures or increased revenue of cost savings

What does NOT matter?

Generally, you won’t find KPIs for things such as:

· Number of findings per audit

· Quality of findings within an audit

· Number of risks mitigated organization-wide or within an audit

· Data analytics such as comparisons between number of staff on a job and whether or not it met budget, or time spent planning versus whether or not it met budget, or number of staff and the number of findings on an audit, etc.

· Time spent on workpapers

· Quality of workpapers

· Time spent writing up memos of discussion or summaries

· Anything you do that is NOT part of a key metric that your organization is measuring

So, what’s the takeaway from all of this?

Once you know what really matters, focus each day on delivering what really matters.

I’d recommend the following approach: do nothing else but ensure that your audits are done in the appropriate quantity within the appropriate time and budget. By doing so, you’ll be setting yourself up for success.

Check out our Newsletter “Secrets of Millionaire Internal Auditors — Mastering the Game of Internal Auditing & Getting Rich While Doing It” for street-smarts, in-the-trenches internal auditing hacks, techniques and strategies that you won’t get anywhere else.