Help! My crystal ball is broken!
Help! My crystal ball is broken!
Internal auditors you are not alone. Perhaps you are feeling as shattered as your crystal ball that is lying in a thousand pieces.
We are here to offer some advice and support to our internal audit community as we all try to deal with the enormity of the ongoing uncertainty that we and our organisations are attempting to navigate.
It seems like a lifetime ago that we wrote about competing crises – yet it was only a few months back. Everything from the existential threat of climate change, to the immediacy of a pandemic, Brexit, recession and geopolitical tensions.
Uncertainty is risk. Inherently we try to avoid it, as do those in positions in power – freestyle rock climbing, rally driving and living off grid are not mainstream pursuits. There are few risk seekers in the boardroom. The IIA Standards are clear that risk-based internal auditing is the way to go.
In an ideal world, the chief audit executive will have time to talk to stakeholders, evaluate risk registers and perhaps update an audit universe to inform the creation of the audit plan.
We are far from a perfect world!
Three tips for managing uncertainty and continuing to provide assurance
Here are three tips for managing uncertainty and continuing to provide assurance.
1. Focus only on the things you can control and ignore the rest
|
Manage uncertainty |
Provide relevant assurance |
|
Develop an internal rather than external locus of control. In other words, perceive yourself as being in control of your wellbeing not the environment around us. This is particularly relevant at the moment, what with the pandemic protection measures in force. The same applies to our organisations: control the controllable. This includes strategic decisions, operations, customer communications, etc. If meetings are all about ‘what can’t be done because’, change the agenda – decisions still need to be made – the world is still turning albeit in a crazy pattern. |
Internal audit has a unique overview of an organisation. If you know something is broken, then time spent evidencing the issue could be redirected into consulting advise to either fix it or patch it up to get through the immediate challenges. Management is in crisis mode, so be solution-oriented. Do not add to their problems. Recommendations for new systems can wait!
|
2. Bring certainty to what is important
|
Manage uncertainty |
Provide relevant assurance |
|
With so many competing crises facing us in 2021 it is hard to know which way to turn. Prioritise. Prioritise the list. And then be ruthless. When you are left with what is really important find ways to bring a degree of certainty to it. |
Internal audit should focus on the areas with the greatest exposure to the key risks that could affect the organisation. Coverage of typical areas may no longer be appropriate. That's not to say they are not important, but they may be less important this year. Internal auditors need to leave sacred cows in the field when planning engagements and tests… |
3. Move the goalposts
|
Manage uncertainty |
Provide relevant assurance |
|
Full information is a rarity in times of uncertainty which makes decision-making stressful. It can be helpful to focus on the process used to reach a decision rather than try to prejudge its outcome. Changing how we evaluate what a good decision looks like is critical in times of uncertainty. |
Be flexible, adapt and evolve. Shorter audits, open communication channels, rapid sharing of findings – practical ways of working to add value. Traditional audit KPIs might not be measures of success in 2021. What would success look like for you? The organisation surviving to 2022 perhaps? Feedback that you have made a difference or that you have completed ‘x’ audits on time and to budget. |
Watch out for our blog post series over the coming months on sector-specific challenges and the role of internal audit.
Further reading
Adapting the audit plan in turbulent times
