The popularity of audit assessments
An audit assessment is like an audit, but not really. It takes less time, costs less and is executed by people referring to themselves as experts in a subject matter. These assessments are becoming rather popular. And that evolution is worrying to a “traditional” internal auditor … not as a threat to our own business model, but because it reminds me too much of ratings by analysts. If this is the future of audits and audit findings, we need to be very careful about what comes out of the audits. Because that will be opinion, and not positions based on validated facts and figures. Let me explain why by comparing these assessments to analyst’s ratings.
Analyst’s ratings
How does an analyst develop his ratings? It’s not necessarily a well known or well understood, but hardly a secretive process. You could compare it to a journalist with a track record in a certain sector and based on that track record, assessing an organization active in that sector. Rating agencies bring in an industry or a content expert, ask him or her to do interviews with key people within the organization and analyze available information to form an opinion about the expected future evolution of the organization. Now, are we so naive as to not expect the interviewees to be carefully vetted by top management to provide the analyst with the right information for the message they want to bring tot the market? In addition to the interviews, analysts are provided with information about the company, sometimes strategic visioning about the future of the organization in its sector or sectors adjacent to it. Again, this information is being provided by the organization they are assessing. They compare this, ideally, to market information, and based on their expertise, they come to a conclusion. And this conclusion is rather determining for the financial future of the company they are analyzing.
Am I the only one to see the flaw here? Probably not.
Audit assessments
Let’s compare this to the new trend of audit assessments? How is an audit assessment executed? An organization or its internal audit calls in an expert in a certain subject area who – on the basis of interviews and assessment of a selection of available information – will take position with respect to the area under audit in which he is an expert. He uses his available expertise to come to a conclusion … and the conclusion will be rather determining for the future of the department under assessment …
Comparing this approach to the analyst’s assessment, I don’t see too much difference. As an auditor I mainly see the flaws in this process.
What is wrong with audit assessments?
Audit in general and internal audit in particular is about fact finding and corroborating these facts with other facts and figures to come to a substantiated opinion based on repeatable assessment on all available data, not ignoring any information. It’s about not forming an opinion before all the facts and figures are in. It’s about keeping an open mind. It’s asking to see the thing that quacks like a duck, swims like a duck and smells like a duck to make sure it looks like a duck. It’s being the four wise Indian men who touched different parts of the elephant and NOT coming to a conclusion.
Assessments on the contrary are rather often about ensuring consistency in interpretation by not taking in account facts that don’t fit the preconception and replacing facts and figures by interpretation and expert opinion. And like wolves in the woods, if one of them starts howling, pretty soon you have a concert … not necessarily pretty, not necessarily relevant, but certainly loud.
This is bad … what is worse is that a lot of the expert interpretation is under the assumption that the market, the sector, the process is not subject to disruptive influences. Current reality dictates otherwise. So I very much doubt the relevance of the expertise being brought in to assess as long as that expertise is not open to look for other interpretations and making sure all the facts fit.
Solutions
Let’s be clear, internal audit is not bad journalism. There is to me only one way to ensure consistency and relevance of audits, and that is to make each and every audit about our prime responsibility. We need to be open to the facts and figures. We need to reserve opinion until every cost-effective avenue of analysis has been exhausted. But mainly, we need to design our audit tests for those key aspects we test: existence or occurrence, completeness, accuracy, timeliness … and we need to be open about our approach, and willing to exchange ideas and learn from others. Only then will we be able to do what both analysts and audit assessment experts regularly fail to do: to provide our users with a relevant opinion based on an objective interpretation of facts and figures.
Exploring The Black Box 