The auditing dilemma

Internal auditing faces a dilemma. As auditors seek to audit or assess their management system, processes and procedures, they are constrained by the traditional methods used to generate the collection of objective evidence needed. 

However, by the time risk or poor performance becomes visible – either as a key performance indicator (KPI), via a one-to-one interview, survey or audit – it is often too late. This is backward-looking data. One might even say, “It’s like trying to drive a car by only looking in the rear-view mirror”! 

The intangible factor 

The current systematic audit methods struggle to measure people’s behaviour, the ‘intangible’ factor – that is, people’s behaviour, which is arguably the most important element, and what really delivers compliance to standards and business performance.  

Behaviour can’t be measured on a spreadsheet or established just by asking questions and reviewing tangible evidence. Yet it is ever-present and often unseen. The importance of measuring behaviour can be summed up like this: 

• Behaviour is a lead indicator and truly predictive to outcomes, risk, compliance and performance. 

• The ability to measure behaviour allows an organisation to view their business through a forward-looking optic. This means the business can measure and manage the ‘here and now’ and not just rely on historical data.  

• Inconsistency in the behaviour of people is directly linked to inconsistencies in delivering compliance standards and performance. This dilemma brings into sharp focus the role of the auditor. As the observers of what is happening, auditors, like all of us, see things from their own filtered perspective.  

Identifying risks to compliance 

Our inability to understand fully the complexity of how businesses really operate, and the many nuances within them, reduces the ability to consistently identify risks to compliance, effectiveness, efficiency and, ultimately, business results. This reduces audit effectiveness, consistency and value from the investment made in internal auditing and third-party certification.  

"The current systematic audit methods struggle to measure people’s behaviour, the ‘intangible’ factor, which is arguably the most important element."

Ian Rosam, Chief Product Officer at DeepFathom

Behaviour is a lead indicator of risk, it’s indicative. We can change what is the objective evidence we are looking for, as well as its impact on compliance and results, by working in a similar way to how behavioural scientists use ethnographic research and by using audit methods based on academic rigour, sourced from recognised systems thinking, structured and consistent management science, and social system experts.

It is a forward-looking optic, not a backward-looking one, that provides improved management information. To extend our driving metaphor – we are now driving the car by looking forward through the windscreen – a totally different optic. 

Organisations can now learn about their businesses within the context of four dimensions:

1. Tangible elements of the system, such as policies, procedures, technology and directly observable behaviours. This means the documentation that makes up the management system, for example the technology and tools people use to carry out their jobs, as well as behaviours that an auditor can observe as the task is carried out.  

2. Intangible elements, such as shared beliefs, values, interaction quality and experiences. This means the impact or outcome of how people behave and how this informs the level of risk to compliance and business objectives. These are concerned with the quality of the interaction between people, its experiential objective evidence driven by what people believe – and value. 

3. Tangible and intangible and how they interact together, meaning that nothing is ever totally one or the other in real life. Often, people work in grey areas, depending on the task they are carrying out. In effect, what is tangible and intangible are opposite ends of the same scale. It is why traditional audit techniques are good for collecting tangible evidence, but not so good for collecting intangible evidence in instances when both are needed to create an overall picture of what is taking place.  

4. How these factors evolve over time. What people believe and value, and therefore how they behave, changes over time, based on the internal and external factors that affect the organisation and its culture. Therefore, the impact of that behaviour on effectiveness, efficiency and consistency to delivering objectives and compliance will also change. 

Changing auditing behaviour 

In effect, the four dimensions interrelate. So the dilemma is this: do auditors continue to audit as they always have done? Or, do they embrace the methods that are now available to improve what they do, giving better value for money and a better service to the managers they serve? 

The easy option is to accept the status quo, but, as auditors, the art is to change the way we behave and experience something completely different.