Who doesn't like audits? I love them!
Having people turn up with a checklist of questions and requests for information, then sitting with them and being interviewed.
Having all of your closet clutter being laid bare and then they leave, and you are left with a feeling that you have failed and the company department team or yourself have been judged as less than perfect. That is ...if you have ever felt perfect!
I have had the opportunity to sit on both sides of the audit table and have experienced a wide range of responses:
From an Auditee perspective, I have felt as though Auditors have been members of the Spanish Inquisition, who trust no one and every response is met with doubt and further questions, and I have experienced the light touch, "don't scratch too hard", Auditors who accept everything at face value.
From an Auditor's perspective, there have been eager beavers who can't do enough and are so proud of the systems they have developed and the results they are achieving, to the hostile hostages who resent the notion that someone would have the audacity to question their operation.
So what is an audit? Many people perceive an audit as the traditional Internal Audit - a check and balance of historical data to find mistakes and the vulnerabilities that allowed the error to be incurred; intended to manage risk, yet leaves individuals and teams feeling as though they have failed. I choose to look at it slightly differently. For me a quality audit looks at how things are being done, it looks for mistakes and omissions (the same as an Internal Audit), and it also looks at what improvements could be made to existing processes, systems tools and skills to drive optimal outcomes and to improve production and cost efficiencies.
In some recent audits I have conducted, the interviewees asked if they passed! It is a reasonable question, however I choose not to answer with a yes or no because audits are never about just an individual contribution. They are about finding out what it will take to reduce risk and improve value across an operation.
As an Auditee, after my first few audits, I started to realize the extra effort required when an audit was coming up could not be done in the couple of weeks prior to the audit taking place, so I developed a mindset of each month collecting the data that an Auditor would be requesting and keeping detailed log books. It helped that my role was managing the gas terminals custody transfer measurement systems and keeping detailed logs was mandatory, however, I also maintained an Audit Log for information that I felt the Auditor would request. When the Auditors visited, the kick-off meeting would allow me the opportunity to hand over the Audit Pack and state the following, "This is what has gone wrong since the last audit, this is what we have done to correct this, and this is what we are doing to strengthen and improve the systems. Anything else you discover we are happy to listen and learn and will thank you for your expertise." Thinking of audits as one tool in the continuous improvement cycle and avoiding defensive responses resulted in letters of recommendation from visiting Auditors, who included my processes in best practice recommendations.
As my role took on larger teams I realized a quality outcome from an audit needed more than just a detailed Audit Pack, though it helped. It required preparing the operations team to be ready and able to respond to auditors' questions in an appropriate way. I was lucky that I had the opportunity to work with an ex-SAS Warrant Officer who shared with me the Six Ps (if you haven't heard of this it stands for Proper Preparation and Planning Prevents Poor Performance.) Taking this concept and turning it into action was achieved by inviting the selected team who would be audited and holding preparation meetings to educate the team on what the audit was looking to achieve, and how to respond to questions. It also meant anticipating the potential questions the audit team would be asking.
As an Auditor there were audits that were strained to the point of feeling like a dentist (i.e. pulling teeth), so having had the experience of being audited and how bad audits could be, I reflected on what I could do to make audits supportive and provide insights to teams to improve after all an audit requires a lot of time and effort. The following were key objectives I set up to ensure as an Auditor, the department region or team were set up for a successful audit outcome.
Prior to the audit
Engage with the audit sponsor to clearly define the expectations and boundaries of the audit.
Review the company (departments or teams) vision and mission statement and any expectations/policy documentation to support the development/selection of questions.
Build the audit plan; we use our own in-house developed audit software tool.
Seek to receive the requested documents prior to interviews.
Set your interviewees up for success: send all the individuals who will be audited, the questions and a listing of documents (transactional and procedural) to be reviewed.
During interviews
At the start of the interview establish the context and intent of the audit and gain consensus on what is to be achieved.
Ask if recording the conversation and using a transcription tool is acceptable.
Use guidance questions, asking the same questions to different interviewees, in the same manner, to start off the line of inquiry.
Look for ways to explore opportunities to understand the current dynamics of the organization's culture.
Recognize that as an auditor you are not leading an inquisition. Keep the tone of the interview conversational, if it feels like an interrogation you have probably closed many doors to finding potential solutions.
Post interview
Send a thank you message to the interviewees, with some of the common themes that will be reported.
Provide an opportunity for clarification.
Make no promises of change, your role is an auditor. The management teams and executive leadership will determine the direction post-audit.
There are many other aspects that I could detail, however, those above have been proven by myself both as an Auditee and Auditor to deliver a successful audit outcome.
Want to discuss your 2022 Q4 or 2023 audit requirements? Want provide your internal audit team with additional training, tools or coaching? Reach out, a call doesn't cost a thing!