Incorporate RCA Thinking into the Audit/Inspection Methodology and Work Programmes

Incorporate RCA Thinking into the Audit/Inspection Methodology and Work Programmes

With audit teams I have worked with, we have moved beyond just bolting on RCA tools and techniques in the audit methodology to integrating key RCA points into the audit methodology and work programmes (e.g. risk control matrices [RCMs]). This can include how to align audit agile ‘sprint’ stages with RCA requirements.

The typical benefits you get are to ‘prune and declutter’ work programmes and make them a better platform for developing insights. Richard Taylor explains his experiences:

‘Work programmes are useful to create a minimum standard for audit work as well as consistency between team members, and over time. But the danger is that auditors think doing a good audit is about filling in templates.

Sometimes you can slip into auditing in “robot mode”; have you ticked the box and completed all the templates? This can easily happen if you have huge work programmes with dozens of key controls and detailed audit tests. It all starts to turn into an exercise of “feeding the machine”. But the important question is whether you have thought deeply about risks and control gaps and their causes, so you can find new angles of attack?

It sounds like a paradox because I am a great fan of discipline during audits, but you need work programmes to permit “out of the box” thinking. Staff need to be open‐minded about the sometimes subtle but important things that others may have missed. And remember that sometimes these key weaknesses lie in‐between departments or functions.'

This frame of mind encourages audit teams to recalibrate the way they think about risk appetite. Damian Finio explains:

‘The quality of internal audit that I have seen in my career has varied greatly. I respect the focus on collecting facts and information in detail, but it's vital this effort is joined up with what matters. To take a simple example: anyone can tell me there is a minor, technical problem somewhere in the business, but whether it really matters is the $64 000 question.

I encourage all the internal auditors that I work with to calibrate their work to the risk appetite set by the board and executive. So, if we have decided that managers can authorise payments below $250 without significant extra checks, then the fact that it could be controlled more if the limit was $100 may be true but is it worth the extra effort? Audit always needs to recognise cost/benefit trade‐offs. Unless there is a major problem they can foresee, they need to respect the tough choices the board and executive inevitably make to have a “fit for purpose” control framework. After all, if you controlled every organisation $1 at a time, you would have no business.'

An RCA perspective isn't just about highlighting gaps; it's about identifying whether adopting best practices would be helpful. Nancy Haig explains:

‘If you have experience, or you have done the right research, you may be able to compare what your organisation is doing to a best practice. That way, if you make an observation, and a manager says, “Yes, but we are compliant,” you can reply, “Yes, you may be compliant, but actually you have fallen behind good practice in this area, meaning you are encountering difficulties that others are not”.

A classic example of this concerns the management of cyber security risks; when you are dealing with potentially criminal activity proactively seeking to find vulnerabilities in what you are doing on a real time basis, sometimes being “good” just isn't good enough.’