Are you up to date with your annual physical?
Take a moment to consider why you go to your doctor.
Blogs Francisco Aristiguieta, CIA Feb 10, 2021
Or better yet, to consider why you take a loved one to the doctor for a wellness check. Is this just a requirement? An errand? Or is it because you want the peace of mind of hearing that "all is going well, and if there is something not going well it will be found and resolved"?
This is not very different from what internal auditors do:
Internal auditors use all this information to perform risk assessments to determine if we need to perform an audit, the same way a general doctor may decide to refer us to a specialist for a deeper dive. The analogy doesn't end there. The deployed auditor will find what is not going well, recommend corrective actions, and follow up on completion, just as the specialist says, "Take these and call me in the morning." Even when all is better than we had expected, auditors are likely to find and recommend potential improvements, just as a doctor may advise a patient to "remember to eat well and exercise."
So what is the point of this analogy? Besides giving you a way to explain what you do the next time there is a bring-your-parent-to-school day, this analogy should trigger your memories about a doctor you have liked and a doctor you have not liked. Consider what made these doctors likeable or unlikable and decide if this is something you can mimic in your day-to-day work. This can help auditors create a model for implementing positive auditing.
Next time you have an audit client meeting, will you say, "Hello, you look better," "Hello, how is the diet going?" or "You know, you are still overweight"? Will you be a doctor who only spends two minutes per patient? Will you be the doctor who only talks about what is going wrong? Can you deliver bad news without killing the hope of how it can get better? At the end of the conversation, will you make practical recommendations or will you stick to vague clichés?
In summary, will your audit clients respect and seek your advice, or fear and avoid the waste of time of meeting you?
The answer to this question may depend on how you implement your understanding of positive auditing. If you force yourself to say something nice, it may not be meaningful. If you ignore the progress and focus on what is still left to do, you may seem unnecessarily harsh or rude. If you place too much emphasis on the progress, it may dilute the need to keep the ball rolling until resolution. If you don't know what to do, clients will notice, decide you are wasting their time, and stop collaborating.
So what can we do to be more positive?
Returning to the analogy, think of your risk assessments and audits as a doctor visit and decide what would you want your doctor to do and try to do that. For your conversation with the client, consider:
Some people like their doctors, others avoid them at all costs, and frankly, no one likes getting blood tests or other invasive examinations. Regardless of what we think of the doctor, we complete the recommended exams and labs because we know our doctors have our best interest at heart and they have committed above all to "do not harm."
If internal auditors can show our clients this is also our philosophy, then they will be more open to talking to us about their symptoms and changes, tell us how they work around them, and ask us for help. They may even finally give us a seat at the table to discuss what changes they have in mind.
In one phrase, we would have successfully implemented our positive auditing approach: fair, approachable, and truly helpful — like a good doctor.