OK. Apologies for the history lesson; it may be information you already knew. However, it's always a good idea for internal auditors to understand how work gets done and how we wound up where we're at. And, in this instance it is good to understand how, for good or bad, Taylor's approach became a foundation for the way a lot of work is still accomplished. Modern management theorists decry much of what Taylor brought forward. But much of it — the good and the bad — still permeates workplaces.
Which brings up the question we should ask often and always, what does this have to do with internal audit?
Well, first, this information could all be used to have a discussion about how internal auditors need to understand business principles — their use and misuse — as we analyze the processes we review. However, there is a bigger elephant in this particular room — understanding how these principles impact the way internal audit works and, relatedly, measures its success.
Taylor laid out four principles in his scientific management approach, the first being that the scientific method should be used to study work and determine the most efficient way to perform specific tasks. As previously noted, the implication is that there is one perfect way to perform any task. And, unfortunately, this is the foundation, in various guises, for the approaches used by some internal audit departments.
Well, you and I both know that, while the siren call of standardization can win over some audit departments, reality is not quite so … perfect. The vagaries of our work, while allowing that there can be better ways to accomplish things, mean that (quoting an obscure song by the obscure group, Goose Creek Symphony) "Every day's different and it's different every day."
The complete standardization of tasks within internal audit is a fool's game. This does not mean there aren't similarities in tasks. But the attempt to standardize approaches will lead to work that just isn't as good as when one uses one's brain. For example, one of my pet peeves is starting an audit — the very first step — by looking at what was done last time. Sure, this is an important part of any preaudit. But if that is your starting point, you have instantly put blinders on the possibilities.
But let's look at another aspect.
As was previously mentioned, what is built into Taylor's approach is that, by having the assessment of the most efficient way to perform tasks, then a measure of success is built for every task. And every employee is measured against it.
And, if we look closely (or maybe we don't have to look that closely) we can see audit departments fall into the trap of "perfect" measures of time for audits, projects, and tasks within every audit. I have seen audit shops that slavishly measure the amount of time spent by the auditors, digging to record the smallest tittle and jot, effectively robbing the auditors of the ability to use their brains in adjusting how the audit is accomplished.
OK, maybe I don't know any audit shop that measures its time down to the pencil strike, the keystroke, the item reviewed, the minutes per question, the length of the interview.
What's that you say? Mayhaps I've gone too far in my suppositions? No, I can't imagine measuring keystrokes (and if your department is doing this, maybe it is best not to share), but how detailed are the measures being used?
You may not measure how many questions should be asked in an interview and how much time should be allowed for each question. But if you track the amount of time each interview takes, are you building an underlying expectation about the "correct" amount of time for every interview. And with that, do the auditors believe interviews should be cut short to meet that measure?
Is there a similar estimate/assumption built into how long should be spent on every test, every walkthrough, every risk assessment, every report? Do you have an estimated amount of time for the audit to be completed? And do those assumptions result in work — quality work — taking a back seat to a stopwatch measure of success?
Maybe it's only tangentially related to this discussion, but I talked to one audit department — a large audit department — that did not establish estimated times for completion of their audits. Nor were they keeping track of their time. I never figured out how they did it, but they were successful.
There is not a word in any of the above that is meant to imply that I do not think you should have estimated times, or that you should not keep track of time. However, I am saying that we have to understand where some of the underlying concepts for keeping track of our time started. And from that understanding, reinspect the way we are doing things.
Much of what is now seen to be wrong with Taylor's theory is what leads some internal audit departments to mediocrity. The audits are not driving the numbers, the numbers are driving the audits.
Sure, have some estimated times established. But don't live and die by them. Know what needs to be done and adjust accordingly. Yes, there are ways to streamline our work and reviews (please, please, please, please, please streamline those reviews — primarily by eliminating them). But there is no magic, efficient way to get any specific audit completed. Successful completion in a timely manner (whatever timely may mean in each case) is one of the things internal auditors are paid to figure out. And mindless timekeeping and virulent adherence to milestones and estimated hours will serve no other purpose than to show success against valueless goals.
Because, ultimately, if our work can only prove its success by the measurements of a stopwatch, then we can be replaced. To paraphrase something a friend of mine says, our value is not in the clickety-click, but in the thinkity-think. And no stopwatch can find the perfect measure for how that is accomplished.
