Mind of Jacka: Even Nostradamus Couldn’t Predict Today’s Risks

As I write this, COVID is no longer the number one topic on everyone's lips. The tragedies and atrocities occurring within the Ukraine are repulsive and heart-breaking. It is impossible to understate the courage of these people as they withstand this unprovoked assault. And it is incredible to see what they are accomplishing in the face of overwhelming odds.

The effect of the war on our lives pales in comparison, but we must still recognize and respond to its global impacts. As human beings, we have to understand what is occurring and be ready to make our own sacrifices. And organizations must ensure they are appropriately responding to a new, new normal.

Of course, this is hard to do when organizations are just now picking themselves up and dusting themselves off from the two-year, smack-upside-the-head of COVID. I'm guessing a fair majority of your organizations were collecting the pieces, trying to get back to the old normal, trying to define the new normal, looking no further than the bloodied nose on their own face, and hoping against hope that they could spend their time worrying about the familiar financial/cyber/culture/ESG risks we were all just starting to get used to.

I am further guessing that most organizations, when it came to looking ahead to 2022, were a lot like the magazine. It included risks such as climate change, U.S. political instability, China, ESG, the economy (okay, the magazine got that one right), regulatory changes, and a number of specifics related to our pulling ourselves up by our COVID-infected bootstraps. Nary a war to be seen.

As my father always said, "To make God laugh, make plans." (And yes, I know this quote is attributed to others, but I heard it from my dad, so I'm giving him the credit.)

I am not trying to pick on this magazine, just as I am not picking on any organization that did not have "war" as the number one risk for 2022. In the same way COVID snuck up on us, there was almost no way to predict the new cataclysm that was about to occur. In fact, I am not really saying that the risks identified are not still relevant and important. However, it reinforces the idea that internal audit should have a key role in ensuring organizations are actively searching for new and unforeseen risks and ensuring organizations have a process already in place for adapting to newly rising risks.

There's another aspect of all this that is more directly related to how we do our work in internal audit.
And that is: Is our approach to risk assessment and its impact on planning becoming one with the dinosaurs, dodos, and doilies?

To start answering that question, let's talk about Paula Poundstone.

Ms. Poundstone is one of the great comedic talents of our time. You may know her from her award-winning standup specials, as a regular panelist on NPR's "Wait, Wait…Don't Tell Me!" or her podcast "Nobody Listens to Paula Poundstone."

She is often referred to as an "observational" comic, but this understates her talent. Go to one of her shows and you will see an interesting approach. Of course, she comes prepared with material to be used in the act. And you will hear it in the opening, the finale, and as foundations that help the night progress. But during most of the show, she just talks with the audience. Starting discussions with the most basic of questions ("What's your name, where are you from, what do you do for a living?"), she builds laughter. Her spontaneity, her improvisational abilities, and her flexibility in adapting to any situation results in some of the funniest material you will ever hear.

And that is exactly the way internal audit should do its job.

No, I don't mean by telling jokes (although I will suggest you check out the book "Humor, Seriously," which discusses humor in business and how to adapt it to your humor style). I mean that when it comes to planning, we should have a potential beginning, finale, and foundations but also embrace spontaneity, improvisation, and flexibility.

Let me explain. I believe Ms. Poundstone goes into every job with a plan. But it is a plan that allows for improvisation and adaptation. She has a core understanding of what she will do during the night — in some cases, the specific stories to be told. But she uses those merely as a framework and a springboard for the real work she will accomplish.

Similarly, we know the basic work that needs to be done. We've identified the areas where we need to spend our time. But we have to be ready to immediately change direction when things change.

And things will change.

In fact, here's the mindset every one of us needs to adapt. When we get to the end of an audit, rather than asking "What is the next audit?" we should be asking, "What has changed and where do we need to go now?" It could be that nothing has changed; doing something different may not be required. But there's a good chance something has occurred, and it is time for the department to improvise and adapt.

I've talked with a number of audit shops about how they approached 2020 and COVID. And it pains me to say that some did not change their schedules — that they didn't adjust their risks as the world was changing. Now we sit in 2022 and another significant even is happening. Have you adapted, have you changed, have you improvised?

It should be obvious, but we must be prepared for the unexpected, the unimaginable, and the things we never thought of. And, as some famous boxer probably said, we must watch out for that left hook. That's the one history has shown will catch you when you aren't looking.

Are we looking? And are we flexible enough to adapt when we realize it is coming our way?