The Creative Side of Internal Auditing
by Larry Sawyer
In a college town near a Marine base, a convenience store attracted both students and Marines. These customers were young and boisterous, and their car radios blasted ear shattering hard rock. The decibels scared off the mature, desirable customers who had more cash to spare than the younger people. The owner of the store could see himself facing not only deafness, but bankruptcy as well.
A stroke of creativity solved the problem. On the roof of the store the proprietor installed a loudspeaker system on which he played the works of Richard Wagner and Johann Sebastian Bach. The rock addicts stayed away in droves, the mature customers returned, and the owner avoided deafness and bankruptcy.
This story illustrates how new combinations can be formulated from concepts already at hand or in the mind - which is what creativity is all about. It is this creative ability that is needed to solve problems. And if internal auditors wish to hold themselves out as problem-solving partners to management, they had better become aware of their innate creativity or learn about creativity and put it to use.
Internal auditors are not often regarded as creative people. According to the unfortunately widespread stereotype, they examine what happened by comparing events with procedures and pouncing on all variances, big and small. They are not seen as forward-looking searchers for new ways of dealing with familiar things. But creativity approaches can often produce audits that are more comprehensive and more attuned to management-oriented reviews and evaluations.
What Creativity Requires
The soil that helps the seeds of creativity to sprout must contain three special ingredients: discontent, observation, and combination.
Discontent means approaching everything with a healthy skepticism - refusing to accept existing practices as the ultimate and always reaching for something better.
Observation means analyzing a task and determining its components and dynamics. Usually this can be done by those closest to the task, those responsible for carrying it out. Too often, managers do not consult those people and thereby fail to employ their creativity.
Combination and "recombination" of information in a variety of ways can transform separate concepts into something new and better. That's what the convenience store owner did. Loud public address systems and the music of Wagner and Bach aren't new; but it took creativity to combine them to meet a new objective.
Techniques for Creativity
Must creativity always employ the "Big Bang" concept? The "Aha" syndrome? The flash of pure intuition coming full-formed from the brow of Jove? No. Techniques have been developed to get the creative juices running and to bring forth practical solutions to puzzling problems.
Brainstorming, one of the more familiar creativity-enhancing techniques, was developed by Alex Osborn, an advertising executive, to make use of the many suggestions that are advanced when people work in groups. During brainstorming no concoction is regarded as too weird or fanciful. Indeed, no criticism is permitted to be leveled against any idea during the idea generating phase, because a useful thought can "piggyback" on a ridiculous one. Only after the idea bag is full is rational thought applied to select the most feasible suggestions.1
A less well-known technique is called synectics and was developed by William J.J. Gordon.2 The synectic approach seeks "to make the strange familiar" and "to make the familiar strange." It renders the strange familiar by analyzing and breaking down the problem to be dealt with and exploring its many facets. It makes the familiar strange by looking at the problem in a new way, turning it inside out and upside down.
The role of analogy is vital to the approach, and a complex of different kinds of analogies are employed: personal, direct, symbolic, and fantasy. For example:
What brainstorming and synectics teach us is that creativity need not rely on flashes of genius or the epiphany of inspiration - on the meteor lighting up the sky. It can be brought about by a chance assignment, or by the need to fill a vacuum. And this is as true of internal auditing as it is of art or science.
But where can creativity be employed in internal auditing? Just about everywhere. For our purposes, however, we shall deal with it in managing the internal auditing department, performing preliminary surveys, developing audit programs, and preparing audit reports.
Managing the Internal Auditing Department
The Standards for the Professional Practice of Internal Auditing hold the director of internal audit responsible for seeing that:
- Audit work fulfills the general purposes and responsibilities approved by management and accepted by the board.
- Resources of the internal auditing department are efficiently and effectively employed.
- Audit work conforms to the Standards. 4
To be sure, growth does not imply increased size alone. It includes gaining greater influence and respect and providing improved service, capacity, and scope. Without growth there is stagnation. And stagnation contains the noxious seeds of deterioration.
Fully aware of the dangers of stagnation, creative directors are not satisfied with being caretakers for their departments. They will set far-reaching objectives that look to the growth in stature of the department, that seek to provide improved assistance and service to managers at all levels, and that will help improve the capability and professionalism of the internal audit staff.
And that's not all. Rather than merely engaging in high-blown rhetoric, they ask their people to set forth specific goals and tasks that will turn the objectives from idle dreams to concrete accomplishments. The following examples illustrate some of the creative things one internal audit department did to help make the department a leader in the profession:
At a time when statistical sampling for auditors was little more than a gleam in daddy's eye the department set a goal to develop a user-friendly manual on audit sampling. The task was to make statistical sampling understandable, usable, and effective. Instead of arcane and abstruse language and formulas, it was designed to use simple guidelines and tables, and to make statistical sampling a familiar concept for use in any audit to which it could reasonably be applied.
The task was carried out; and the fact that The Institute of Internal Auditors adopted it for its seminars in statistical sampling underscores its value to the profession.5
Another creative task was to develop a style manual for auditors. This project was designed to summarize the basic rules of grammar, punctuation, and syntax applicable to internal audit reports. All the illustrations related to internal audit. The result helped eliminate tedious arguments between auditors and audit supervisors on matters of syntax and parts of speech, employing clear examples to guide the audit teams. This manual, like the sampling manual, was adopted by The Institute of Internal Auditors.6
These publications resulted from creativity in action. They represented the ability to formulate new combinations from concepts that were already in existence.
Performing Preliminary Surveys
The purpose of the preliminary survey is to provide an overview of the operation to be examined. The central idea is to get what's important and get it fast. It precedes the audit program and, depending on how artfully it is done, it can make or break such a program.
The preliminary survey does present hazards and challenges. It can create hostility if it is not performed with care and with empathy for the problems and difficulties auditees are experiencing. Results of the survey can be erroneous, because it is hard to question a great many people and record accurately and with proper selectivity what they had to say. It can be highly expensive because of the numbers of activities and people that must be dealt with in large operations.
The minimal approach to the preliminary survey is for the internal auditors to go on a fishing expedition by asking random questions of anyone within reach. The professional approach is to know what questions to ask and from whom to ask them, to gather information rapidly with the least disruption of the auditee's activities, to gain respect for the auditor's craft, and to develop a good relationship between auditor and auditee. This may require novel techniques. Here is an example of the creative approach to a preliminary survey.
Internal auditors were assigned to the audit of a large research and development (R&D) division, one that had never been audited before. This was the auditors' first experience with such an operation, but they approached it creatively.
Their initial step was to determine the standards of performance for a research and development organization. This they gleaned from current literature, from discussions with scientists and engineers in other organizations, from representatives of the academe, and from the procedures written by the R&D division itself. To lift the inquiries from an auditing to a management level, the auditors translated the 30 resulting standards into questions, which were listed under the four headings of planning, organizing, directing, and controlling. The following are examples of the questions:
Planning: What are the objectives and goals of the R&D division?
Organizing: How are people involved in R&D work informed of their responsibilities and authority?
Directing: What action is taken to encourage open and frank exchanges?
Controlling: What forms offer feedback are used to help the director of R&D and his managers see that goals are met within allocated budgets? Who is responsible for deciding on the size of the budgets, and what input is used for making the decisions?
The director of R&D agreed to have these questions answered by his own staff people. The answers turned out to be complete and well documented. The internal auditors made such additional inquiries and verifications as they considered necessary in order to satisfy themselves about the completeness and propriety of the auditees' responses. The audit started off in a collegial manner and proceeded through programming and fieldwork in much the same way. Under the creative approach used, the preliminary survey was quick, economical, and effective. Where it disclosed problems, the auditees themselves proceeded to take corrective action after discussion with the auditors. Creativity paid off.7
Developing Audit Programs
The audit program is a road map for the proper collection of information. It provides a series of analytical steps or procedures for auditors to follow. If the program is unimaginative, it will result in a pedestrian audit. It will bring about the expenditure of many expensive audit hours without producing much of real value. But if it is thoughtful, properly focused, and goes to the heart of the operation being audited, it can produce an economical, useful audit.
As previously mentioned, the unimaginative internal auditor will be concerned with what was past, comparing events with written procedures and standards, and proudly underscoring variances. But creative auditors will take a fresh look at events. They ask themselves: What are the objectives of the operation which we are about to examine? They are not interested in the self-serving objectives set forth in published statements of authority and responsibility and designed to puff up the activity, but in the true objectives.
In other words, what is the operation supposed to accomplish; what does management expect of it? What are the risks that lie in the way of reaching the objectives? What are the means of control that either exist or should exist to avoid the risks and meet the objectives? And only then, decide upon what events are to be examined, what audit steps are to be taken, and what tests will be made to see whether objective views are being met? This calls for creativity - combining familiar concepts into a new and better conception. The exhibit on the next page provides a few programmed steps taken from such an audit program for the audit of procurement operations.
This is but one approach to creating new forms of audit programs. But this one is worth considering because it approaches the audit in the same way that a senior manager would: concentrate on the more serious risks. Determine how to protect the enterprise from harm through appropriate controls. Develop a programming system under which the risks can be rated in terms of seriousness, and make sure that the more serious risks are considered first.
Many internal auditing organizations have adopted creative ways of carrying out audits. For example, one organization developed "Penetration Audits," an effective program for high-risk audit subjects. Auditors process fraudulent invoices, orders, credit charges, and similar documents through the system to test the controls and determine whether improper transactions will indeed be rejected. To avoid an improper use of the tests, top management is informed of them-but not of their timing. Because of the sensitive nature of this program, the director of auditing and his managers monitor all such tests closely.
In another case, a company had completed a large, complex plant that was scheduled to go into operation. Senior managers asked the internal auditors to review the plant's systems and methods for greater economies and efficiencies. Instead of checking procedures against practices - the common approach - the auditors embarked on a creative program. They asked their top management to make contact with other companies that had similar plants, also recently completed, so that they could review their systems.
With these impressive introductions, the auditors were able to meet high-level officials in a number of comparable organizations. There they learned what was good and desirable in the plants they visited. Comparing those systems with the ones in their own company, the auditors were able to identify at least a dozen significant improvements that could work just as well in their own backyard.
These improvements called for major readjustments in existing systems. But because both operating and senior management had been involved in the audit approach, there was no problem in having the recommendations implemented. And especially dear to management's heart were cost savings that ran into the millions.
Preparing Audit Reports
Audit reports and findings present the auditor with a rare opportunity to seize management's undivided attention. Management's views of its internal auditors are strongly colored by the impressions gained by reading these communications. But hazards block a clear view of audit accomplishment. Internal auditors are not noted for the compelling excellence of their writings. Moreover, they are often trapped by conflicting needs of managers at the various levels of the enterprise.
Some internal auditors, heeding senior management's pronouncement that it is concerned only with those matters on which they must take action, simply restrict their reports to a recital of deficient conditions. These may satisfy the CEO and the CFO, but they can create resentment among operating managers. Those managers complain that such reports give senior management an improper perspective on the accomplishments of the operation. This may result in hostility and lack of cooperation in future audits, hindering or barring the way to any problem-solving partnership between auditors and auditees.
Similarly, audit findings can be written in such a way as to show the internal auditor as a hero and the auditee as incompetent or worse. Also, the tendency to show senior management what sterling work the auditor accomplished can produce findings that cast blame instead of building guideposts to improve operations.
Creativity is the key to solving these dilemmas. Some examples of creative reports and findings follow:
One internal auditing department exercised creativity by eliminating audit reports altogether, while still maintaining communication of findings and corrective action to senior management. As auditors developed findings during the audit, they kept operating managers informed of any trouble spots and discussed the need for and nature of corrective action. At the end of the audit, the operating managers developed an action plan with the guidance and assistance of the internal auditors. This plan described the weaknesses that the auditors had identified, and set forth the corrective action taken or to be taken. If an operating unit did not recognize a needed improvement or failed to take required action, the auditors asked that unit to present the internal audit results to the next higher-level of management. The auditors did not permit significant control weaknesses to persist without receiving higher-level attention.
Operating managers, not the internal auditors, wrote the "audit reports." But the internal auditors monitored any action taken or needed. Proponents of this system maintain they save 30% to 40% of audit budget by not having to prepare audit reports. The burden on the auditee is not increased because no response to an audit report is needed.8
But even when internal auditors are required to write the so-called negative reports, they can take the sting out of them and reduce the basis for hostility. In a prominent place at the beginning of such an audit report they can insert a paragraph which puts the audit findings and conclusions in perspective, avoiding an unrelieved parade of deficiencies. What they do, in effect, is encapsulate the results of the entire audit in that paragraph, giving balance to an essentially negative report. Here is an example of such a paragraph.
Conclusion Creativity is not reserved for the arts and sciences. It is needed in our profession as well. But it will never be tapped if we do not develop a divine discontent with what we see and if we fail to search for new ways of solving the problems which we identify or which management presents to us. We can offer a new presence to the business community - as creative problem-solving partners to managers at all levels.
2 William J.J. Gordon, Synectics (New York: Harper and Row, 1961 ).
3 J. S. Dacey, Fundamentals of Creative Thinking (Lexington, MA: D. C. Health and Company, 1989), p. 127.
4 Standards for the Professional Practice of Internal Auditing (Altamonte Springs, Florida: The Institute of Internal Auditors, 1978), General Standard 500.
5 Sampling Manual for Auditors, by Lockheed Aircraft Corporation (The Institute of lnternal Auditors, 1967) and Supplement to the Sampling Manual for Auditors, by Lockheed Aircraft Corporation (The Institute of InternalAuditors, 1970).
6 P.E. Heeschen and L.B. Sawyer, Internal Auditors Handbook (Altamonte Springs, Florida: The Institute of Internal Auditors, 1984).
7 L.B. Sawyer, The Manager and the Modern Internal Auditors (New York: AMA COM, American Management Association, 1979), pp. 23-26. 8Robert Doll, "Is the Traditional Internal Audit Obsolete?" Internal Auditing, Summer 1985, p. 13.
Reprinted from Sawyer's Words of Wisdom
The IIA Research Foundation