The Way of Pain.

Cooperation is preferred... but for those who refuse to cooperate there is always The Way of Pain.

Although an audit is a painful experience for any sufficiently large or complex organization, the potential benefit is enormous: effective audit produces business wisdom.

1. Auditors have "new eyes".

   To the extent possible, auditors provide independent, objective assessment:

   1. Auditors base conclusions on a state map.

      In general, the state map is established by an independent quality standard or framework, and implemented by an organization's own internal policies and procedures. As a result, auditors have no personal interest1 in the state map, and are able to maintain their independence.

      Everyone who works knows that there is considerable difference between the way things are done and the way things are done. Practically, auditors are unburdened by preconceived notions concerning the state map. Independent of the state map, they have no knowledge of who should have been Responsible, Accountable, Consulted, or Informed (for the fiction that is RACI, for example), or who should have updated documentation, contacted the customer, or revised the drawing.

   2. Auditors base conclusions on facts supported by objective evidence.

      An assertion is a declaration that a statement establishes a fact. An assertion becomes a fact when independently verified and supported by objective evidence.

      An audit is useful for determining whether something is, or is not, a fact. In this way it is like an encyclopedia.

   3. Auditors are independent of the organization being audited.

      Free of the need to maintain good working relationships with people who should not be in positions of power or influence over others, and conflicting organizational loyalties, auditors are able to identify the reponsible party when deficiencies are noted.

2. A professional audit is not like an Internal Revenue Service (IRS) audit.

   IRS auditors are auditors in name only, and should correctly be referred to by some other title, such as "accountant for the prosecution".

   If you are audited by the IRS, you are presumed to be guilty in the absence of evidence conclusively proving your innocence2. An IRS audit is the equivalent of being convicted in absentia of tax evasion, the only defense for which is to conclusively prove that the federal government is not entitled to the money the IRS asserts the federal government is entitled to, and by which you are penalized for complying with the law or not complying with the law more, depending on your perspective3.

   For an auditor, this would be equivalent to reporting findings or conclusions in the absence of facts supported by objective evidence, and then demanding the organization conclusively disprove the findings or conclusions, i.e., prove a negative. Then, when the organization successfully defends itself, invoicing them for their compliance4.

3. Auditors are not policemen (or -women).

   A professional audit is not like a police investigation. With certain exceptions, for example, for Certified Fraud Examiners, you are not under suspicion of having committed a crime. An auditor is not a policeman, and does not enforce the law, despite the fact that in some organizations the audit process is used punitively to enforce, rather than evaluate, compliance.

4. A successful professional audit is like having a private investigator work for you.

   Giving an auditor access to your company is like inviting a stranger to critique the contents of your bedside table or medicine cabinet. It requires detachment, and the willingness to be told that a problem or problems exist, however minor (i.e., receive findings), and the auditor's conclusions. Note that this does not mean that you must agree with the auditor, or that a problem exists simply because the auditor asserts a problem exists.

   In addition, the purpose of an audit is not to fix problems (resolve findings), but to identify problems and potential problems for resolution by management through appropriate corrective and preventive action, respectively.

   So if you want to know if Purchasing is making effective use of your information technology infrastructure, you hire an independent auditor. The auditor investigates your organizational structure, identifies key personnel, asks what specific attributes you want to evaluate, and requests copies of all documents which control the work (if any). In other words, the auditor takes a snapshot of your organization, any existing relationships, and your requirements, from whatever source. This is the expected state of the system, the state map.

   He then evaluates your organization, or a facet thereof, and notes the ways in which the real state diverges from the expected state5.

   The differences allow the auditor to identify findings. As a more detailed picture of the organization's compliance with the state map emerges, the auditor forms conclusions based on the findings, and identifies the responsible party or parties. This causes a problem: some people refuse to cooperate with the auditor.

5. Some people refuse to cooperate with the auditor. This is The Way of Pain.

   Some people refuse to cooperate with the auditor. For example, some do not want the boss to know how poorly they manage the company's resources, some don't care, and others refuse to cooperate because they have been an unfortunate participant in an audit that was not conducted professionally.

   No matter the reason, the fact is that some people simply will not cooperate with the auditor. Alternate methods of persuasion are required.

   Auditors maintain a professional demeanor, for example, to calmly reassure people who have prior experience with unprofessional auditors. However, because he or she is independent of the organization being audited, the auditor has control only over his or her own actions, and cannot control the actions of others.

   The one thing that most people fail to understand is that they bring increased scrutiny on themselves by offering half-truths as an explanation for personal or professional failure and by attempting to divert attention away from themselves or their organization. For example, the most common (and unsuccessful) strategy I encounter is to point out deficiencies in "the other guy's" work. Most people fail to remember that they are "the other guy" to "the other guy". The other guy, upon discovering that you attempted to deflect blame onto him, is usually only too willing to share the other side of the story with the auditor, that is, the facts you neglected to mention. By resolving any differences, a skilled auditor can determine what actually happened, or happens, that is, what the facts are. Anything the auditor can't resolve is documented in a report for management to resolve.

   This is The Way of Pain.

   It's usually the only thing people involved in an audit remember. They say the auditor "pitted them against each other". People involved in an audit almost never connect their lack of cooperation to the chain of cause and effect which leads an auditor to conclude there are differences to resolve, or to the increased scrutiny that usually results.

Endnotes.