| When you are assigned a new audit, what are | | | | that has never been audited and your supervisor |
| some of the first things that come to mind? Most | | | | asks you how the audit is going, which answer |
| likely the word 'Planning' comes to mind, and most | | | | would you rather have? |
| Audit Departments love spending time with the | | | | 1) "I've been planning the audit for several days |
| traditional planning approach... | | | | but I'm almost done with the planning phase and |
| Ready (preliminary preparation and planning) | | | | will begin interviewing management and testing |
| Aim (more brainstorming and planning) | | | | really soon."or 2) "I've started the audit by |
| Fire (performing the activity) | | | | outlining a few key areas to focus in on, and after |
| You say, "what does the title of this article | | | | interviewing two different managers, I was able |
| mean?" In this article, you will find information | | | | to obtain valuable information from them that has |
| about the Ready, Fire, Aim approach that can be | | | | helped me determine areas of higher risk that I |
| used with new audits. | | | | previously did not consider. In addition, I do see |
| Imagine being lost in a forest and you are only | | | | the likelihood of audit findings with |
| handed a compass and only know that you are | | | | recommendations as a result." |
| supposed to head north, you must be out of the | | | | If YOU cannot perform an audit efficiently and |
| forest in 24 hours, and you cannot see beyond | | | | expeditiously, how are YOU (and the Internal |
| 50 feet. Since you cannot see more than 50 feet | | | | Audit Department) going to have a leg to stand |
| in front of you, the best thing to do would be to | | | | on when you're recommending another |
| start walking north and deal with obstacles as | | | | Department/Division perform their work more |
| they come. If you just stand there and wonder | | | | efficiently and expeditiously? This simply will not |
| where the obstacles are, you run the risk that | | | | work because the Internal Audit Department will |
| you spend too much time planning, and not | | | | be viewed by Senior Management as a |
| enough time walking (otherwise stated, spending | | | | "hypocrite" Department. Essentially, the Internal |
| too much time and resources getting ready and | | | | Audit Department will have shot itself in the foot |
| aiming). Obstacles such as ravines, cliffs, and | | | | because they are not practicing what they preach. |
| rapidly flowing rivers, cannot be known until you | | | | One of the first mistakes I made as a new |
| start walking north. Then, when the obstacle is | | | | auditor was over-plan. Over-planning, I've found, is |
| reached, you will need to make the proper | | | | the enemy of progress. If, before the game or |
| adjustments (to scope) depending on what you | | | | during the game a basketball player plans all of his |
| 'find.' | | | | shots that he wants to take, but takes none of |
| The reason for the Ready, Fire, Aim approach is | | | | them, the results on the ESPN highlights board will |
| that many times a "new" audit shows up on the | | | | be an obvious, Zero Points! for that basketball |
| Audit Schedule, the individual performing the audit, | | | | player. |
| no matter the experience or credentials achieved, | | | | In-depth planning is for the Annual |
| cannot know precisely what the problem areas | | | | Risk-Assessment process that involves, audit |
| are until some work is complete. Just like in the | | | | staff, senior-level Internal Audit Management and |
| forest, you must first begin walking before you | | | | Senior Management (and of course the approval |
| identify the problem areas/obstacles. This is not | | | | of the Audit Committee). Over-planning is the |
| to say that no planning should go into an audit, | | | | enemy of progress.5 |
| rather, once some basic plans are mapped out, | | | | A majority of employees of a company fall into |
| start heading in that direction. | | | | two categories: |
| In order to be successful using the Ready, Fire, | | | | In-the-box thinker: |
| Aim approach, you will need to think of the Audit | | | | In-the-box thinkers are the death of sound audit |
| Program as a "continuous" Audit Program. What I | | | | recommendations and profitable business solutions |
| mean by this is, start out in a known higher-risk | | | | because they don't see beyond the micro-view of |
| area of the auditable entity (interview | | | | what they are doing. When this type of thinker is |
| management in this area) and then, more times | | | | performing work, they cannot see outside of their |
| than not, you will start to have a better idea of | | | | own box, therefore, they are not visionary |
| what is most important to the audit vs. just | | | | minded. Instead, they are the employees that are |
| writing the Audit Program and beginning your | | | | paid to do precisely one job and that job only. No |
| sampling. By using the "continuous" Audit Program | | | | significant business recommendations come out of |
| approach, the scope will reveal itself rather than | | | | this group of thinkers. |
| spending value time and resources determining | | | | Out-of-the-box thinkers that just Go: |
| what the scope should be. In addition, if all your | | | | Internal Auditors should be out-of-the-box |
| time is spent planning, what time will you have | | | | thinkers. What do companies like Google, Home |
| when you need to develop audit findings? | | | | Depot, Meijer, and Walmart have in common? All |
| Probably none. If you have no time to develop | | | | of their founders were visionaries. Google, the |
| audit findings, you will have no time to make | | | | largest and most popular search engine in the U.S. |
| sound and profitable audit recommendations. | | | | Home Depot, the #1 in their industry and #2 of all |
| I have had some of the best scope changes take | | | | retailers in size. Meijer, who pioneered the |
| place as a result of interviewing management first. | | | | supercenter concept, and last but not least, |
| If management is cooperative with Internal Audit, | | | | Walmart, the #1 retailer in the world. None of |
| many times you will extract "problem areas" and | | | | these companies have non-visionaries at the helm. |
| find that your initial risk assessment may have | | | | Recommendations by nature are out-of-the-box |
| been off. And what Auditor wants to admit they | | | | suggestions and opinions that promote profitable |
| missed a particular area with significant audit | | | | change and keep the business a "going concern." |
| findings. No Audit Program should be set in stone. | | | | However, the above information is not based on |
| In a "continuous" Audit Program is where the | | | | opinion, rather, first-hand experience, as I have |
| most significant audit findings exist, as you will be | | | | tested this approach out many times on brand |
| more capable to adjust the scope and adapt as | | | | new audits. IT DOES WORK! |
| the audit progresses. What is "value-added" about | | | | My Solution to be an Expeditious Internal Auditor: |
| a program that is set in stone? Although you are | | | | Ready, Fire, Aim! ... in that order. |
| giving assurance based on what was tested, it's | | | | Try this approach and you will not only get the |
| what is not tested because the Audit Program is | | | | most important business issues identified quicker, |
| set in stone that should make you wonder. | | | | but the positive results of taking these actions will |
| If you have been assigned an audit of an area | | | | be felt sooner. |