Editorial
After graduating from the London School of Economics, I joined the external audit firm of what is now PwC.
As a very junior financial auditor, my working papers were subject to intensive review by the audit seniors. I remember being told to redo several (in ink) because I had not used the correct tick mark.
While appropriate, there were times I thought it picky and a waste of my time to rework the test documentation. But the likelihood that I would overlook something or fail to test a control properly was high, because I was inexperienced and barely trained. If my error was not detected, it could potentially lead to an incorrect (or at least unjustified) audit opinion on the financials filed with the regulators.
The risk merited the level of review.
Does the Supervision Match the Risk Level?
Over time, I moved up in the firm and the level and type of supervision and review of my work changed.
That’s as it should be. The risk had changed and the value of an intensive review of my work reduced.
For example, as a manager and then senior manager, the partner would ask questions about why I had concerns on the issues I presented. They didn’t review my working papers to confirm my sample size was sufficient or that I had tested effectively.
When I became the leader (CAE) of my own team of internal auditors, I had this in mind.
I tried to hire the best and brightest people with the experience necessary for them to not just perform audits but deliver high value information: the assurance, advice and insight our customers and stakeholders valued. I paid them well and they carried the title of manager. (Most were managers in their prior positions in industry, internal or external auditing.)
With new employees, even though they were managers, I would review their work and asked related questions until I was satisfied that they had covered the significant risks and that I agreed with their assessments.
As they grew in my confidence, my level of review and supervision was reduced — if it didn’t, we had a problem.
I trusted them to perform and deliver.
My assessment of the level of risk of a poor audit was that it was low. The value of an intensive review and periodic supervision was also low.
Timing Matters
Now contrast that with this.
One of the opportunities I love is presenting at a company’s annual internal audit meeting/conference. I have done this quite a few times and enjoy meeting, talking to, and listening to auditors at every level from around the world.
At one, several of the CAE's direct reports, all managers, complained to me about their quality assurance program. They asked that I intervene with the CAE.
They told me that the internal audit QA manager would review audit working papers a month or more AFTER the audit had been completed and the report issued. This affected morale to the point that they were willing to risk the wrath of the CAE and get me involved.
I talked to the CAE and asked what the value of such a post-mortem was, especially when it required revisions to the working papers.
He could only say that it promoted consistency and made sure future audits would meet departmental standards.
I tried to persuade him that the quality needed to be inspected before the audit is finished, preferably before leaving the field, and definitely before the report is issued.
I think he listened.
Henpecking Never Helped Anyone
So where am I going with this?
- The quality of our internal audits is very important, and we need to ensure the risk of a poor audit is very low.
- The level of supervision and review should be commensurate with the level of risk.
- Employee morale is adversely affected by henpecking.
- Think before you require working papers to be reworked. Where is the value?
- Minimize the level of audit report rework. Limit the number of head chefs in the kitchen, and don’t change wording just because you have a different style.
- Make sure every minute of every hour on an audit is necessary to deliver quality information to our customers and stakeholders.
Conference
Sep
16
HR Tech Conference Las Vegas 2025
Register
Conference
Oct
27
Gartner HR Symposium/Xpo Orlando 2025
Register
Do you trust your people enough to get out of their way?
Editor's Note: Read more thoughts on team management and trust:
- The 3 C's Framework for Managing Employee Growth — Discover how to adapt your leadership — from Captain to Coach to Counselor — to foster a thriving, self-sufficient team.
- How to Tell the Micromanagers From the Concerned Bosses — Welcome to Courage Coach, where expert columnist Karin Hurt answers readers' tough leadership challenges. This week: help, I think my boss is a micromanager!
- 8 Steps to Build Greater Trust in Your Workplace — We all know trust is important, but it needs to be built and maintained with a proactive strategy.
Learn how you can join our contributor community.
