How Your Worldview Impacts Your Audit Approach
Geopolitical risk has been top of mind for internal auditors, especially as the world has watched global border disputes escalate. Focus on this risk has renewed the debate on the inherent nature of people. While I am not trying to reduce the entirety of humanity to a binary view that humans are inherently good or bad, I believe our individual perspective on the nature of people influences our auditing. This article will present two perspectives and discuss how implicit optimistic or pessimistic worldviews impact the outcome of an audit.
History of the Debate
Historians and anthropologists have debated the nature of humanity for centuries. We will use a simplified explanation of two major philosophies in this conversation. First, Jean-Jacques Rousseau hypothesized that humans are inherently good, act out of self-preservation, and reduce suffering for themselves and those in their group. Our second worldview comes from Thomas Hobbes. Hobbes proposed that humans are naturally lawless and need enforced laws to avoid a descent into anarchy. We can summarize this dichotomy as follows: people either work selflessly for the benefit of the group or selfishly for themselves.
Applying the Dichotomous Worldview to Internal Audit
We bring our worldview into the workplace. We have implicit bias developed through experiences, education, and cultural interaction. One result is to see the world and people, like our coworkers, along a spectrum of good and bad.
Two approaches pop out when we consider how this impacts the practice of internal audit. One approach is to take the optimistic view that people are inherently good and will do their best every day. Within a business, controls are in place to help people avoid mistakes, and any issues we find are assumed to result from unintentional human error.
The pessimistic approach views people as self-interested, and controls are implemented to prevent people from taking advantage of the company for personal gain at the organization's cost. In a business setting, controls are in place to prevent and detect errors and fraud, and auditors are in place to confirm the accuracy of the work.
Optimistic Auditing
An optimistic approach to auditing assumes that people typically want to do a good job and work for the organization's success. The actual fieldwork is then spent confirming that supporting evidence is sufficient and appropriate (e.g., relevant and reliable) to substantiate the work management claims to have performed. In this scenario, the outcome is assumed to be correct, and we are assessing management’s ability to prove it is correct. If we find that something is not correct, issues are raised to strengthen the controls to avoid mistakes in the future. For example, management claims to keep the door to a server room locked, so the auditor reviews a log that backs up the claim and tests to see if the door is currently locked. We assume the log was not fabricated minutes before the audit.
Pessimistic Auditing
The pessimistic view assumes that employees intentionally subvert the business’s objectives for their benefit. In this approach, auditors look for discrepancies, presupposing that individuals have tried to cover fraudulent activities. Policies and controls are enforced to prevent individuals from committing fraud and detect those who may have hidden their actions in the past. Issues are presented to strengthen the control environment and punish those who undermined the controls. An example of this would be continuous network monitoring for external breaches. An auditor may review an incident log to ensure the log is indelible, and a network admin could not have manipulated the data to hide a breach. We assume everyone has bad intentions.
Audit Relies on Diversity of Thought
The world rarely fits into neat categories. Internal Audit teams need diverse backgrounds, education, and worldviews to practice “due professional care” effectively. A strong team has various members who can look at the same process through different lenses at different times. Suppose the auditor reviews a process repeatedly. They may miss something, not because they lack skill, but because they approach the area through their own worldview. Another person might view the process differently and come up with a different conclusion.
As we create audit teams with diverse skills and attributes, mixing people with different worldviews can provide a more comprehensive assessment of your organization. If you are curious to map your perspective, many free online tools help measure your optimism/pessimism levels (see IDRLabs.com).
Internal Audit teams can also engage with their Human Resources professionals to take and evaluate personality tests as a group or add an attribute assessment to the hiring process. Understanding yourself and your team and considering how each individual’s worldview impacts their perspective in the audit will provide even deeper insights into the auditing process at your organization.
Additional Resources:
Courses:
How to Become a More Mindful and Emotionally Intelligent Leader
Identifying, Developing & Retaining Top Internal Audit Talent
Having Difficult Conversations in a Remote Work Environment
Avoiding Resistance by Using the Principles of Influence
People-Centric Skills, 2nd Edition
Emotional Intelligence For Internal Auditors
Keys to Maintaining Objectivity and Professional Skepticism