When I was head of internal audit (HIA) for the pharmaceuticals company AstraZeneca Plc, I became increasingly interested in two key questions about internal auditing:

• how could I be sure the internal audit function was adding the maximum value it could?
• how could I be sure the internal audit function was as efficient as it could be – moving beyond benchmarking, and going back to first principles?

While I was HIA we developed a lean auditing approach and obtained recognition internally and externally for our greater contribution to the organisation, while driving efficiency improvements of around 20%. 

Several years later I started to work as a freelance consultant and took what I had learned at AstraZeneca and applied and enhanced it with my clients. I also started to run training on lean auditing in the UK and further afield. 

In 2013 I was approached by John Wiley & Co to write a book on lean auditing. which was published in January 2015. 

In the process of writing the book I was fortunate to interview Richard Chambers, CEO of the IIA in the USA, and also Chris Baker, technical manager of the IIA UK, as well as over 20 HIAs of leading organisations. 

What follows is a (very) brief overview of  lean auditing and some of the key messages from the book. 

What is lean and what can it offer us?

The label ‘lean’ was first used in 1987 by John Krafcik, who researched the productivity methods of Toyota. He observed that their systems and processes:

• required less investment for a given production capacity
• went from concept to delivery with less time and effort
• delivered products with fewer defects.

He explained: ‘It needs less of everything to create a given amount of value, so let’s call it lean.’ 

Typical benefits obtained from lean ways of working include:

• reductions in: defects, lead times, cost, inventory and waste
• improvements in: customer satisfaction, productivity, capacity, responsiveness and quality.

Lean techniques have been successfully applied in a range of sectors outside of motor manufacturing (eg in white goods manufacture) and in service sectors.  Lean has also been applied to support functions, such as finance, IT and admin, and so lean auditing is really just an extension of this to internal audit. 

Key principles of lean

The overall aim of lean is to maximise customer value while minimising waste.  It is outside the scope of this article to outline all of the excellent tools and techniques lean can offer but key points include:

• specify value from the perspective of the end customer and always ask: would a customer pay for what is being done?
• pay careful attention to what really happens in an organisation (called Gemba or Go Look See)
• aim for a flow of valuable work and a greater understanding of waste (Muda) such as waiting, rework, duplication etc., as well as unevenness of workloads (creating lulls) as well as points of overburden (that create bottlenecks)
• create a culture of discipline to perfect and streamline processes and drive constant improvement through clear measures and other techniques (eg just in time, automation and error proofing).

Benefits from a lean audit approach

The use of lean re-orients an audit function to progressive ways of working, in which there is a clear contribution to the organisational agenda and the things that matter, and a much more dynamic, productive function. 

Specific benefits include:

• the creation of an audit culture that is focused on delivering value add and that recognises the importance of engaging stakeholders on a regular basis
• a plan that is more closely, and demonstrably, aligned with the key value drivers of the organisation
• helping to ‘join up the assurance jigsaw’ of multiple functions doing similar things
• audit assignments that are appropriately resourced, and delivered to time and budget
• audit findings, reports and other forms of communication, that are short, insightful and recognise the wider context of the organisation and the challenges it is facing
• an audit function that is able to highlight appropriate efficiency opportunities, including instances where the streamlining of compliance and control processes would be beneficial
• a function that can clearly demonstrate a positive return on its cost.

Here are some of the insights from contributors to the book: 

Assignment planning

‘Planning an assignment is key because when I see things going wrong, including delays in delivery, it is often because we didn’t think enough up front. It can be as simple as not recognising a key contact is travelling or on holiday for two weeks during the assignment. Unless people have really thought about what they want and sufficiently planned and been rigorous in engaging the business, problems will arise.' 

‘Good audit departments put a lot of effort into thinking about and agreeing the scope of their audits so they are addressing important points; and as a result key findings will then be meaningful to the organisation.'

Testing

‘IIA Standards say that you need to gather sufficient evidence and have sufficient relevant information to be confident about what you are concluding. However, that's often translated into a whole load of advice about how many records you need to look at and how many tests you need to do to substantiate everything, when, in point of fact, if we are focusing on risk and adding value it should be different from that. It’s wrong to stick to sample requirements in a rigid way.' 

Root cause analysis

‘I think that reporting the findings in terms of symptoms and then stopping is ridiculous. If you just report the reconciliations are not being done, without asking more questions that may be needed to identify the root cause, the issues don't go away. You're actually not curing the patient. You're just pointing out the problem.'

Reporting

‘Before we put pen to paper and waste our time, let's write up a list of findings and first of all decide whether we agree these are all important. After that we can look at the findings and the proposed corrective actions and start to see whether there are patterns, so that they can be combined. This approach makes sure that audit reports are more focused, with less need of rewriting. It also helps you to combine points making reports as concise and readable as possible, and also helping stakeholders better judge the relative significance of what is being found.'

One CFO I interviewed explained: ‘I’m looking for internal audit to have a really good business and commercial understanding. You want people to be able to translate the dry accounting and control terminology in a meaningful way that they can engage their internal customers. You don't want them using technical speak – you want them to put them into common sense. This is what it means to your business area or your business unit.' 

Final reflections

My work on lean auditing has highlighted that there is a considerable amount of progressive, value adding, practice in the internal audit profession across a range of countries and sectors.

Lean Auditing is a book that will enable functions to assess how much they are really orientated towards value and productivity, and will likely provide practical tips that can be easily implemented to make further improvements. The book also contains key points for senior managers and audit committee members to consider, since they play an important role in helping audit teams ‘unlock’ the value and productivity improvements that are possible.

Sometimes lean can have a bad name – and I understand why this happens – but I have tried hard to demonstrate in the book that the sensible application of lean principles can be a very energising thing for the audit function and those who come into contact with audit.

In addition I have gained strong support from senior leaders in the IIA to say that following the practices in the book is not incompatible with what the IIA requires; indeed many of the recommendations better reflect what the IIA is looking for, in terms of a more risk based, value-adding approach.

Finally, the book addresses the myth (which I myself believed years ago) that to implement lean ways of working requires a lot of time, effort and consulting support. This is not what my book advocates – indeed I think the reason my approach to lean auditing has gained traction is precisely because of the ways in which it encourages some activities to be cut back, or stopped, and others to be piloted without a lot of time and effort.

Lean Auditing is available from Amazon and Risk and Assurance Insights.

James Paterson – director, Risk & Assurance Insights Ltd