(This post contains a fair amount of irony. And some school Latin.)

Why is it that management does not implement the corrective actions in our audit reports?

writes an Internal Audit VP in a post on LinkedIn.

Yes, why in fact is management so dumb not to properly value and apply the words of wisdom the auditors wrote down in their report for them? Despite the fact that our auditors applied the correct technique for writing a proper observation:

If we show the expected practice (Criteria), the issue (Condition), source of the problem (Root Cause), the negative impact (Consequence), and the magnitude (Rating), why is it then that management does not take corrective action?

All done according to the book. Condition, criteria, cause, consequence … and even a rating (most probably according to an elaborate qualitative risk evaluation methodology). Anyone in their right mind who can read and think logically simply must get it and implement corrective action (meaning those recommended by the auditors). But they don’t.

Don’t they get it? Are they not “risk and control aware” enough? Do they simply not care?

The author of the post answers his question with 6 hypotheses, 5 of which are – positively noted – self-critical:

1. Maybe: We make recommendations by/for ourselves. Suggestion: Develop corrective actions collaboratively so they are pragmatic and the client agrees with them before the report is issued.

2. Maybe: We don’t explain the magnitude of the problem or the consequence. Suggestion: More details explained clearly.

3. Maybe: Management has grown tired of chasing the symptoms we write about. Suggestion: Root cause analysis.

4. Maybe: Our tone is too accusatory. Suggestion: Write more carefully so we are not seen as adversaries.

5. Maybe: We are focusing on problems instead of selling solutions, emphasizing the past instead of looking at the future benefits. Suggestion: Show them we care, are forward-thinking, and our goal is to help them succeed.

6. Or…maybe, it is them and they just don’t care! Suggestion: First make sure it is not items 1-5!

I have a different suggestion before items 1-5, before any other assumptions:

0. Maybe the auditors didn’t ask enough questions and not the right questions and didn’t listen and try to understand their audit clients enough.

Suggestion: Ask the audit clients for the reasons why. And listen to what they have to say very closely.

Audit comes from Latin audire = to listen. I am surprised how many in the profession are not aware of that.

Look at the “5 maybes” above and what do you see?

• “if we show… why don’t they”

• “we make recommendations”

• “we don’t explain… enough”

• “we write about”

• “our tone”

• “emphasize the past”, “show them”

All expressions are about taking, about sending messages, telling, showing, writing, emphasizing… More a “locutor” (Lat. loqui = to speak) than an “auditor”. Not a single expression of listening and understanding in the list.

How about listening to truly understand first? Maybe…

First seek to understand then to be understood.

– Stephen Covey, The 7 Habits of Highly Effective People