Making an Impact

According to Wright, internal auditors normally have a program of periodically reviewing and identifying all major risk areas in the organisation. Then external auditors will come in and, often using the work of the internal auditors, will tend to look at the accounts and systems that impact revenue and profits.

Wright says that as an auditor she used to look for inconsistencies. If five people all said the same thing she'd feel pretty comfortable, especially if she was auditing a project and it correlated with what she'd seen in relation to it. Now that she's on the other side of the fence she undertakes continuous reviews to ascertain exactly what her issues are so that she has no surprises when the auditors do come in. She achieves this, she says, by having a transparent environment, regular lunches with her staff, making sure people tell her when things go wrong, having a reporting system of incidents and through customer surveys.

"If there's anything customers are unhappy with that they might complain to the auditors about, I shall probably know about it anyway because they've said that in the survey. Some of this is culture (see "Cultural Divide", CIO April) and some of it is processes that you put in place to understand whether you're managing your risks properly," Wright says. "You can talk about best practice all you like, but I've never seen an organisation where there is best practice. And if there is an organisation in which there looks like there's nothing wrong, then they're hiding something."

Like Kogekar, Wright believes that an auditor's findings can create a burning platform to get certain things done that might not otherwise get the necessary priority with so many other things happening. "Auditors do follow up and that's actually quite useful because often they'll come up with an action list of things we agree need to be done. We may already be doing them, but one of the benefits of auditors turning up is that you can say to your people or the business that they're coming back in three months time and we need to make sure that those things are all done," she says. "If you've done something you think is really good, you might be able to use the auditors to get recognition for it as well. They say what's bad, but they can also say this is good compared to what others are doing."

However, Wright always insists on reading the auditor's report, internal or external, to ensure it is factually accurate and that she agrees with its business impact, or not, as the case may be. She also makes sure the right people in the organisation will read the report. "Often a report goes up to the board or [top] management and there are inaccuracies in it, or it says that something is serious and really it's not because it has no impact. So it's very important to make sure you have a common view on that or that it's really clear where you agree to disagree," Wright says.