8 - We Always Think in the Context of Big Picture

~ We Always Think in the Context of Big Picture ~

The landscape we operate in is big. It is a lot for any one individual to fully understand at any given moment. However, collectively, as an audit function, we must understand the big picture in order to be effective with our coverage. We must divide and conquer. Thus our teams, and individuals on the team will learn and continuously understand their portions of the audit universe. The understanding of these portions will bring our department a comprehensive understanding of the entire universe of risk we cover, the Big Picture.

So what is the Big Picture? It consists of many components, many components that have direct and indirect impact on the risk and control environment, and there are many ways to view the picture.

Externally, there are nation states, lawmakers, laws and regulations, and the regulators that enforce them. There are macro and micro economic climates and shifts. There are industry trends, competitors, potential customers, and customers. There are geographies and localities where our business operates and provides goods and services. There are partners, affiliates, subsidiaries. There are vendors and other service providers. There are criminals and their ever evolving methods of committing theft and fraud. Technological advances are endless, and continue to evolve, and will continue to shape how our business operates.

Internally, there is incredible vastness to account for. There are senior levels of management who set strategy and drive implementation of change. There are multiple levels and mechanisms of governance to oversee execution, operation, and risk. There are numerous business functions on the organizational chart, each of which have numerous processes to deliver their value. Value chains cut across multiple functions. Numerous functions! Strategy, Sales, Marketing, Procurement, Accounts Payable, Accounting, Finance, Human Resources, Risk Management, Information Technology. This is just scratching the surface, as many of these functions will have several sub functions with specialities and specific expertise. Processes under these functions are vast, and have significant importance, though some more important than others. They must all have their own strategies and operations. They must budget, track implementation, and manage risks. The must hire and continuously develop their people. And let’s not forget people. Many different people, cultures, personalities, and emotions. We They must interact well with other functions as part contributing effectively to the larger value chain provided to our clients.

Make no mistake, we must develop and maintain our knowledge of this big picture. We must take account of all of this, both externally and internally. We must also take both a micro and macro view. Detailed understanding of the micro is necessary to understand the macro. Also of necessity is to understand the relationships and interactions between the external and internal functions. Far too often is this ignored, leading us to focus on the wrong things. Find me a declining global economy, and I will find you shrinking budgets, cancelled strategies, and decaying operational processes. I will find you important processes with no investment or funding, and accelerated entropy.

Even during the most expansive of economic climates, we cannot ignore the relationships between functions, and the overall value chain. The lifeblood of any organization is the “whitespace” between its functions, and it’s here where we will find many clogged arteries. There is no shortage of examples: Clients want product A, and we are building product B. Marketing is targeting the wrong audience with the wrong value proposition. Technology is taking too long to build a new strategic system because Human Resources hasn’t been able to source viable engineers and and the risk function is not happy with the security of the solution. Everyone is in their own world, doing things they think is important for their department, but is of little, if any significance to the firm and its clients.

And then there is us. The Internal Audit function, operating in this incredibly complex and vast universe. What are we to do?

We must map this out. We must map out our universe and the macro and micro levels. We must understand the the relationships of these levels, as well as the relationships between components. We must map out the lifeblood of the organization. And the work we do is to help keep that lifeblood flowing in a manner that is expected by our key stakeholders: our clients, senior leadership, regulators, and others within significant skin in the game.

All the work we do must be based on this understanding of the lifeblood. We must leverage every auditors knowledge of this universe to make the best decisions about where we focus our energies. Its the difference between spending time on clearing a blockage in our heart and trimming a fingernail.