Five Things Internal Auditing Has Taught Me About Human Nature

As a young internal auditor, I concentrated extensively on learning the technical skills of the profession. I learned early in my career about the importance of developing an audit plan at the beginning of every engagement, documenting the results of the audit, and crafting a well-written audit report. I also learned how important it was to understand the operations/business of the areas I was auditing. All of these skills served me well throughout my career. However, I can honestly say that the technical skills were easy to learn compared with the “soft skills” that I needed to hone in order to be successful.

Over the course of my career, I have led or served on scores of audit teams focused on an incredible array of industries and operations. As I did so, I began to notice that regardless of the function or operation I was auditing, there were common threads in the way the people behaved. Overall, the hundreds of professionals over whose areas of operations I have audited have been good, decent, and hard-working professionals. Many of them had thankless jobs at which they toiled tirelessly without complaining. However, I have learned some things along the way about human nature that might be useful for those who are starting out in their careers and even for those who are seasoned internal audit veterans (and want to compare their observations).

Smart People Can Do Dumb Things

It is easy for internal auditors to be intimidated when auditing an area led or populated by intelligent and seasoned professionals. They often can dazzle you with their deep knowledge of the operations and appear to be unassailable. However, I frequently have observed that some of these bright folks have done some pretty “dumb” things. On occasion, I have noticed that their decisions to violate or circumvent internal controls were intentional decisions based on their belief that their experience or expertise didn’t warrant the kind of controls they were being asked to follow. Don’t assume that smart people always do smart things.

Good People Can Do Bad Things

When we think of fraudulent acts, we tend to associate them with nefarious characters who intentionally set out to do something bad. However, many of the frauds I discovered or reviewed during my career were committed by otherwise good and decent people who somehow lost their way. These were people who often were under extraordinary financial or personal pressures outside of the workplace. Many times, they rationalized their initial actions and didn’t intend for the frauds to morph into something as big as they eventually did. As internal auditors, we should not assume that everyone is doing bad things. However, we must maintain a level of professional skepticism and remember that even good people can do bad things.

People Like to Be Recognized for Accomplishments

As internal auditors, we are trained from the outset that the purpose of our work is to provide assurance on the effectiveness of risk management, internal controls, and governance. Yet, we often bolt straight for the findings on inadequate risk management, internal controls, etc., in our final audit report. Many audit reports are crafted with no genuine recognition of management’s accomplishments. It is one of the things that gives us a bad reputation. I have discovered during my career that people are looking for an objective assessment of their areas of operations. They understand that we have a job to do, but seek to at least be recognized for what they have accomplished or done well. Including a “management accomplishments” section at the beginning of an audit report can go a long way toward generating acceptance of our findings and recommendations for corrective actions that follow.

People Don’t Like to Be Surprised

One of the first audits I led taught me a lot about the importance of communicating throughout the audit. My team and I were under a lot of pressure to complete the audit quickly. Following an entrance briefing with operating officials, we put our heads down and went to work. Four weeks later, we presented the same officials with a draft report. They were incensed at what they viewed as being “blindsided” by the results. One of them said to me that he didn’t disagree with the results of the audit, but he sure would have appreciated learning about the problems as we discovered them. In recent years, the importance of communication throughout the engagement has been stressed in audit standards and guidance. Timely communication is important throughout the engagement, in large part because people don’t like to be surprised.

People Like to Make Themselves Look Good

Most of us seek to be recognized for what we do well. While we may recognize our shortcomings or failures, we certainly don’t accentuate them when communicating with others. That is important to remember when conducting interviews during an internal audit. People will speak effusively about things that are working well. However, they rarely volunteer information about things that are not. This is another reason that professional skepticism is so important for internal auditors. Don’t assume that you have been told “the truth, the whole truth, and nothing but the truth,” because people often like to make themselves look good.

This is my short list of things I have learned about human nature in the workplace over my career as an internal auditor. I welcome your thoughts.