The Psychology of Audit

culled from:leaders-values.com

An auditor is guilty until proven innocent
Joan Pastor has worked with both private and public organizations as a consultant, conference speaker and trainer. Her in-depth knowledge reflects over nineteen years of experience in implementation of quality improvement programs, building high performing teams, developing the "customer" orientation within and outside the organization, change management and conflict resolution skills.
Contact JPAjoan@aol.com or JPAtya@cox.net. Joan's web site is at www.jpa-international.com
________________________________________
Twelve years ago, I gave my first presentation ever to a group of internal auditors at the annual conference of the IIA Boston Chapter. It was an all day seminar on "How to Resolve Conflict and Positively Influence Others," and I was facing a packed room of mostly male, mostly graying auditors. I was addressing the concept that auditors as profit-based professionals -- have customers too. I quickly realized that my audience did not quite understand the importance of looking at auditees as their customers.
To clarify my point, I asked the audience: "If I were to ask your clients for the first word that comes to mind when thinking of internal auditors, what would I hear ?"

There was complete silence, and then a low ripple of laughter. A hand went up. From the back of the room, I heard the word: "Cops." Another hand went up: "Trouble-makers." There were several more negative generalizations, including "a pain in the neck," and "there to play 'gotcha !'"

Since that time, I have seen an incredible change in the philosophy and practice of internal audit, most of it falling under the rubric of "value-added auditing." By 1993, the list of negative words that clients invariably gave me started including some neutral, and even positive words, such as "collaborators," "advisors," and even those magical words "very helpful."

Another word that appeared regularly was "consultant," or "internal consultant". This designation stirred up ( and still does ) wide debate within audit professional associations as to whether being a consultant could and should include being involved in setting up controls ( i.e., quality improvement teams ) or being involved in implementation after the audit.

Once Control Self-Assessment ( CSA ) became a viable option in auditing methodology, there were times when the list did not contain any negative words about auditors at all!
The death of "gotcha!" is a bit premature
Nevertheless, the death of "Gotcha !" auditing is a bit premature. Even with the improvement of auditís image in some organizations, it has not gone as far as it perhaps should and could go. There are still large pockets of resistance to new approaches ( CSA ) in auditing methodology.

Let's look for a moment at the different auditing cultures that I have encountered over the years - from value-added organizations to those groups that have not subscribed to CSA. My ultimate focus will be on the psychological reasons behind the latter groupís tenacity in "conducting business as usual," and the real benefits in changing one's approach.
Auditing cultures
1.    There are a few audit departments that operate as much as possible from a value-driven perspective. They have worked hard to position themselves as a necessary and useful asset to other departments, where they have helped employees to see that everyone's ultimate loyalty is to each other, their customer(s), and the health of the organization. The audit department uses a variety of value-added methodologies, including CSA ( along with more conservative methodologies to assess fraud ); their services are sought out on an ongoing basis. Employees will let auditors know about fraud because they have a comfortable relationship with their auditors.

2.    A second group of auditors - for whom I have a great fondness - truly understand what it means to be value-driven, but they are facing some real resistance from their audit or executive management, their audit committee, or from their own staff. These auditors are fighting the good battle and are actively engaged in trying to change perceptions of the auditorís role at various critical levels within their own organizations. They are not just going along with the dictates of their management or audit committee, but are actively networking and educating people in key positions as to how they can provide the same - if not more - value to the organization by expanding their role and/or their position. The biggest challenge is when there are differing philosophies within the audit department. Whenever one sees increased turnover ( other than expected departmental rotation ), you can bet there is a split.

3.    The third group of auditors or audit departments is philosophically in agreement with the first group, but they donít really understand how a collaborative relationship with their customers can increase their ability to find and address exposure. This group has an even harder time with the idea that employees in the work area may understand the critical risk and controls even better than the auditor. This group agrees that it is important to empower the workforce to determine their own risks and controls, but at the crucial moment they pull the rug out from under their customer( s )' feet by not letting the people in that department or work area make the final decision. Instead, the final decisions are kicked back up to the managers and auditors to make, who are traditionally the very group that knows the least about what is really going on in the department.

4.    The last group are the auditors who believe current directions in auditing are a huge mistake, that methodologies such as CSA are a bunch of hooey, and that audit should be the eyes and ears of management, period. They actively practice "Gotcha !" and cannot understand the role that relationship and people skills have in successful auditing, even in fraud investigations.
Why so many auditors still struggle
There are many individual factors that show why so many auditors still struggle with the idea of letting go of who ultimately determines what risks should be in place, the importance of those risks, and the necessity of various controls.

Some would say that age is a factor; however, this cannot account for all of the resistance to letting go as many audit directors with gray in their hair have been more than proactive in changing the face of internal auditing.

Others might say that having more women in the profession has made a difference. Research does supp ort the conclusion that professions populated by women do become more open to cross-functional collaboration. However, recent studies on gender differences in the workplace have found that, in the past four years in the United States, men have almost caught up to women in their belief that collaboration, communication, and a customer orientation are important managerial and departmental philosophies and skills.

There's another factor worth considering in view of the increasing trend to rotate new hires through the audit department to inject fresh thinking and spirit. A research study conducted by Hayes indicates that 22% of the U.S. workforce consists of a new type of employee called the "emergent worker." These employees tend to be very independent in their thinking, highly goal directed and self-oriented. In other words, the W.I.I.F.M. factor ( "What's in it for me ?" ) is stronger than ever. This type of worker transcends age, ethnicity and gender, and is expected to grow to 45% of the workforce within a few years. The philosophy of the emergent worker does not exactly support a collaborative orientation.
Psychology and its applications to auditing
In order to understand why it is so difficult to let go of the "Gotcha!" mentality and why it is so easy to acquire that mode of thinking - even when you don't want it - we turn to the field of psychology. Much of the traditional beliefs of auditing are based in a core human experience: the fundamental need for control.

Psychology, as the scientific study of the mind, its activities, and human and animal behavior ( Websterís, 1971, p. 297 ), has a lot to offer to auditors. Psychologists may differ in their beliefs as to why people think and act the way they do ( e.g., because weíre born that way, or because of socialization by our parents or culture, or a combination of both ), but there is one point that all psychologists share in common.
The fundamental need for control
From the moment of birth, we share the belief that human beings have to create meaning out of the events in their lives. If we didn't assign an interpretation to what we experience moment by moment, we wouldn't know how to respond and would feel completely lost and out of control.

The feeling of not being in control of ourselves and of the situations in which we find ourselves is the single most terrifying experience that a human being can face. It is so unpleasant that erecting meaning-making structures in order to defend against this experience is one of the most important roles of the ego ( Jacobs, 1994 ).

All cultures have elaborate belief systems and/or rituals that give us roles and rules to follow so that we can trust that the others in our group - whether it be family, a profession, an organization or a society - will stay in their roles and follow the shared belief systems of the group to which we belong.

For example, in Western societies where English is the dominant language, we hold in high esteem the concept of individualism, which holds that each individual can, and should, choose his or her own destiny. Freedom of choice is our most cherished value as it makes us feel "in control." We then directly or indirectly negotiate with each other to make sure "your destiny" will not negatively impact "my destiny."

In many other cultures, however, being "in control" means to be able to depend completely on trusted others who will be there to assist you at any time any threatening situation occurs.

For example, Japan's physical landscape has traditionally been a very isolating and forbidding one, including massive earthquakes that occur without warning. Centuries ago, the Japanese learned that the only way to survive was to survive together. To reduce chaos when the environment turned against them ( or when warring parties attacked ), an elaborate and detailed system of precise roles was developed for each group member to follow based on seniority, gender, and economic status. This system of interaction eventually generalized to include all interactions between human beings. As a result, being "in control" in Japan is based on the resilience of one's group, and provides a great sense of security and safety in what is basically an unsafe world.

The examples above are meant to show how the individual ego of every human being collectively pulls together so that all human beings share enough common meaning-making for living together in relative harmony. This offers fundamental protection to the psyche, such that any perceived or real decreases ( called "rips" ) in the illusion of control will result in very real declines in both physical and mental health.

Much research exists to show that violations to oneís person or community ( such as rapes, theft, wars, pillaging, poverty, and mental and/or physical abuse in the home ) are highly correlated with permanent damage to oneís belief that one can live freely and safely. This belief is expressed in such chronic problems as increased depression and anxiety, a chronic sense of helplessness and inefficacy, an obsessive need to control at all costs which is the basis of many mental disorders, and even higher mortality rates.

Thus, any time a person feels that their ability to control their world is threatened, all the psychological defenses we have built since birth are triggered, and we automatically respond to restore a balance of power between ourselves and the source of the threat.
The word "control" as part of the audit language is not a coincidence
Auditing, more than any other profession, is completely based on this same fundamental premise of control. There may be a great deal that people who are not auditors do not understand about the auditing profession, but it does not take much exposure to traditional methods of auditing to quickly understand that the auditor is there to test the one concept that is most fundamental to that manager, employee or department. That is, their method of meaning-making that has led them to determine what they feel are the best ways to conduct their business !

This has been especially reinforced by decades of internal auditors deliberately setting themselves up as coming from a perspective separate from those being audited, whether that separate perspective is based in upholding laws and regulations or carrying out senior managementís dictates. Furthermore, the fact that an auditor does not have the time nor other resources to look at the whole client operation causes them to have to limit their activities to a specific scope, and to sampling methods. It is not that this is a bad thing to do; it is that those being audited have often perceived the picking and choosing of some arena to look at ( often considered rather obscure ) over another arena ( which in their minds might reveal more about their collective positive efforts ) as arbitrary and completely missing the bigger picture.

Therefore, auditees have come to make a number of assumptions which are still not entirely inaccurate: that the auditor is simply poking holes in order to find problems; that the auditor blindly operates from an archaic set of laws and regulations that he or she knows are no longer relevant; that auditors are often there to do managementís dirty work ( i.e., get people fired ), and that they do not weigh the severity of the risk against the cost of containing or eliminating the risk.

What this all boils down to is an ongoing perception that auditors don't focus on the same meaning-making, or set of beliefs, that the people in that work area do, and this sets people up for a power struggle.

The more non-auditors see the auditors' set of beliefs and expectations as separate from their own, the greater the perception that the auditor is simply asserting his or her positional authority to get what he or she wants. Positional authority means the ability to assert oneís point-of-view as the one to be followed based mainly on the power given to the position in the organizational pecking order.

In other words, if the auditors are perceived to have the ear of their senior management, auditees will cooperate superficially, but they will be more resistant underneath because they feel the control has been taken away from them.

The more the auditee finds common meaning-making, or beliefs, between him or herself and the auditor, the more the auditee will not only ascribe more informational authority ( that the auditor knows what he or she is talking about ) to the auditor, but will see him or herself as an equal with the auditor.

Why ? Because most managers like to see themselves as being authorities based on informational expertise as well. The perception of some congruence between the belief systems of two different professions - auditors and managers at any level in the organization - is such a positive experience for those trying to control their day-to-day environment that the collaboration becomes genuine. A partnership with increased dialogue and honest communication is formed.

Therefore, it is imperative that auditors continue to move beyond the focus on problems, findings and risks, and develop a reputation for also helping their clients to reach departmental goals and to see new opportunities for advancement.
Why is it so hard to shift from a risk- and controls-based perspective ?
From my observation, I find that auditors are still having a difficult time shifting from a risk and/or control based perspective in the concept of "findings." Some auditors equate findings with objectivity. However, as long as findings include only what is wrong with a work area or a work process, auditors are missing half the picture : all the things that people may be doing right.

By "right," we mean that employees are complying not only with critical laws and regulations, but also extending the definition of due diligence by focusing on the most critical activities in their jobs that lead to accomplishing their department's mission and goals.

There are a number of critical reasons for taking serious note of the positive actions. First, noting equally what is positive and what is negative gives a more accurate and complete picture. Second, and even more important from everyoneís perspective, the means for correcting a problem is sometimes rooted in the activities that people are already doing correctly.
Generalization
This leads us to an extremely powerful concept based in a psychological concept called generalization. It means that once a positive or negative action is taken in a particular situation, there is an increased tendency for the person( s ) to use the same behavior in other situations that are perceived to be similar to the original situation.
Every auditor has been a victim of negative generalization. How often have you met with great resistance at an opening conference due to the negative experience the auditees had with the last auditors ? However, with new awareness and training, auditors can ( re )shape other peoples' responses to them so that their clients will begin to generalize positively to the typical auditor.

Some of the keys to success involve learning to assert informational rather than positional authority, accepting a fundamental truism that we cannot change other people, and changing oneís own behavior in response to the behavior of others.
Knowing why, how and what we are doing is half the battle
In order to change negative perceptions, an understanding of behavioral patterns that are often at the root of the problem is essential, i.e.:-
•    How we internally develop a system for making meaning of the world to control it ?
•    How that system inadvertently distorts our ability to see the world and people in it accurately ?
•    How our distortions cause us to act and react with others in unhealthy and unproductive patterns of miscommunication and misunderstandings that generalize to more and more resistance ?
Psychological perspectives
There are many psychological theories as to how human beings go about developing their belief systems and behavioral patterns.

The field of psychology has its roots in the intradynamic perspective of human development. This perspective believes that the meanings we assign to events and actions we take are due to inner, genetically based forces that we are born with.

Another perspective is based in social psychology, which traditionally has focused on how other people impact us as individuals, and how we in turn might respond.

In recent years, however, a third dimension in psychology has emerged, called interaction psychology. Interaction psychology believes that one cannot focus solely on internal forces and desires to understand how one makes meaning of life, nor can one focus solely on the external impact other people have on the development of the individual. Instead, the interpretation of meaning assigned is based on the unique combination of the person x the situation. Notice that the word here is "situation," not "other people."

Bronfenbrenner, who developed a similar theory called "ecological systems theory" ( Lemme, 1995, p. 38 ), defines "situation" as the continuously changing properties of the ( 1 ) immediate settings in which the person lives, ( 2 ) the relations between these settings, and ( 3 ) all the larger past and present variables that affect us ( e.g., our childhood, age, the global economy ). All that is going on inside the individual combined with all that is going on in the external world impacting that person at that particular moment together create the final analysis and interpretation given. In a nutshell, interaction psychology says that the situation and the person are continuously co-creating each other, moment to moment.

Each one of these perspectives has something of value to offer auditors and will be viewed separately.
Freud : Not everything he said was wrong
Freud is the best representative of the psychodynamic approach to human development. There is a lot that Freud theorized that we no longer agree with today, but there are some key fundamental concepts he developed that still have a lot to offer.

One of the things Freud was most famous for was the idea that our mind is divided into three key structures that explain different aspects of our beliefs and behavior.

The first structure is the id which is present at birth and drives all our physiological instincts, emotions and desires. The id demands instant gratification of instincts without consideration of law, social custom, or the needs of others. Freud recognized that the id could contain two conflicting emotions at once, which is why it is possible, for example, to enjoy the excitement of stealing while hating ourselves for taking such a risk ( Rathus, 1990 ).

The second structure of the mind is the ego, which begins to develop during the first year of life, largely because a childís demands for gratification cannot all be met immediately. This causes immense frustration and anger which need to be dealt with somehow. Thus the ego develops as a "stand for reason and good sense" ( Freud, 1964, p. 76 ). The ego finds rational ways to curb the id's need for instant gratification. It also develops ways for the child to rationalize the need to align him or herself with social convention in such a way that a person can find gratification, yet avert the censure of others.

The last major structure of the mind is the superego, which develops throughout early childhood. It incorporates the moral standards and values of parents and other people perceived to be important to us. The superego develops examples of how we ideally can and should think and act in the world. It acts like the conscience, an internal moral guardian. According to Freud, the superego monitors the intentions of the ego our whole life and hands out judgements of right and wrong. When the superego does not like what our ego has decided, it floods us with feelings of guilt and shame.

As you can imagine, the ego is stuck in the middle of the id and the superego. On the one hand it strives, consciously or unconsciously, to satisfy and negotiate the demands of our id. On the other hand, the ego has to deal with the moral rectitude of the superego. The egoís job becomes one of negotiating between the id and the superego. If our ego is not a good negotiator or problem solver, or if the superego is too stern, we will feel miserable. If, on the other hand, the id is too strong, we might easily end up in jail !

From the Freudian perspective, a healthy person has found ways to gratify most of the idís demands without seriously offending the superego. Also, most of the idís remaining demands are contained, meaning we can feel the urge but it is not so strong that we feel compelled to act upon it. Or, some needs are repressed, meaning that the ego prevents us from even knowing that we feel that way.

Nevertheless, it is important to understand that for our inappropriate and dangerous impulses to be contained or repressed in a healthy manner, there has to be sufficient allowance for the less dangerous and even the positive impulses to be expressed ( e.g., a well-deserved vacation after working hard on a long project ).
What does all this have to do with the world of auditing ?
As you may have already guessed, people are often drawn to professions that fit the tendencies of and relationship between their internal id, ego and superego. In other words, it is rare that you will find a person who likes auditing who also has a very strong id !

Since even value-added approaches to auditing require analysis, patience, problem-solving and decision-making skills, a well-developed ego and superego seem to be inherent to auditing practitioners. Unfortunately, an overly strong superego encourages auditors to make moral judgements and to judge both people and their work situations based on their own internal belief system of what the ideal should be.

In fact, auditing was originally designed to be moralistic : findings focused on the mistakes and the negatives. Auditors came in unannounced as if they were trying to catch people at something ( some still follow this practice ). People were asked to make corrections and changes because that was the rule, not because it would help the department to function better or make the organization financially and structurally stronger.

This is certainly no great news to you as an auditor. Many audit departments try to weed out people who appear overly moralistic in the interviewing process. Unfortunately, that is not true of all audit or risk assessment departments.

I recently gave a seminar on leadership skills for technically trained managers at a large corporation that is very active in the IIA. A manager from the global risk group - we'll call him "Dave" - was one of the most punitive thinkers I have ever known. We conducted an exercise where people had to negotiate a solution to what appeared to be an insurmountable problem. Whenever Dave's partner did not agree with him, he would state very slowly and clearly: "You are stupid. I will kill you." It was his way, or no way at all ! Dave was as hard on himself as he was on others, correcting himself frequently and labeling his ideas - and everyone else's ideas - as stupid and silly. The class was terrified of him !

Unfortunately, Dave's boss had an equally stern superego. In addition to being very defensive and vigorously defending Dave, he stated: "This is what is needed to get these people in line in this company."
Cognitive rigidity
Both Dave and his boss have such stern superegos that it has created cognitive rigidity. In other words, the more dominant the superego, the more the person will apply simplistic, overriding interpretations to a wide, unrelated variety of people and situations in an absolutist manner. Notice that the bossí statement did not qualify that some people in some areas need a strong approach. Instead, his statement implies that all people in that whole company need to be strong-armed, and that his point of view was the only one worth considering.
The trend in this decade
If the audit profession has tended to come from a basis that reflects the superego, the trend in this decade reflects the profession's desire to shift from a psychology based in the superego to one that is more balanced in both its stance and its approach. This is a very positive development.

In fact, because most people who stay in auditing tend to have stronger superegos themselves, auditors especially can afford to let up on themselves and enjoy themselves a bit more. This is exactly what value-added methodologies are allowing auditors to do.

One of the hardest things I find that auditors go through is their struggle to give up control as they learn to facilitate risk through CSA-based workshops. Once auditors realize that they do not have to have all the answers and that imperfection is a blessing when you know how to use it to your advantage, they begin to loosen up and, by golly, have fun ! Real fun !

I would like to say that all my exhortations about the virtues of value-added approaches to auditing are the re