Audit
|
Risk Anatomy™
|
In a firm the audit trail fulfils following functions:
- Documenting compliance: evidence of compliance with internal policy and process, albeit this is form without reference to substance.
- Assign responsibility: To memorialise decision-making — to assign individual responsibility — but at the same time to record qualifications, derogations, assumptions and conditions upon those decisions — that is, to diffuse responsibility for the decision.
The key for decision-makers is to articulate qualitative conditions — that require comprehension of the subject matter — and not quantitative ones, that can be easily measured by the audit function. This allows the SME, to whom the consultant will inevitably turn, to create her own qualitative conditions. If she is experienced, her conditions will be in the gift of a third SME, who will create her own qualitative conditions in the gift of a fourth. Eventually the trail will lead in a bureaucratic Möbius loop back to legal, and the circle of diffusion will be complete.
Audit is the triumph of form over substance
Burgeoning complexity means a preference for substance over form. As previously rehearsed, the more complex the firm the less likely individuals are to understand the totality of their own subject, let alone the broader organisation (no one knows how to make a pin), much less be responsible for it.
Form is, by definition, easily articulated. It is measurable, observable, auditable. “Did you review that template by year end?” has a yes/no answer which is easily given in the affirmative. All you need is a diary and a decent sense of time management. A machine could do it. “Did you review the template properly?” is a harder question to answer. In the same way, “Did you check it against policy, legal developments and corresponding templates?” is a tougher question, but still has a yes/no answer. It functions like a checklist.