Doing things right versus doing the right things
I ran across this saying the other day, and it really got me thinking. Is it more important to do things right or to do the right things?
Of course, whether at home or at work, it’s important to do things correctly (doing things right). But what if the things you are doing are the wrong things? Even if you do them right, should you be doing them in the first place? Maybe your time would be better spent on other tasks, or you should be delegating tasks to others so they can learn, or you may just simply be doing things you have always done without taking a moment to figure out the “why” behind it.
In that way, I think the focus should first be on doing the right things, and then doing those things right.
If I think about this concept in terms of internal auditing at financial institutions, I start to think about the following things:
- Is internal audit spending too much time on areas of low risk (e.g., teller line operations) because that is where the staff is most comfortable?
- Are internal auditors spending time performing a control (e.g., daily review of overdrafts or loan file maintenance) versus testing the effectiveness of controls performed by others?
- Does the internal audit plan operate in a silo without taking into consideration efforts performed by others (e.g., financial statement auditors, compliance audits, information technology audits or FDICIA/SOX controls testing) in the name of remaining independent, without consideration to potential duplication of efforts?
These sorts of activities amount to doing things right, but likely not doing the right things because they dilute the value and effectiveness of a strong internal audit department.
The internal audit department should focus on the institution’s highest risk items, based on a defined risk assessment, as well as ensure that whenever possible, control activities are completed by control owners instead of by internal audit personnel. Internal audit activities should also be defined by a detailed internal audit policy and internal audit charter. Finally, all audits should be supported by detailed workpapers and a formal report, as well as tracking of findings for appropriate corrective action.
Want help knowing if your internal audit department is on par? Consider an internal audit quality assurance review. From informal internal audit coaching/development, to a complete Quality Assurance and Improvement Program audit as defined the Institute of Internal Auditors, Wipfli’s certified internal auditors stand ready to make sure your internal audit team is not only doing things right, but also doing the right things. Click here to learn more.
Related content:
