It was almost ironic the timing. Whilst performing an audit (and being told by the business area "... how under resourced, and under-pressure" they were, I received a Google Alert regarding the Rocky Mount Telegram. The article made reference to almost $450k worth of funding being repaid back to the Department of Housing and Urban Development (HUD). The article is almost trivial, but still a good read (you can read the full article here). What caught my attention in the article however, was this:
"Our HUD representative indicated that we were short staffed and Internal Audit agrees,"
When I started in Audit and Assurance at a Big 4 firm, after going down rabbit holes and taking in everything that the business area told me, I proudly announced to my Engagement Manager, that the issue was resourcing. The underlying issue for everything I had found, was simply, there wasn't enough staff. I have thankfully grown up a lot since then, and the words of my Manager at the time will always stick with me; "Lack of staff is never the issue. Everyone thinks they are busy. It's not for us to confirm if they are busy, understaffed, or just lazy". It was a brutal shut down of my audit observation, but nonetheless, true. It was this quote from my Manager, and the one liner from the Rocky Mount Telegram, that made me step back and question... is lack of staff ever an appropriate item to include in an audit report? My answer. No.
Staffing is not our responsibility
First and foremost, as auditors, we are often there to check the performance and conformance of a set of processes and controls. Are current processes designed and implemented properly? Are they operating as designed? What does our Test of Operating Effectiveness show us?
Whilst we often do add value through advisory / consultancy style work also throughout our audits, the primary role of our audit is not to assess the level of staffing within a business area, nor that it should be.
Whilst I am a firm believer that audit reserves the right to comment on the skills, experience and capability of staff within a business area (always a sensitive topic, but sometimes warranted), we should not comment on the level of staffing. This should be factored / raised through other business processes.
Taking a step back
Although it may be obvious that a business area is struggling with the immense workload and pressures, its more advantageous to take a step back and look at the bigger picture. Here is a couple of things which should be considered when taking a step back:
Business Planning and Budgeting - Larger organisations should be performing annual business planning and budgeting exercises. It is in this forum that management within a business area should raise any staffing level concerns they may have. This is the perfect opportunity for the business area to sort out their own issues, rather than using audit as a sounding board. Where the business has tried (and been unsuccessful), in their attempt to gain additional resources, audit should consider reviewing the business planning process through their annual planning / audit plan refresh processes. It may so be that the refusal to provide additional resources is justified, however on the flip side, it may show a business strategy which is too aggressive; potentially leading the business into a situation where key business processes and controls are falling by the wayside and business teams struggle to maintain current workloads whilst struggling to meet organisational targets. Such a case can have long last consequences on a business, its culture, and its reputation.
Current work practices - A business area may simply feel too busy, because they are. Too often, particularly within Finance and HR teams, people are doing an activity '... because that's the way its always been'. For instance, someone may have once requested a report. That report is now generated, reconciled, reviewed, and passed to the business area each month. Meanwhile, the person who originally requested the report is no longer with the business and the report is no longer utilised by the current manager, who instead, receives his own bespoke report. It may be beneficial for a business area to stop, take stock of current activities, and determine if all current activities are essential, are they inline with our current risk appetite, and can they be simplified or automated.
The staff could just be disgruntled - Such a situation should not be dismissed, but rather, briefly investigated by the audit team. Is there an issue here which has been highlighted in the Workplace Satisfaction / Engagement surveys? If so, what is being done by the business area and HR to address this? Although this is not an easy item to bring up directly in an audit report, reference can always be made to it through another finding.
HR hasn't been watching resourcing movements - Sometimes, the lack of staff may be justified. As businesses move to more integrated workplaces, where single systems such as SAP, Workday, Technology1, etc, are utilised across all functions of an organisation for both People and Financial Management processes; these systems often record 'Position Numbers'. The number of staff, or positions, that should be allocated to a particular area. A simple check will quickly identify if any business area is either over staffed or understaffed. Whilst this check will provide you with a quick answer, it is not the root cause, and should not be included in the report. Such a situation may again link back to a poor business planning exercise, or HR simply not maintaining necessary oversight of staff / resource management.
These are only a few considerations that should be investigated when an auditee says "they are short staffed", however it is still my opinion that such an excuse should never be included in a report. Whilst they may well be understaffed, there is a reason why, and it is this that needs to be investigated, and bought to the forefront.
Comments