What do you do when an auditee says "No thank you"

[Jennifer Kirley]

In Reply to Parent Post by Wes Bucey

I counsel organizations to make internal audit teams cross-functional, always including a management member of at least as high a rank as any department head undergoing the audit - stops most resistance before it can be offered. The audit TEAM issues findings over the signature of the highest ranked member.

I think it's unfortunate to consider an organization needs this extent of decorum. In my view, if an auditor is hired to do the job but can't audit someone based on stature, that speaks volumes about the organization's commitment to the QMS. Of course a person needs to be able to deliver bad news to a superior; that's part of the job and one qualification of a good auditor is the ability to pull it off. I have had to tell a client ship's captain that his boat wouldn't make deployment in the morning - the man was clearly unhappy but my division stood firmly behind us. We did have to be non-commissioned officers though; some rank was important, but even an E-4 had the authority to tell an O-4 what he didn't want to hear without reprisal. Being a good auditor should include the ability to calmly and respectfully point out what the standard requires. It isn't about what we believe applies to us; we all have responsibilities and some come with effort. His group brought this on themselves by insisting on controlling their process documents outside the corporate system. If not for that I could have verified the document controls from my desk, with no effort or time from him.

We don't always have audit teams. In this case there were two of us, and I was the lead but no management level auditor was available to sooth this guy's bruised sensibilities. I will be interested to see what the audit program manager says. He knows me - I have argued record retention with him.

That said, if this was a VP I would do what was already done, which is to bring the regular auditor into the meeting for support of the position. I would not want to go it alone with some people. Brrrr!

[Wes Bucey]

Yep! Military organizations recognize that any rank doing the job assigned (no rogues!) is going to be backed by the brass. RHIP (privileges), but also rank has its responsibilities. In cases where the ranking officer is derelict, word soon reaches brass who will remove that officer.

(Of course, in 'nam, derelict officers in the field sometimes got "fragged" by an individual wearing the same uniform when top brass didn't act quickly enough.)

In Jennifer's situation, it was stated as fact the top brass was unlikely to act against a junior officer.

My suggestion to add a manager to an audit team is to enforce the concept that auditees may face peril for defying the audit because of the visible presence of the manager. (Kind of like having a police car parked close to a red light or stop sign or speed limit sign - drivers think twice before violating the traffic instruction. - in one Chicago suburb, the police chief had an out of service [empty] squad tucked in near a speed limit sign with a "dummy" dressed in a uniform. The open secret, though, was given teeth because, on random days, the "scarecrow" would be replaced by a real cop who would write speeding tickets. )

[howste]

In Reply to Parent Post by Wes Bucey

Both Steve (Howste) and Randy are channeling "3rd party auditor" thinking here. Such thinking is rarely applicable in internal audits because internal auditors often have lower rank and status than managers of departments under audit. In organizations where top managers abdicate power and authority, the propensity of silo creation is very prevalent. The managers of those departments then become more powerful than the top manager who is unwilling to take any action unless the silo becomes an obvious money loser.

You make a good point. I realize that there are a lot of office politics and dysfunctional organizations around. However, I still tend to be an optimist. I don't always assume that someone is making a power play. Even if they are, being timid isn't always the best way to handle the situation.

I've found throughout my career that respect and authority are things that people rarely just hand to you. If at the first indication of potential conflict, a person rolls over, then they will never respect you or your position. Obviously open defiance isn't the best policy either. Some of the best relationships I've had with higher levels of management have been cultivated because I wasn't afraid to push back when necessary.

[Jennifer Kirley]

In Reply to Parent Post by howste

You make a good point. I realize that there are a lot of office politics and dysfunctional organizations around. However, I still tend to be an optimist. I don't always assume that someone is making a power play. Even if they are, being timid isn't always the best way to handle the situation.

I've found throughout my career that respect and authority are things that people rarely just hand to you. If at the first indication of potential conflict, a person rolls over, then they will never respect you or your position. Obviously open defiance isn't the best policy either. Some of the best relationships I've had with higher levels of management have been cultivated because I wasn't afraid to push back when necessary.

I think this is correct. It took years, but I have achieved a sort of stature in my own site - people are surprised when they assume I am management level and I point out no, I'm just an hourly tech level employee. I've done it through give and take, negotiation, occasional wheedling and, in the beginning, direct affirmation and support from my manager. And to this day, in a difficult situation (they still arise once in awhile) I will make clear I recognize I am not the last word on these matters. I audit at the pleasure of my employer - he gets to make the final call. So, when necessary I have been known to punt an issue.

But this was the corporate offices, which only recently had gone through certification and as such the system is still not very mature. The level of awareness still isn't all that solid in all groups. I expect that but I find it unfortunate that I wasn't a large enough part of the roll out. I think I could have helped.

So, as is often the case it was a teachable moment. I find a lot of them as I go. Getting through this gracefully it what can set people apart, I think. It was good exersize as my people "at home" have learned not to challenge me this way.

[Jennifer Kirley]

In Reply to Parent Post by Wes Bucey

My suggestion to add a manager to an audit team is to enforce the concept that auditees may face peril for defying the audit because of the visible presence of the manager. (Kind of like having a police car parked close to a red light or stop sign or speed limit sign - drivers think twice before violating the traffic instruction. - in one Chicago suburb, the police chief had an out of service [empty] squad tucked in near a speed limit sign with a "dummy" dressed in a uniform. The open secret, though, was given teeth because, on random days, the "scarecrow" would be replaced by a real cop who would write speeding tickets.)

I'd like to think that wouldn't be needed. If it is, I would like to think a phone call would be enough: "I am sending Jennifer over to audit XYZ. Feel free to open up and discuss with her - she's much more than a kick-the-tires sort of auditor."

[Jim Wynne]

In Reply to Parent Post by Wes Bucey

I see TWO important points here:

1. This is definitely a power play by the auditee. By his action/inaction, he says to Jennifer, "This whole internal audit process is a threat to my power and authority over my 'silo.' As the symbol of that threat, I am resisting you."
2. In this issue, the auditee KNOWS his silo is not being billed directly, so he doesn't care who pays or how much as long as it is not reflected on the accounts of his silo.

Both Steve (Howste) and Randy are channeling "3rd party auditor" thinking here. Such thinking is rarely applicable in internal audits because internal auditors often have lower rank and status than managers of departments under audit. In organizations where top managers abdicate power and authority, the propensity of silo creation is very prevalent. The managers of those departments then become more powerful than the top manager who is unwilling to take any action unless the silo becomes an obvious money loser.

Rather than something as dramatic as a "power play," I think it's more likely that the manager is suffering from conflicting priorities syndrome. There's a good chance that this person had to choose between getting hit over the head for not getting his work done because of time spent with the auditor or getting hit over the head for blowing the auditor off.

There might have been an accurate perception on his part that blowing off the auditor would result in a wound less severe than if he had to blow off a customer by missing a conference call or a corrective action due date. If internal audits are to "add value," the priorities of the organization must be in alignment.

Another thing to consider, although I don't think it applies in the case at hand, is that sometimes auditors do waste everyone's time by chasing down obviously blind alleys, not understanding documentation they're appraising, or the general dynamics of the process (or, god forbid, department) being audited.

[Jennifer Kirley]

In Reply to Parent Post by Jim Wynne

Another thing to consider, although I don't think it applies in the case at hand, is that sometimes auditors do waste everyone's time by chasing down obviously blind alleys, not understanding documentation they're appraising, or the general dynamics of the process (or, god forbid, department) being audited.

I'm pretty sure my auditee have believed this from time to time because I often stray from the beaten path. But after years of auditing the same processes I don't need to use that path all the time; I do, however need to explore issues that have surfaced in other processes. Instead of beating the other process owner I will deal with it in the group that has the most direct authority and responsibility. It's that whole system thing that doesn't happen in my sister sites that use a team of part time auditors and don't have a good method for tracking issues.

[Jim Wynne]

In Reply to Parent Post by Wes Bucey

The inoculation:
I counsel organizations to make internal audit teams cross-functional, always including a management member of at least as high a rank as any department head undergoing the audit - stops most resistance before it can be offered. The audit TEAM issues findings over the signature of the highest ranked member.

In most places internal audits are done by individuals, not teams. If the organization is dysfunctional, having managers conduct audits can be counterproductive, to say the least. In dysfunctional organizations there is often competition between department heads for the attention and favor of the higher-ups, and there's almost always one or two who are favored over the others. In such situations, internal audits can be used as a blunt instrument, usually with impunity.

If one happens to be employed in a company with enlightened management, there is no need to have managers doing audits although it probably wouldn't do any harm as it might in a dysfunctional company. In any event the suggested "inoculation" will probably exacerbate the problem or have no effect at all. It's unlikely that it would help anything.