Tales from the audit trenches#1 What would happen if you were hit by a bus, Chris?

When time permits, I have decided to share some of what I consider to be the slightly more amusing experiences from my time in the wonderful profession that is internal audit. 

A few of you may recognise some of these stories. I have shared several of them previously in person. All are true. If there are any minor errors then these are down to the passing of the years. Forgive me in advance.

Maybe I have changed some of the names of those involved. Maybe not. 😐 I have considered our Code of Ethics and have sought to abide by the confidentiality rule and principles throughout. As you would expect. Of course…

Welcome to the first article, or episode if you prefer, of… ***gentle fanfare and drum roll*** …tales from the internal audit trenches. Number one.

I feel that for this one, it’s right to start at the very beginning.

It was September 1999 and I had just started as a trainee internal auditor, lured into the job with the promise of a pay rise, study leave, an additional study allowance and the opportunity to gain professional qualifications that I could take anywhere. All the right reasons, as you can see. I was also pleased to leave my previous role in the same organisation, as I felt management were unenlightened and the tasks were a little dull and repetitive. I was glad to have escaped.

Internal audit appeared to offer so much more. Variety, challenge, ahem extra money, and I really liked the deputy head of internal audit, Vince. He was a very genuine, nice guy and was keen to support me, and my colleague who joined at the same time, as we began to learn the ropes.

Week two of the new job saw me off to the (then) Civil Service College at Sunningdale, for the first of many training courses. This one was - from memory - the four-and-a-half-day introduction to internal auditing course. It included sessions on corporate governance, internal control, and of course internal auditing.

I had no real idea about half of what was covered as I was such a newbie. Hey Ho. But the main tutors, Neil Cowan (RIP) and the fabulous ‘Uncle’ Nigel Freeman were good and many of the other delegates were real characters. I was also introduced to the first of many Freeman triangles, received the first of many Pickett internal audit textbooks, and was given a plastic Rutterman’s flowcharting tool! Not quite Christmas, but not bad. 

I’m happily still in touch with several delegates…you know who you are! Sunningdale was a great, campus-style site, with the only downside being the patchy food. Many of you veterans will also remember that. Sometimes it was great, other times less so. 

***As an aside, as everyone knows, the quality of food is absolutely vital on any internal audit training course. The course may - occasionally - be dull, heaven forbid, but if the food is good, then no problemo! Happy days.***

Upon my return from the course, I was given my first internal audit engagement.

I was to look at a team whose role was to undertake penetration testing, snigger snigger, of ‘friendly’ websites. Ethical hacking if you will. Of course, I knew nothing about this either back then, so I initially spent time learning about this subject and thinking about good governance…how the team set its objectives, managed its risks, prioritised its work, shuffled its resources around etc.

See, I really was learning already.

The time came for my very first meeting with the head penetrator. Am not sure now that this was his actual job title, but never mind. 😏 It was a long time ago. We’ll call him Chris.

Chris was a really professional guy. I explained that I was new to the role and that I had an internal audit to undertake. I said that I needed to ask him some general questions to enrich my understanding of the work of his team. He was polite and helpful throughout. A dream first internal audit client.

I was suitably relieved.

As this preliminary meeting neared its end, I asked Chris about how he planned the team’s activity and managed the different project timelines. He pointed to the big, Banner wall calendar behind him. It was one of those large wall calendars with the year split down into months, weeks and days. Remember them? 

Interesting, I thought, an IT whizz who uses a very manual approach to planning and plotting. Why doesn’t he use a calendar on his computer, I wondered? What does he know about IT security that I don’t?! (A huge amount actually, but I didn’t dwell on this for too long).

On the wall calendar were a great number of those small, round, coloured, sticky dots. Red, green, yellow, blue etc. I asked Chris what they represented. He replied that each dot was a team member and it showed what projects they were allocated to. The green dot appeared the most. It was visible on nearly every day of every week of every month, across the whole year.

Who is the green dot I asked? It’s everywhere.

That’s me said Chris.

But Chris, don’t you ever take leave? You must be so busy? You seem to appear against every task.

Chris replied that the team had too much work, too few resources and so he was far busier than he should be. The team were struggling to keep pace with demand. As a result, he had to get involved with far more than he liked.

I had an inkling that I was onto something. My internal audit-Spidey sense was kicking in.

Perhaps Chris was one of these ‘single points of failure’ I’d read about. A critical person. There must be a key person dependency here! Surely this was a risk and I had my first finding?! I was nervous but secretly pleased…perhaps this would lead to a recommendation. My first one ever. At this point I understood recommendations to be good things. Weren’t recommendations what we lived for? Yay! 😎

To confirm my thinking, I then uttered the fateful words.

Given the amount of work you are involved in, what would happen if you were hit by a bus, Chris?

Chris kicked back in his chair and breathed in. Hmmmm. Well, he said, it would be a big problem for the team and its tasks. Projects would slip to the right; customers would be unhappy and websites would be left vulnerable. Not good.

Music to my ears. Oh yeah.

I was secretly delighted. Yowzer, I had my first internal audit finding.

Inwardly punching the air, I quickly thanked Chris for his time and skipped joyfully back to the internal audit nerve centre at the other side of town, to tell Vince of my result.

But the story doesn’t finish there.

Oh nooooo… 

For the very next day, in the centre of town, Chris was cycling along when… 

Crash. 

Kerpowww! 

Smash. 

Ouch. 

Chris was hit by a bus. 

It’s true. 

(And since then, I swear that I have only used this apparent super power for good.) 

Happily, Chris survived this rather close-up and personal encounter with the bus. 

Unhappily, he was a bit broken. 

He returned to work a few months later, on crutches and with pins in his legs. After updating his wall calendar he came looking for me. If a quick escape proved necessary, I was confident that I could run faster than him in this condition. Just. When we met, he did joke about my ‘bus’ comment at that point. But I was careful not to laugh too much. 

From this moment onwards I have always asked a different question when the situation has required it. What would happen if you won the lottery or more recently, what would happen if you won euro millions? Sadly no one I know, and certainly no audit clients have. Yet. 

By the time Chris returned to work, Vince, the deputy head of internal audit had left. He had moved back to his previous organisation as it was a much shorter commute. I was really disappointed. He was one of the main reasons that I’d joined internal audit. This was a real blow and led to a difficult few months at work as I sought to quickly learn about internal auditing, attend courses and study for the examinations. Perhaps more about that some other time. 

Chris left too, shortly thereafter. 

Was he fearful of another Chesshire curse?! 

I hope not. 

Actually, despite being hit by the bus, things worked out rather well for Chris. He left to work for a private sector information security company at three times his current salary. Good man. He certainly deserved it with the skills he had. 

And that’s where my first internal audit, Vince, Chris, me and the bus parted company. 

**************************************************************************

I hope you enjoyed this first tale from the internal audit trenches and that it has maybe made you think about your first internal audit!? 

Hopefully no women, men, children or animals were hurt during the conduct of your first one…

John Chesshire

Home (jc-audit.com)