Jello is Firmer Than the Internal Audit Capability Maturity Model

This year I had the opportunity to apply the Internal Audit Capability Maturity Model (that is a mouth full!) to an audit organization of over 60 auditors.  It was fascinating, but it goes against everything I teach in an auditing seminar.

In an auditing seminar, I teach that the audit objective has to have a very clear and finite subject and a firm criteria.  The Capability Maturity Model asks things like “Is the audit activity performed effectively and with proficiency and due professional care?” SQUISHY!

In an auditing seminar, I teach that that you should only take on a few objectives at a time so that you can finish quickly.  The Capability Maturity Model has 7 facets ranked against 5 levels.   WHAT?

In an auditing seminar, I teach that you should back up your findings and conclusions with physical and documentary evidence.  In order to make judgments on the ratings in the Capability Maturity Model, you rely on testimonial evidence gathered during interviews and through surveys.  HOLY COW!

An Internal Audit Capability Maturity Assessment is Squishy but Compelling

In other words, assessing an entity against the Capability Maturity Model is not an audit, it is a consulting engagement.  And like any consulting engagement, you have to apply a lot of judgment and work with squishy, Jello-like objectives, criteria, and evidence.

Also in order to perform a capability maturity assessment, you have to accept the title ‘consultant’ – a title that has lots of negative connotations.  Some say that consultants tell you know you already know, but in a full-color graphic. There is some truth to that, but consultants ultimately survive because everyone loves to hear about themselves.

How did I do?

I remember as a young woman looking forward to getting Cosmo magazine every month so that I could take the latest Cosmo quiz “Is your boyfriend right for you?” or “How to tell if you are too clingy.”  I frequently see that same quest for more intimate, personalized information drive organizations to pay corporate trainers and consultants to perform extensive personality assessments on their audit teams.

And the Capability Maturity Model is pretty intimate and personal.  It tells an organization all about it self, the strengths and the weaknesses, and even goes as far as to rate the organization on a scale of 1-5.  That is some pretty compelling stuff.

But does the Internal Audit Capability Maturity Model add value?

So given all of those drawbacks, is it worth it to go through a Capability Maturity Assessment? Yes, ultimately, I think it is worth doing the work for several reasons:

• Staff is more willing to share with an outsider rather than their own boss because the boss may not be receptive to the truth.
• The Capabiility Maturity Model provides a framework to classify and group ‘issues’ so they can be resolved systematically.
• The model gives teams something to strive for (everyone likes to move up a level to evidence progress and growth).
• The model humbles the haughty (because getting to a 5 is nearly impossible) and centers audit shops on what is important.
• The work can result in some pretty cool recommendations for improvements if performed by knowledgeable auditors.

To find out more about the Internal Audit Capability Maturity Model as it is applied to audit shops, check out this IIA guide.

I am going to ask participants to evaluate their own audit shops against the model in a workshop about audit leadership at the end of August.  I’d love to see you there.

Leita