Assurance Fatigue

If you ever have the chance to hear or read Professor Urton Anderson's thoughts - you are one blessed auditor. He is the author of "Implementing the Professional Practices Framework" book published by the IIA. If you are following the red book - it is a MUST read document.

The week before Christmas, he donated his time to Austin chapter of the IIA. He is a professor at UT and was on the IIA standards board for years. He knows his stuff.

He shared with us an interesting graphic of three concentric circles. The core was 'controls', the middle circle was 'risk,' and the outer circle contained the word 'governance.' The graphic described the evolution of the internal auditors focus from policing controls, to asking what risks the entity is experiencing, to asking whether the entity has adequate governance or leadership. Makes sense - and I have witnessed the evolution over the past 20 years.

But the graphic begged the question, "What's next?" So, I asked. And Urton said that the next big concern for auditors is overlap. PWC in South Africa developed a way for organizations to catalog their audit coverage. This cataloging shows where the organization is receiving too much audit coverage and where they are bereft of coverage. And it is the first place I have encountered the term, 'assurance fatigue.'

Most large organization have internal and external auditors. In the government environment, you can be audited by the grantor, the cognizant agency, the passthrough entity, the internal auditor, and an independent CPA. As you can imagine, some subject are over-assured and some are ignored completely. If you are a defense contractor, you might add your ISO Auditors and other quality assurance providers. And don't forget IT. I am now experiencing assurance fatigue in my mind.

Here is the link to the PWC report:

http://www.pwc.com/en_ZA/za/assets/pdf/SteeringPoint-KingIII-Combined-Assurance-11.pdf