The method that worked, if anyone used it.
An audit team had a sound, well-documented risk-based audit approach. The trouble was that almost nobody applied it correctly.
The challengeA risk-based audit method nobody applied correctly
The approach existed, it was right, and it was written down. But it lived in documents written by auditors for auditors. People outside the team, the ones who needed to apply it, found it abstract. So they applied it partly, inconsistently, or not at all.
What we deliveredAudit training as a tour of the Great Library of Risk
- 1An Alignment Brief with the audit team: where people went wrong and what correct looked like.
- 2A Story Blueprint: the approach told as a tour of the Great Library of Risk, one shelf per idea.
- 3A 40-minute risk-based audit training course, built as an immersive tour of the library: books that explain inherent risk and what drives it, a reading room of audit methods, and a case study room where people audit three versions of the same purchasing process.
- 4Two further modules, commissioned after the first.
The idea, and why it workedOne shelf per idea, and a room to practise
Inherent risk is an abstract idea: the risk that exists before any control is applied. So we gave it a building. The Great Library of Risk keeps a book for every situation, a hiker’s, a remote worker’s, each with risks of its own. Even the library has one: bookworms. People walk the shelves and open the books that explain what makes risk rise: complexity, volatility, susceptibility, subjectivity. Then they sit down in the case study room, where a folder waits on the desk: one purchasing process in three versions, done by hand, half automated and fully automated. They choose one, write their own analysis against the clock, and only then see the auditors’ answer next to theirs. Along the way, they notice that the risk moves with the design of the process.
It worked because a method is easier to follow when someone takes you through it once, step by step, with something at stake.
