1.
The effectiveness of auditing activities
depends more and more on the ability
to generate and create value –and not
so much on the ability to monitor
budgets, processes, and systems. To be
more efficient, improve profitability and
uniqueness-induced growth, companies
have to stop focusing on the costs
and hone in generating value and
communicatingtheirvision.Nevertheless,
Internal Audit Departments are still
under the pressure of regulatory contexts
that are increasingly more restrictive and
of financial constrictions that depend on
the market’s particular situation and on
the progressive focus on the corporate
administration’s mechanisms.
Culture is key, also in auditing
Culture should be the first concern of any
auditor, because here is precisely where
most future problems lie and where most of
their possible solutions can be found when
auditing accounts.
The broad experience of Lean Auditing’s
specialist consultant author, James C.
Paterson, as Head of the Audit Department
at multinational pharmaceutical Astra
Zeneca, allows him to assure that there is a
direct link between risk and control culture
in organizations; this subsequently reflects
in their accounting reality and financial
situation.
Audits have changed their traditional focus from cost control towards a global
strategy of risk management, governance, value creation, and organizational
culture. Auditing is a representative element of corporate culture because it
defineshowcompaniesthinkandact,butmanagedecisionsarethetruereflection
of how a company thinks and acts. Thus, this area expands its importance thanks
to its direct participation in risk management and value creation.
Strategy Documents
L19/2015
Focusing on value creation for
stakeholders: applications of
lean processes and systems
Reputation
Book Summaries
This document was developed by Corporate Excellence – Centre for Reputation Leadership and among other sources contains references to the
book Lean Auditing written by James C. Paterson, head of Risk & Assurance Insights, Ltd., and published by Wiley in 2015

2.
Book Summaries 2
Focusing on
value creation
for stakeholders:
applications of
lean processes
and systems
The key is that the procedures and decisions
that a company makes are coherent with
its values and policies. However, most
of the time, the values expressed are, in
corporate culture, less important than the
unconscious assumptions of the people in
the organization. Ultimately, those beliefs
are used to define more clearly the external
expressions of a specific mentality or way of
doing things, as the attitudes or behaviours
shown and decisions made.
The important role of bias
We know that, psychologically, we all
tend to reinforce our decisions –which
apparently are rational but have an
emotional origin– with arguments,
information, and data that justify them. In
other words, we see what we want to see.
In this whole process, memory, especially
selective one, plays a critical role.
According to Paterson, the same thing
happens in the cultural sphere of
companies (this has been validated by
a research conducted in 2010 by British
financial firm Lloyd’s): confirmation bias
is essential both in the risk acceptation or
risk appetite and its rejection.
It is also important to include a regulatory
role, played by the public authority or
government, in order to ensure that
certain rules about how the company
works are observed, keeping in mind the
external perceptions mentioned above.
Both the external rule and internal culture
directly affect the company’s behaviour
and decisions.
Even though financial controls are
normally the centre of attention when
trying to improve work effectiveness, the
operative processes and the regulatory
compliance often play a more important
role. Organizational culture is specially
the one with an actual impact on the mid
and long term.
Cultural barriers for internal audits
Some of the usual dilemmas in auditing
when talking about organizational culture
and regarding a broader function of this
role are:
• Differences between the stakeholder’s
visions about their expectations
regarding an internal audit. Some see
a higher potential of this role.
«Alignment
of the risk
culture with the
corporate culture
is a key elements
to guarantee
the efficiency of
value creation»
Figure 1: Cognitive dissonance
Source: Lloyds - Emerging Risk Report Behaviour
MADE A PROFIT
(OR WOULD HAVE)
MADE A LOSS
(OR WOULD HAVE)
REJECTED
THE RISK
ACCEPTED
THE RISK
Memories are
focused here
BAD
BAD
GOOD
GOOD

3.
Book Summaries 3
Focusing on
value creation
for stakeholders:
applications of
lean processes
and systems
• A limited understanding of the three
lines of defence model. An internal
audit is considered a quality control
process in management (second line
of defence) rather than a process to
guarantee that quality (third line).
• The perception, based in bad
experiences, that guaranteeing
quality in management and corporate
governance are functions which,
rather than enabling organizational
performance, hinder it.
• An excessive trust in past successes
that is projected on the future.
This perception entails risks
of complacency and a lack of
imagination when trying to change
the perspective, even when things are
not turning out right.
• A trend to overreact to real
or imaginary risks taking
disproportionate decisions.
Therefore, an internal audit is important
to spot cultural barriers that hinder
improvement and effectiveness within
the company to help those who are truly
interested on it: the stakeholders.
Analysis of basic causes (or root causes)
A systematic and deep analysis of the
reasons that cause a negative scenario
in companies is useful to find long-term
solutions to reduce the likelihood of risks
and their impact in the future. Thus, the
best auditors are those that fix a problem
but also identify its root, this is to say,
the basic reason that caused it in the first
place.
In comparison with other methodologies,
the analysis of root causes generates fewer
explanations for a problem but identifies
thosewithacommonrootand,henceforth,
enables more efficient solutions.
Besides, this kind of analysis is particularly
interesting when a company experiences
the same mistake over and over, when
consequences of an activated risk are
«An internal
audit is
important to
spot cultural
barriers
that hinder
improvement
and
effectiveness
within the
company»
Figure 2: Organizational Effectiveness system
Source: RiskAl.co.uk
External
Enviroment
Mission &
Strategy
Organisation
Culture
Systems
(Policies
Procedures)
Individual Needs
& Values
Structure
Task
Requirements &
Individual Skills
Abilities
Leadership
Management
Practices
Work Unit
Climate
Motivation
Individual &
Organisational
Performances
Culture / Behaviour
- An outcome
Performance / Issues
- An outcome

4.
Book Summaries 4
Focusing on
value creation
for stakeholders:
applications of
lean processes
and systems
important, when similar problems happen
in different areas or when the performance
is consistently low compared to generated
expectations.
There are different systems and tools
that allow companies to know those
fundamental reasons, often hidden from
the naked eye, that have indeed a great
impact on risks:
• The 5 Whys: a technique used by
Japanese company Toyota consisting
on asking five times why a problem
was caused until its true nature it is
known.
• Fishbone Diagram: the reasons of a
problem are fit together to offer an
integral and full vision and be able to
remove information gaps and identify
the causes.
• Organizational Effectiveness (OE):
allows companies to spot root
causes and identify key vectors for
organizational culture and manager’s
behaviours so that they can fit the
cultural reasons together with the
performance elements and the
different issues.
Conclusion: audit to create value
Lean philosophy significantly improves
corporate management because it identifies
assumed risks. It is centred in the mid and
long-term implications of the decisions
made, which are aligned with the risk level
previously established by the C-Suite.
In the case of an internal audit and its
traditional function of financial control,
lean mentality contributes to value
creation for the stakeholders of a company
and guarantees better productivity and a
more influential and decisive way of doing
business.
Thus, the goal in intern auditing is to offer
independent and objective counsel to all
the stakeholders of a company about its
management and performance so that it
can provide a true value. To do so, the
traditional focus on the cost control and
regulatory compliance has to be expanded
to also include risk management and other
aspects related to corporate governance
and organizational culture.
To reinforce this approach, we can study
examples such as the British financial
services company Barclays, which
incorporates its corporate culture into any
kind of auditing; or 3i, a venture capital
company headquartered in London, that
considers corporate culture as something
attached to the daily work of the auditing;
or even the example of BAE Systems, a
British multinational defence, security
and aerospace company, who defends that
most of auditing conclusions are engaged
with cultural aspects.
At the end, considering all stakeholders,
making decisions that are coherent with
the corporate values, the commitment
of the managers with their company, the
application of risk management in all
corporate activities and, specially, the
alignment of the risk culture (appetite vs.
rejection) with the corporate culture, are
key elements to guarantee the efficiency
of value creation suggested by the lean
paradigm in business management.

5.
Leading by
reputation
©2015, Corporate Excellence – Centre for Reputation Leadership
A foundation established by major companies aiming to excel in the management of intangible assets and facilitate promotion of strong
brands with a good reputation and a capacity to compete on the global markets. Our objective is to become the driving force, which would
lead and consolidate professional management of strategic assets and resources, which generate value for companies all over the world.
Disclaimer
This document is a property of Corporate Excellence – Centre for Reputation Leadership developed with an objective to share business
knowledge about management of reputation, brand, communication, public affairs and non-financial metrics.
Corporate Excellence – Centre for Reputation Leadership is the owner of all rights to the intellectual property related to images, texts,
drawings or any other content or elements of this product. Corporate Excellence – Centre for Reputation Leadership is the holder of all
necessary permissions for the use of the document and therefore any reproduction, distribution, publishing or modification of the document
without its express permission is prohibited.