Auditing for the

21st century

With traditional auditing techniques coming under scrutiny, Steve Buxton explains a new assessment approach that focuses on behaviour

As organizations become more complex and sophisticated to meet ever increasing 21st-century business demands, the critical reliance on the appropriate behaviour of staff is amplified. Businesses that run without an understanding of the underlying values and beliefs of all stakeholders may enjoy short-term success, but more by luck than judgement.

In the longer term they need the engagement of employees and suppliers and close alignment with the expectations of all stakeholders – firstly in order to survive and ultimately to excel in their chosen marketplace.

Beliefs, values and habits shape the behaviours of individuals and therefore the collective behaviour of whole organizations. Both have a direct effect on systems, processes and business results. Measuring these attributes provides a leading indicator of what is likely to happen in the future, not what happened in the past.

Until recently, attempts to assess and understand the enablers and constraints that impact on a business have relied on the tactical compliance-level review of documented procedures and associated records. This is on top of time-limited face-to-face gathering of facts from a thin slice of the business, while attempting to comprehend a wide range of interconnected disciplines and issues.

It’s no wonder that the outcome is often disjointed, not strategic, and seemingly of limited relevance to senior decision-makers within an organization. Worse still, such approaches report only on what has happened in the past and not on what is likely in the future.

Traditional auditing is only able to measure past performance because it concentrates largely on the assessment of records and recollection of employees and has a limited opportunity to predict risk. If we can identify the shape of things to come, we can then make timely and informed adjustments.

Another way

The behavioural assessment approach is not a replacement for face-to-face assessment techniques. Rather, it is a means to enhance that vital interactive process by providing risk profile data that enables the planning process to focus on the most likely risk areas.

An effective way of deploying behavioural assessments is to deliver the tool online via a web portal that presents the participant with a series of statements and a multi-choice response set. These choices provide evidence of compliance and the effectiveness of either clauses or sub-clauses of a standard or identified drivers of management system performance. For example, it could be based upon the eight quality principles that underpin the ISO 9000 series.

The optimum result is obtained when all roles and functions within an organization are included in the assessment to gain 360-degree feedback. However, a large overall participation rate is not necessary to produce a stable representative picture of what is happening (typically this emerges at participation rates as low as 10 per cent).

It is critical that the results of the assessment are co-reviewed with the participating organization to ensure that the risk profile can be interpreted in the context of the business from which the data was derived. Behavioural assessments are not surveys, which have in-built weaknesses making them unreliable as assessment techniques.

Results from the deployment of behavioural assessments have been startling. In all cases viewed so far, the areas identified as potential risk have uncovered real issues when followed up with face-to-face auditing. This pattern has been seen across a wide range of standards and frameworks including ISO 9001, ISO 14001, OHSAS 18001, ISO 13485, ISO 27001, health and safety and customer satisfaction.

Table 1 shows an example of an assessment of the people management process within an organization, with a score of 40 per cent representing ‘just OK’. Note how quickly the areas of risk can be identified both graphically and numerically.

Table 1: People management - human capital

Performance Driver Description %
1 Managers lead people effectively 33.0
2 The organization's culture is customer focused 46.7
3 People's training and development is managed and takes place 12.3*
4 People's financial and non-financial reward recognizes what they do 31.9
5 The physical work environment is conducive to good work 44.9
6 People are motivated and feel involved 35.7
7 Career development takes place 22.9
8 Financial and project information supports the business 18.9*
9 Improvements to the organization's training and development process take place 17.1*
10 Everyone in the organization works together as one team 33.1
11 People's performance is managed 14*

* Areas of largest risk

It is clear that certification bodies are beginning to hear customer concerns that traditional auditing is not delivering the output required to enable informed decisions to be made. They are also beginning to see that behavioural assessments are being deployed to enhance the overall management system assessment process, be it for internal audits or external certification.

About the author

Steve Buxton is an independent management system expert and worked for ten years at Underwriters Laboratories heading the health sciences regulatory certification business. He is currently an associate at Alacrita LLP E: steve.buxton@live.com