Sense-making, A Core Competency for Internal Auditing?

By Mikhail Ben Rabah, CIA, CFE, CRMA
Government Audit Manager, Presidency of the Government, Tunisia


Among the different meanings given to Sense-making, I do prefer the following “identifying problems at an early stage as they begin to manifest into larger threats”.

Sense-making has not to be confused with critical thinking or skepticism. Although there is some connection between the three concepts – all of them are exercised throughout the auditor professional judgement process and require a questioning mind -, sense-making is a crucial concept in preventive risk management.

Critical thinking has been selected by the Institute of Internal Auditors (IIA) – within the former IIA Global Internal Audit Competency Framework – as one of the ten core competencies needed to meet the requirements of the International Professional Practices Framework (IPPF) for success within the internal audit profession. On the other side, skepticism is considered by anti-fraud professionals as a key component that can strengthen an organization’s fraud risk management program.

While both, critical thinking and skepticism, are widely explored in internal audit resources and are commonly considered at the heart of effective auditor decision making, sense-making is rarely raised in the debate about auditors’ required competencies.

Sense-making is not just giving a meaningful sense to past events and decisions by trying to explain them, but “giving a sense to what can happen based on what happened”.


Defining sense-making in the audit work.

IIA standards and guidance implicitly addressed sense-making throughout the different phases of the audit. As a matter of fact, the IIA considers “being insightful, proactive, and future-focused” as one of the Core Principles for the Professional Practice of Internal Auditing. Obviously, this principle could never be achieved without effective sense-making.

Given their paramount role in risk management, internal auditors are the main providers of assurance regarding the risk assessment processes. Their unique position in the organization provides them the required tools and capabilities to listen to a range of voices in the organization and predict emerging risks and threats. Since major disruptions and crisis emerge from an incubation period during which some minor events combined together may evolve to a major meltdown, internal auditors are the best suited to predict the “unthinkable”. On the other side, risk owners (managers) always address risk from their own perspective and cannot have an overall overview of the organization’s risks.  

Furthermore, Key factors in any sense-making process are the ability to learn from what has happened in the immediate past. Again, internal auditors are the best positioned in the organization to do so.

Scanning the horizon for potential threats and crisis is in the core of internal auditing.  Hence, in large organizations, mature internal audit departments may create their unique processes to perform “sense-making” functions. Using data analytics tools and advanced risk identification techniques is crucial to achieve this challenge. Auditors should be enough skilled in these areas.

It is not a coincidence that many internal audit departments were among the first departments to be downsized due to the Covid-19 pandemic. Many of them failed to help organizations becoming better resilient to major crisis. While some believe that the current pandemic was “unthinkable”, it was perfectly predictable. Just for released movies dealing with pandemics, there were dozens of them. We knew that one day, it will happen.

Moreover, sense-making fits perfectly the Agile Internal Auditing approach and could be for a great help. I will discuss it further in a next article.


Upskilling internal auditors in “sense-making”

“Sense-making” is not innate but must be learned and developed over time. It is the responsibility of Chief Audit Executives to ensure that the audit staff is trained in sense-making. Here are some of the skills and properties internal auditors should be aware of to develop effective sense-making. Weick identified seven properties of sense-making (Weick, K. ,1995, Sensemaking in Organizations).

  1. Understanding the context and defining the identity of the organization is crucial. This is the foundation of any sense-making process.
  2. Retrospection and learning from past events.
  3. Enacting the environment by building narratives, charts and other visual representations which help reduce complexities and facilitate prediction.
  4. Sense-making is also a social activity in that plausible stories are preserved, retained or shared (Isabella, 1990; Maitlis, 2005)
  5. Sense-making is an ongoing process.
  6. Extracting cues and relevant information from the context to develop a larger sense of what may be occurring.
  7. Fostering plausibility over accuracy in accounts of events and contexts. “An obsession with accuracy seems fruitless, and not of much practical help, either” (Weick, 1995: 61). Artificial Intelligence is based on this concept, isn’t it?

Exploring case studies can be an effective tool to educate internal auditors in sense-making.