Auditing mechanistic and organic systems. What objective evidence do we really need?
There are two types of system, mechanistic and organic or social. Mechanistic systems can be predetermined, and people have no choice but to comply, drive out variation, focused on outputs & are managed by SPC, Six Sigma, KPIs etc. When we audit these types of systems objective evidence is clear and while we audit we look for ways of improvement to help produce better results.
Organic or social systems cannot be predetermined or modelled, they are complex interaction of human behaviour (culture) in the ‘here and now’ where people have choice, from which risk and results emerge. It is focused on outcomes and managing variety by its nature. What then is the objective evidence in this living world? Of course, nothing is ever totally mechanistic or organic, the audit art is to understand this mix.
The methods for mechanistic auditing are will established. Start with a defined process or procedure, follow this and ask questions to auditees about what they do and collect objective evidence to show they comply and are effective and look for improvements and risks.
Collecting objective evidence in organic systems
The gathering of objective evidence in an organic system is more of a challenge as it is created at the time the human interaction takes place and cannot be predetermined. Often the details are not written down – they just happen as part of everyday live, they are not remembered accurately and of course the auditor cannot witness every interaction. But it gets more complicated. We could quantity the number of interactions, lets say there are 50 people who interact 100 times a day i.e. 500 interactions and then work 30 days in a month so 15,000 data points available for audit assuming the auditor could be there all the time.
But each interaction varies in its degree of effectiveness, to a greater or lesser extent, this is the qualitative nature of the objective evidence. This is isn’t necessary in mechanistic auditing as the behaviour expected is predetermined and there is no choice but for people to comply. Auditors in effect just check this compliance and make comment.
So, in an audit of the real world we need to quantify qualitative data and thus reveal the objective evidence needed. Part of this is not to establish what people do (mechanistic) but the impact or outcome of what they do on others and then the business outcomes as a whole.
Critically as mentioned above nothing is ever totally mechanistic or organic, the audit techniques needed are based on the nature of what you are auditing.
A new approach
What is happening is that we are trying to audit organic and living systems using the same mechanistic techniques which is inappropriate as by their nature the systems are different. Its, like comparing chalk and cheese. Maybe the reason for this is that we, as humans, do not have the mental capacity to collect 15,000 data interaction points, understand / place a value on the qualitative nature of each point and then a value on its effect on business results and compliance. Hence HPO RS Vista.
Given that culture is a social interaction we can enhance our auditing understanding by borrowing techniques more akin to social science. One such approach is Ethnographic which in overview is the study of group behaviour over time.
About the author: Ian Rosam from HPO Risk Solutions is the creator of unique intellectual property to measure risk and business culture to business and compliance management outcomes. A system thinker, author and facilitator supporting the implementation of ERM and Management systems. Ian has worked in many different industry sectors.