Where is the Gemba in the Internal Audit Process?

And why the review process should not be dreaded

Originally a Japanese term, Gemba refers to the "actual place" – the place where value is created. For an artist, for example, it may be his or her art studio. For a football player, it may be the football field. For a salesperson, it may be when the deal is closed. But, what if we shift this concept to the internal auditing world? Where is the Gemba in the internal audit process?

My belief is that in the internal audit process, the Gemba is located in the review process. Let me give you a few examples:

The Fraud that would not have been detected

Consider an example from a vendor review I was involved in. During the audit, I noticed that the services supposedly performed by the vendor were not being signed off by management. Strange. All other vendors who supplied services to this business unit had been signed off by management attesting that they were indeed performed. Bringing this concern to the auditor-in-charge initiated a deeper investigation, leading to involvement from upper management and the discovery that the services were never performed. In addition to this discovery the investigation later determined that one employee was in on the fraud. Bingo.

The report that would never have existed

In another scenario, a staff auditor expressed doubts about our ability to gather certain data points necessary for evaluating the efficiency of an important operational process. The information needed was not in one, not in two, but in three different systems. There was doubt that we would be able to clean and cross reference the data enough to make it digestible to operational management. However, a collaborative review with the auditor-in-charge and the audit manager revealed that not only we had access to the necessary data, but that we could also present it in an easily interpretable format. At the end the report was not only feasible but was also welcomed by management as a value-added tool.

The cost recovery that would not have occurred

In the last and final example, a staff auditor performed a process to identify duplicate payments. Upon first inspection, approximately $4K was recovered. After the process went through review an additional $200K was identified and recovered. In this case, the review process served as a quality check  and should be perceived as such. The review process may be dreaded by many as a red-ink party, non-value-added nuisance, but when done well it is, in my opinion, the most important part of the internal audit process.

Final thoughts

These examples emphasize the important role of the review process in internal auditing. It is in these moments of collective analysis and brainstorming that true understanding and insights materialize. The review process serves as the Gemba, the "real place" of value creation, where ideas are developed, and solutions are built.

The Gemba in internal auditing isn't just about the physical location of audit activities. It's more about where critical thinking, problem-solving, and value addition predominantly occur. It's in the moments of collaboration, discussion, and intellectual engagement that the essence of Gemba comes to light in internal auditing.

I invite your perspective on this: where do you think the Gemba is in the internal audit process?