Audit

The Audit Building Block includes more than traditional financial and compliance auditors. Any function which inspects and judges others, and reports the results to someone other than those being inspected, is considered Audit.

Audit may even have some authority to block others (veto their requests or decisions). This is the only Building Block with such power; all the others focus on serving, not judging, others.

Audit is distinguished from service-oriented Building Blocks in that it delivers its findings to someone other than the people being judged. While Auditors should treat those they're examining professionally, these are not their customers. Rather, they sell their services to people other than those whom they inspect, such as the enterprise's Board or external entities.

For example, a testing service which Engineers can voluntarily use, and where the test results are reported back to the Engineers, is not Audit. (It's a Service Provider.)

Similarly, on any topic, an assessment service that delivers findings back to the people being inspected to prepare them for real audits is a service, not Audit.

Audit's job is to catch people who are not in compliance with rules (such as security policies, regulations, and financial reporting), or to stop people from making mistakes.

The mission of Audit is strictly to uncover problems. It must not recommend corrective actions to those problems. Auditors' expertise in finding problems doesn't qualify them to design solutions (which requires the expertise of other Building Blocks).

Furthermore, recommending solutions would be exercising undue influence, a conflict of interests. Imagine the Internal Revenue Service recommending that you solve your compliance problem by buying a particular brand of financial software!

Also, if Audit recommends solutions, it would no longer be "arm's length." It might judge more harshly a solution that complies but isn't what it recommended, or overlook problems just because others followed its recommendations.

Furthermore, Auditors must not disempower managers by setting objectives or giving orders. To have legitimacy, the order to comply with audit findings must come from one's chain of command, not Auditors.

Audit is not only a distinct building block of structure. It must be kept entirely separate from the other service-oriented functions. It's impossible for the same people to both serve and judge others.