The covid pandemic has been a case study in risks and controls. That context offers insights into the decisions of our elected leaders, the actions of compliant and resistant citizens, and the growing knowledge of public health experts. Throughout, everyone has struggled, and the contagion prompted me every day to think about risks and controls for my well-being.
Wear a mask, wash your hands, maintain a six-foot distance, avoid large indoor gatherings —you know the simple controls that would reduce the risk of infection. But the dangers of infection for individual vary widely, from barely noticeable symptoms to hospitalization and death, with youngsters seemingly immune and the fragile elders and those with underlying health conditions more vulnerable to complications. Some people see only small personal risk, while others fear the worst.
But we still agonize over many other risk and control questions—whether masks are still needed on someone who had covid or got vaccinated, when herd immunity will happen, or whether children might carry the virus home from school. We needed a risk decision for every action, and the research was catching up with this new type of virus. We also had the “dropouts” who rejected all these ideas and the virus as nonsense, and those others who refused a vaccination.
We humans are not good at assessing risk or controls. Nobody teaches us about those concepts or how to weigh them, even though they are pervasive in our lives. We spend millions of dollars on road signs and signals, lane markers, barriers, and traffic enforcement, but tens of thousands licensed drivers still die in preventable accidents each year.
“I’ve got this under control,” is probably high on the list of famous last words. That’s the challenge we face as auditors. Situations are complicated, and people react to them in even more confounding ways.
There’s another trade-off we sometimes forget: cost and benefit. The economic cost of shuttering businesses has been obvious. All those fun, social things were gone: theaters, music, restaurants, wedding parties. Yet the benefit was hard to measure. “Staying healthy” didn’t seem like a benefit, only the status quo. This was because a small percentage of people were hospitalized, and even fewer died. And so, many people saw many costs, little benefit, and were insensitive to the conflagrations that overwhelmed our health care systems.
One of the more perverse complications in all this was the time lag of contagion. We could be infected and spreading the virus for days before we had symptoms. The geometric growth of infections was on us before we could react. People can’t easily connect activities with consequences when the feedback is a week or two after exposure.
Of course, public health professionals gave us guidance, but it emerged slowly, and we weren’t the most astute followers. Even with that guidance, we needed to incorporate our own social and personal circumstances into these multidimensional decisions, which involved our health variables, the daily risks, uncertain controls, inexpressible costs, and intangible benefits. People want clear and simple guidance, and when they can’t find it, they either go for extravagant compliance or exasperated rebellion. As a result, we saw the full range of responses, from individuals living in solitary confinement to others carrying on without regard to any consequences.
I was imagining an “if-then app” on my phone, regularly updated with better probabilities, to help me judge the risk of a situation like going for a haircut and the alternative mitigating controls so I could judge their costs relative to the benefit of looking better. That’s an easy one, but more difficult situations can be imagined involving dentists, airplanes, or ailing relatives.
In a more complex audit situation, how do we simultaneously weigh risks, controls, costs, and benefits? When we conclude that an old information system is impeding an agency’s efforts, how do we judge the cost and benefit of recommending its replacement? How much of an impediment would justify its replacement? Despite the most extensive controls, new computer system installations mostly fail, and at great expense. I think those difficult decisions are one reason why we auditors only recommend, and management is left to consider and reject our conclusions (another reason being the independence standard, of course).
If we are to succeed in our work, we need to guide public managers and employees to help them find the right alternative. I still think about the beleaguered caseworkers in child protective services who had a procedures manual nearly a thousand pages thick. Those were all “controls” to manage, though they couldn’t answer the most difficult question in those critical, professional moments—whether to remove a child from their family. Because, you see, those decisions involve those many variables and unknown risks, uncertain controls, inexpressible costs, and intangible benefits. However, management (and auditors) could apply hindsight and one of those many pages of simple instructions to condemn the caseworker when something went terribly wrong for a child.
Police officers are trained to establish control to reduce the risk of harm to others and themselves, but we know that the costs and benefits of those controls are very different in every situation, and for every person. Some decisions are easy because the situations present more immediate information to make those judgments. Other situations, shaped by officer stress, limited information, and demands for quick decisions will, in hindsight, reveal the judgments as very poor. No procedures manual will be adequate, and no amount of training will prepare the officer for the work. Here, I am talking about well-intentioned officers—the majority in police forces—and not the cruel, violent, or prejudiced officers who violate all our norms of public service.
Where do managers learn how to find the sweet spot of risks, controls, costs, and benefits? Very few public administration programs offer anything like it. Where do we auditors learn all that? How much objective analysis goes into the costs and benefits of our recommended controls?
We are sometimes called upon to conduct an audit after a tragedy involving a hapless client or member of the public. Hindsight is a wondrous power and we auditors have a sincere desire to identify strategies to better control that thing that happened, or might have happened, or might happen in the future.
If we find patterns of flawed decisions, what would we recommend to address those complicated situations where public employees must correctly assess and act on the perceived risks, controls, costs, and benefits? How should managers set expectations and hold public employees accountable to deliver wise choices, when it can’t be done with even a thousand pages of rote procedures? There doesn’t seem to be an audit term for the management responsibility over those employee activities that can’t be “controlled.” Maybe coaching? Guiding? Mentoring? Influencing?
That kind of expectation-setting doesn’t come from textbooks or lectures, but only occurs when participants are put through many realistic scenarios. Granted, these scenarios cannot impose the pressures of the real situations, but later, in practice, amidst the real-world stresses, a well-trained caseworker or police officer has a better chance of success. Experienced employees, who contain a world of scenarios and responses, could contribute to the training, and describe why some actions succeeded and some failed. I know some police agencies are already using scenario-based learning.
I have been writing about agency risks, controls, costs, and benefits. Scenario-based learning could also enrich our audit decisions because every audit plan has trade-offs among the risks, controls, costs, and benefits. We don’t have my fantasy phone app, but I think the Standards expect this wisdom falls under “auditor judgment.” We should consider the risks and mitigating controls of taking on an audit topic, and public benefits as well as the costs. Audit training could also sensitize us to complex situations in the agencies we audit, improving our recommendations.
We have some informal professional resources available to us. ALGA sponsors mentors who can offer advice and alternative thinking. During my career, the audit leaders at the annual conferences were generous to me with their wisdom when I asked for it. The audit abstracts offer us additional advisors on those topics. If we organize our questions and thinking within a framework of risks, controls, costs, and benefits we will develop better auditor judgment.
