Part I · Chapter 1 · The Ask · lesson 6

Why you are not allowed to be the one who says you did it

10 min

You can do every part of this yourself. You can draw the boundary, write the policies, run the reviews, collect the artefacts, and assemble a folder that answers every question anybody has ever asked you.

And then you cannot sign the last page, and no amount of being right about the rest of it changes that.

Predict

Why can an organisation not issue this about itself?

Because the frameworks forbid itBecause you would not be honest about yourselfBecause the value of the document is entirely in the reader's position — a buyer cannot check you, so the only thing they can rely on is that somebody with no stake in the answer didBecause an auditor has tools you do not

Independence has a narrow technical meaning and a blunt practical one.

Technically: the person forming the view has no interest in what the view turns out to be. They did not design your controls, they do not operate them, their fee does not depend on the conclusion, and they are accountable to a professional body rather than to you.

Practically: their calendar is not your calendar. They have a finite number of weeks in the year, those weeks are worst at the end of a calendar year and quarter, and the fieldwork leg of your countdown belongs to them.

That second meaning is the one that bites. Every other date in this subject can be moved by working harder. This one can only be moved by booking earlier.

The part you can do, and the part you cannot

There is a second kind of audit here, and conflating the two is common enough to be worth separating now.

One framework expects an organisation to audit itself on a cycle, as part of the management system — findings and all, which the external auditor then reads. The clause to look up in your own copy is 9.2. The decision it forces is who performs that internal audit, and the only hard constraint is that it cannot be the people who own the thing being audited. Your own staff can do it. Somebody auditing their own control cannot.

The external opinion is different in kind. It is not a better version of your internal audit; it is a document addressed to somebody else, and the reason it exists is that the somebody else has no way to check you.

Not the same thing

A self-assessment

Your own judgement about your own controls, written down by the people who run them.

Measured in: How useful it is to you
For example: A spreadsheet marking fourteen controls as in place, with notes on the three that are not.
Chase it alone and: It is worth a great deal internally and close to nothing externally, and the gap surprises people who put real effort into it.

An independent opinion

A view formed by somebody with no stake in the answer, addressed to readers who cannot check you themselves.

Measured in: Whether a stranger can rely on it
For example: A report naming the period, the boundary and every exception, signed by a firm that answers to its own regulator.
Chase it alone and: It is slow, it is expensive, and the constraint on it is a calendar you do not control — which is why it decides your start date.

Both sides accept
Both look at the same controls and both want the same artefacts. The difference is who the document is for, and that difference is what independence is protecting.

Which is which? Put each one on a side.

The person who built the access review process checks whether it ran
A firm with no commercial interest in the conclusion forms a view about the same reviews
Your colleague from another team audits a control they do not own, and writes up two findings
The fieldwork weeks that sit between your period closing and the report existing

Something people say

“We will do the work ourselves and send the buyer our own assessment — it is the same controls either way.”

Why it spreads: Because the first half is true and the saving is real. A capable team can do every piece of the preparation, and a self-assessment genuinely does find most of what is wrong. The step that fails is the last one, and it fails for a reason that has nothing to do with the quality of the work.
The part that is true: The controls really are the same controls, and the self-assessment really is the fastest way to find your own gaps. Doing it is not wasted effort — it is the right first move, and this course is largely about doing it well.

What exactly is missing from the self-assessment?

Check

Your consultant designed your controls and now offers to perform the examination as well, at a discount. What is the problem?

The discount suggests they are cutting cornersThey would be forming a view about their own design, which is the one thing the document is supposed to rule outNothing, as long as they disclose itIt would invalidate your certificate

Worth remembering

Independence is the product, not a quality step: the document exists because its reader has no way to check you themselves.
A self-assessment can be more rigorous and better-covered than fieldwork and still supply none of what a buyer needs, because the gap is the author's position rather than the work.
One framework also expects you to audit yourself on a cycle; your own staff may do that, as long as nobody audits a control they own.
The fieldwork weeks belong to somebody else's calendar, which makes them the one leg of the countdown that working harder does not shorten.
Firms are worst placed to form a view about controls they designed, which is why a consultant who built your controls is normally separated from the examination of them.
Decide early whether an independent opinion is in your future, because that decision is what puts the fieldwork weeks on the calendar.