I work in an IT audit and compliance department. A peer of two weeks whom I am informally mentoring is very enthusiastic and picking up the work nicely. Unfortunately, his attitude could be more proactive and his judgement can occasionally be faulty. For example:
He was given some change requests today to review. On some items, management oversight was inadequate and not timely - Sign off late by several weeks. From my experience, this should be noted for follow up with the appropriate party. Yet, no concern was ever raised.
Just last week, I was reviewing some of his work as part of peer QA, and the test sample chosen was not representative and hence any audit results derived meaningless.
Review procedures call for a adequate representative sample in line with risk tolerance thresholds, guided by one's professional skepticism / judgement. Hard rules such as X numbers of employees must be chosen or Y numbers of accounts must be validated are not practical. Rather, the size of the sample is governed by audit risk, so if there is more risk such when new systems come online, the test sample should be adjusted accordingly.
Many of these procedures are hard to definitively quantify, with no hard rules written down. Judgement and intuition must be used. I have reviewed with him the procedures to be followed for the different reviews, and reasoning behind such procedures.
How can I have this person be more proactive and improve his judgement in doing this work? Could something be lacking in my guidance?