A major step to get high value findings is simply allowing auditors to have enough time at the right moment of the audit. It is indeed quite surprising to see how much audit value depends on its schedule execution.
Some critical audit phase will be spoiled if the audit schedule is not sufficiently under control. The resulting audit report will not contain high value findings : reported facts will be accurate but will not be interesting for the management.
Plan the audit phases, and stick to the plan in order to yield value for money audit
This best practice is dedicated to the audit manager. The auditors job will be to perform many interviews and receive hundreds of documents. Their challenge is to process this high volume of information and catch the high value findings. This is the data processing phase at the heart of the audit. It is mostly independent of auditees and therefore can be well controlled by auditors. Its auditors job to follow the planned duration as it lies between 2 risks:
1- Too slow data processing, will affect the report writing quality and clarity. Indeed it will push the end of audit towards fast writing sequence. Unfortunately good writing requires time … and some rest between writing sessions in order to get several opportunities to have a fresh look at the report.
2- Too fast data processing, rushing to start report writing, will not leave sufficient time to auditors in order to catch the high value findings. They will use the easy findings, usually already known by the management. In order to get good findings, auditors need time to link and understand what they have already found. They need time to further interview auditees. If writing is already started it will be extremely complicated to rewrite each time a new high value finding arise.
With some audit experience, it is quite easy to plan the duration of the audit phases. They are usually: specifications, interviews, data processing, report writing, final validation. Length depends on the number of interviews scheduled, travel made, number of senior management involved during the final validation.
Data processing includes further questioning and findings validations
At this middle phase of the internal audit, auditors should recontact auditees in order to validate findings and ask further questions. Often, interesting clues have been collected but are not yet true findings.
The audit follow a V shape beginning with the overall objectives and finishing with an executive one-page report. We are here at the lowest spot of the V shape. The value of audits is built here, when the auditor is usually alone and under pressure from the amount of documents to analyze and synthesize. It’s at that moment that he should hold on and use the scheduled time to produce the high value findings.
During interviews, start with the important questions instead of the general “discovery” questions.
Often auditors have the time to ask only 5 or 6 questions. It will be therefore important to:
- Not plan too many questions for an interview. It is then necessary to prepare only few targeted questions. Auditors will be quite sure to ask them.
- Avoid useless general questions as they almost never yield high value informations. They are often wrongly used at the beginning of interviews due to insufficient preparation or for unnecessary ice-breaking.
Final “prevalidation” of the audit report is necessary. It will insure the good hard findings.
Auditors must prevalidate the report with the auditees before the final presentation to senior management. It means that findings and the way they are written and fit together in the report must be exposed to auditees who should have the opportunity to respond and if necessary suggest adjustments. Of course only auditors can write the report and they will take only the feedback that will appear acceptable to them.
It is quite interesting to see that auditees can quite easily reject important findings. This can happen even at the very end of an audit, for minor reasons. If some details are wrong, it will bring doubts and shadows to the full report. Therefore prevalidating the report will allow to express findings in a way that make them acceptable to auditees.
– – – – – – – –
This new best practice follows 3 best practice focusing on making clear audit reports. They have not yet addressed what questions to ask: it is the focus of this next best practice.