Beyond Audit. Robert L. Mainardi

While all of these exist in most business processes, it is important to ensure that you understand the situations that allowed these types of transactions to occur.

The other critical detail that must be explained is what level of standard, formal documentation is required when one of these workaround processes is selected. Consider, the business team is performing their job by going outside the normal order of processing. The documentation included must clearly explain why this occurred and exhibit some level of approval. Hopefully, all workaround scenarios are fully explained in the policies and procedures and included the required documentation and approval required for each type. The final workaround point to discuss is the validity of this type of transaction. The key distinction in determining the appropriateness of a workaround is pretty straightforward. While workarounds exist and are necessary in business processes because no business process will be the same every day of the year, the validation of workarounds is determined by the control environment. What that means is that a workaround is appropriate if, and only if, it does not bypass a critical control. If a workaround procedure is used to avoid a critical or key control (approval, review, etc.), then it should be flagged and discussed as part of the standard policies and procedures. Keep an eye out for these types of controls and be sure to inquire as to the frequency of their occurrence. This type of information will provide insight to the day-to-day operations.

      As you complete your independent research of the business process and prepare to set up a meeting (in our remote audit, this will be a call), you must obtain and verify that you have the appropriate client contact. During the initial stages of a remote audit, you must ensure you have a client contact person who can be reached for any process validation, system access, sample selection, and data and documentation questions. Having an established client contact from audit kickoff will expedite the critical step of information sharing throughout the audit. Be aware and quickly raise the question within your own audit team if you have been assigned a business partner contact who does not have the time, information, or detailed knowledge to effectively and efficiently address specific audit questions. Without an effective business contact, the remote audit will stall on a regular basis. Keep your ears focused on identifying traits of a business contact who is not ready for primetime during your audit.

      If your contact is not reachable during normal business hours, is not able to answer process questions without having to validate the information before providing a response, and is consistently missing established deadlines for providing requested data, system access, or samples, you need to discuss the situation with your audit team and determine the root cause. Unfortunately, in these scenarios, it could be the result of a lack of experience or process knowledge or it could be because the business contact was instructed to review all requests and questions with a third party in the business unit to ensure only certain details and data are provided to the audit team. While it is usually a lack of experience or knowledge causing the delays in responding, there have been numerous instances where data and information was being scrubbed before giving it to the audit team. In the end, if your audit planning approach is complete and follows the Objective, Risk, Control process approach to be detailed in Chapter 5, ultimately the data and corresponding testing will validate the control environment and corresponding effectiveness. The only result of delaying the delivery of information to the audit team is expanding the length of the audit. So, when possible, be sure and verify you have a competent, knowledgeable business contact for your remote audit. You can accomplish this by building a rapport with the business contact during your relationship development by asking for their background and tenure in the department. This type of basic business experience knowledge usually provides a good indication of how smoothly information will be exchanged throughout the audit.

RESPONSIBILITY ASSIGNMENTS

Another factor that will contribute to the success of your remote audit will be the assignment of work to be completed in each audit phase. This responsibility is no different in a regular audit, as compared to a remote audit. However, the person responsible for keeping the audit on track should have a heightened awareness of the assigned task, along with the corresponding deadlines for each, as the tasks can get out of control from a delivery standpoint much easier on a remote audit. This is due to the fact that the audit team is usually physically dispersed during the remote audit and task delinquencies can go unnoticed sometimes until it is too late.

      To ensure remote assigned tasks keep to their assigned deadlines, the project lead or in-charge has to remain diligent in the tracking and monitoring of the business unit questions, data requests, and audit testing completion. Any delays, missed deadlines, or audit work challenges must be identified proactively and addressed with expediency. Too many times, the audit suffers from a lack of oversight on remote audits because there is a lack of regular and timely communication within the audit team. As previously discussed, remember how critically important it is for the audit team to maintain a high level of communication within the department and during audits to ensure all team members are aware of the deadlines and the urgency to complete assigned tasks on budget.

      One caveat must be mentioned when it pertains to assigned budgets. A budget is the documented estimate of time to complete a task, and it is based on either historical data or a projection that was formulated from the testing requirements to be completed. Keep in mind that budget estimates are just a best guess. Although they should be regarded as a guide for how long any audit task or testing should take to complete, budgets can and should be challenged when they appear to be unrealistic. Do not ever rush or force the assigned work just to fit into the budget number. That is a huge mistake. The moment you identify that there is no possible chance that you or any auditor could complete an assigned task under that corresponding budget, say something. Do not try to go faster to make the deadline just for the sake of the deadline. When that happens, whatever work or testing was supposed to be completed will get finished within the budget but will ultimately have exclusions and mistakes, along with a false sense of accomplishment.

One additional tip related to budgets: The moment you are certain there is not sufficient time to adequately complete the assigned task within the budget, reach out to your audit project lead and explain the need for additional time. Make sure you detail the initial budget, data and work required, and the time needed to review and conclude on the data. This will ensure you have considered all aspects of the task and sufficiently supported the need for additional time to complete the work adequately and accurately. In the remote audit environment, the budgets tend to be more aggressive because audit teams believe execution of the planning and fieldwork phase do not need any buffer time built into the assignments because there is no time for chatting about the work or relationship building. It is all about just getting the information and data and doing the work. In actuality, the inverse is true. In a remote audit, it takes more time for auditors to understand the process requirements and data being provided, so more time needs to be allowed for the audit team to ask qualifying questions to ensure the auditors fully understand the process before attempting to evaluate for the planning phase or reperform the process during fieldwork. So, before you begin a task or audit testing, make sure you review the work being assigned, along with the corresponding budget, and determine if the initial budget number matches the work assigned. Auditors should always closely monitor their own work and ensure they are delivering a complete quality product while communicating with the audit project lead on any work challenges and potential deadline extensions. This will assist the project lead in ensuring the business client during this remote audit is up to date on the status of the audit work being completed in their business area.

COMMUNICATING CRITICAL INFORMATION

In an effort to keep your business partner “in the know” during this remote audit, it is paramount to establish regular, formal status meetings throughout the audit. The frequency of these status meetings is usually established in the introduction or kickoff meeting. When I am leading an audit (especially a remote one), I will suggest to my business partner that we should have a weekly status meeting to ensure communication channels between the two teams remain open, clear, and strong. Along with my weekly status meeting request, I provide the need and benefits of the timing. When it comes to