Beyond Audit. Robert L. Mainardi

auditors have to realize that in any audit, getting the information to do the job requires many requests (usually more than one per need) for information, data, and explanation. To fulfill that need, we can establish a weekly meeting to discuss the status of the audit as well as outstanding requests to date. This meeting provides a perfect forum to facilitate active follow-up and communication of the work in progress, completed, and still to be done. Additionally, auditors benefit by being well informed on any of their work in progress and can communicate it back to their management team, keeping them informed of the audit in progress. When you look at the weekly update meeting from the business team side, tell them this meeting is to provide an up-to-the-moment status on the audit, documentation and data requests, as well as any issues noted to date. Business team management wants to be made aware of the issues because it will provide an arena to clarify and potentially quantify the issues identified in the status memo. Keep in mind that auditors never, ever put an issue in the status memo until and unless it has been validated by the audit team as authentic (poses a risk to the business unit achieving its objective(s)) with someone in the business unit. Auditors do not want to go into a status meeting with an issue that has not been validated because if they are wrong, it will impact their credibility not only in this meeting, but also for the rest of the audit. Each time an auditor brings up any issues from that meeting forward, it will be called into doubt because of a single mistake made in a status update meeting. Ultimately, though, I will leave the status meeting frequency up to my customer. If my clients prefer to have a meeting every two weeks, that is their choice, but I let them know the associated risks. Having a longer time between status meetings does not impact the business partner as much as it does the auditor because they could possibly have to wait 10 days to get an answer or a delivery status on a requested item, which could impact their ability to complete the task and meet the budget.

As referenced in the previous paragraph, to effectively facilitate this audit status meeting, a formal status memo is created by the audit team and provided in advance to their business partner. This allows the business personnel to review the document and prepare any questions regarding its contents and obtain an update on any and all outstanding audit requests. As you complete the audit status template, keep in mind there are a few specific objectives of the template. First and foremost, the status memo provides a percentage completion status of each phase of the audit. It details the planning, fieldwork, and reporting phase completion percentages. This provides your business partner with a snapshot of the audit at any time and helps guide them on the time remaining in an audit (which always seems like it is not soon enough for them). Second, the status memo details any identified and validated issues that have been noted to date. Remember that these items, to appear on the formal status memo, must have been validated with someone in the business processing unit to ensure the audit is interpreting the testing data accurately and fairly. Also, there is a section below each issue requesting a proposed management action. It is proven that the sooner you start discussing the issues and requesting a management response, the more effective the audit report phase. This additional section assists in facilitating a root cause (Chapter 7) discussion and proposed management action to properly address that cause and ultimately the identified issue. Third and just as valuable, the status memo details any outstanding audit requests for documentation, data, or samples. Again, in an effort to facilitate what could be a challenging client discussion, the status memo indicates when the request was made and that it still remains unfulfilled. From the date requested, it is simple to see how long this item has been outstanding and allows the auditor to explain that the work cannot be completed until that information is received. This results in a longer audit, which neither the audit team nor the business client wants. And finally, the status memo outlines the remaining steps in the audit, including, where applicable, the projected target date (i.e., the draft report, final report, survey). Overall, the status memo provides a quick snapshot of the audit status and gives the auditor an effective tool to facilitate the meeting with confidence.

      As discussed previously, relationship building is a critical part of any audit and business partner relationship. Auditors leverage this relationship to assist in the facilitation of all phases of an audit, from planning to action plan implementation. We are going to discuss both the relationship values in every phase of the audit and the need for audit to remain focused on relationship building.

With the unplanned emergence of remote auditing due to the pandemic, business partner relationships have become even more important to the success of every audit. These relationships fuel and drive the learning and sharing of critical business process information and required data sharing. As we go through the discussion of each audit phase, consider how focused your audit team is currently on relationship building. Does your team dedicate the time and resources it takes to foster and strengthen the audit and business partner relationship? Is there an interaction with business personnel? Or is the audit team too focused on getting the fieldwork completed and the final report issued so they can move on to the next project? I totally understand. Finishing outstanding audits helps the audit department move the coverage needle and get closer to completing the communicated audit plan. However, being in audit is not solely about completing the audit plan. Also, just because the team finishes the audit plan, does not translate into the audit department adding value to the company and being seen as a true asset to business operations. The audit department should be building on their existing audit knowledge, obtaining a more detailed understanding of the business objectives and corresponding processes, and providing value-added recommendations to their business counterparts linked directly to the achievement of the confirmed business objectives in the most effective and efficient manner. Unfortunately, those critical skills and business knowledge can only be developed from conversations and exposure with the business partners. The business personnel have the detailed information that can assist in auditor development. The knowledge auditors can develop and build on will make them a more valuable partner and asset to the business partners as audits continue to expand in scope and criticality. So, let's first examine each phase of the audit and discuss the role the auditor and business partner relationship plays in the successful completion of planning, fieldwork, and reporting.

      To successfully complete any phase of an audit or any project, you must have specific and clear understanding of the objective. Remember, when talking about an objective (as a noun, not an adjective), it means purpose. Once you have identified the purpose, you can direct all efforts to building a stronger understanding, work plan, and valued feedback to your business partner to assist them in achieving their goals. Without this knowledge, how would you know what topics to understand, red flags to looks for, data to test, and recommendations to develop?

AUDIT PLANNING

      So, let's first start with the audit plan. You have been given an audit and begin to compile critical business process–level information related to a particular business unit, which you may or may not have encountered before. Additionally, it may be the first time the audit department has audited this particular area, so there are no previous audit reports or documentation to provide any background on your new assignment.

      How do auditors approach such a task when they are beginning at ground zero when it comes to information on this unknown business function? Most auditors will do the obvious and go straight to the internet and research this particular topic to see what most common information about this process is available. They may go to their favorite audit-related internet site to try and obtain more information or possibly “canned” audit programs related to their assignment.

Keep in mind that after your online research efforts are complete, the information you have obtained is only a general overview and does not in any way, shape, or form represent the business processes within your company. Every company and its corresponding business support processes have specific requirements that are unique to their way of doing business. And those unique business characteristics can only be learned from the business personnel and not the internet. Thus, there is a mandatory need to establish a good working relationship with the business partner to gain a baseline understanding of the function. If this truly is a business function the audit department has never reviewed, it is going to be critical for the lead auditor to ensure they explain to their business contact the audit department