Beyond Audit. Robert L. Mainardi

AUDIT WRAP-UP

The final point to review before we leave the audit approach discussion during a remote audit is the wrap-up phase. This is not usually considered an official audit phase, as most groups consider the audit to only consist of planning, fieldwork, and reporting. Now, I know how it feels when the audit report gets finalized and distributed. There is a definite sigh of relief that the audit is complete, and you have almost certainly moved on to the next project on the list. But is the audit really complete and over? The answer to that is no. There is file clean-up, survey distribution, lessons learned, and annual risk assessment updating (if required). File clean-up includes an internal review to ensure all audit sections are complete with the proper testing referencing and required sign-offs are evidence on all work performed. Lessons learned is an audit team–only meeting where the participants on the remote audit discuss critical aspects of the audit, such as how well did we plan, use technology where applicable, develop audit testing linked to the business objective, and productively foster the audit and business relationship. The lessons learned can be compared and used in unison with the audit client survey results to identify gaps in the audit process and suggest audit methodology revisions to strengthen audit execution.

      While these items in wrap-up phase are for the most part an internal exercise for the audit team, the audit survey process is still a critical outstanding item that impacts the audit and business partner relationship. The survey itself should have a targeted distribution. Many times, audit teams make the mistake of sending the survey out to the executive over the business process that was just examined and possibly including the business manager over the unit. However, if the audit team truly wants to solicit feedback on how well the audit was planned, the fieldwork was executed, and the report was generated, then you should be reaching out to the key business personnel contacts that the audit team interacted with during this challenging remote audit. Simply sending the audit survey to the executive or manager over the area being audited is not going to provide you with an honest assessment of how well the audit went or how effective communication was throughout the audit. That is going to require a different distribution to unfiltered feedback on audit's performance during this remote review.

      Audit surveys should be limited on the number of questions asked but require two responses to each question. The response should first require how important the item referenced in the question was to the business partner and, second, determine how well the audit succeeded in that effort. Additionally, the survey should include specific questions related to not only to the effectiveness of audit's communication but also the frequency of said communications. Communication will always be at the foundation for success for auditors and should be recognized as the cornerstone in your department and a mandatory core competency for every audit team member. The communication cornerstone concept will be discussed in Chapter 10. Without effective communication, audit execution and success, especially on remote reviews, will not be effective and will take much longer to complete.

CHAPTER 3 Marketing the Internal Audit Department

      CREATING YOUR AUDIT BRAND

      When you work in an internal audit department, it does not matter what types of audits you execute, where you are located, the tenure of the leadership team and staff, how long your department has been established at the company, or how exceptional you believe your street credibility is with the business unit partners. You still need to market your audit department.

      The fundamental question that every audit department should be asking themselves is, Do our clients know what we do and why we do it? Each time I facilitate training on marketing the audit department, I ask this very question, and the response is consistent. Not everyone in the company understands what audit's objectives really are, and most business partners just seem to tolerate the inconvenience of interruption to their operations when audit comes to town to review the business operations.

Trust me on this point: Audit departments do not want to engage with their business partners in the situation where the business personnel do not understand what audit does, why audit is in their operation, or how this particular business unit was selected for an audit in the first place. When the business unit lacks a fundamental understanding of the internal audit process, the audit and relationship starts off in a very strained position. Now, complicate this situation with a remote audit in which the auditors and business partners will not be meeting in person, and you begin to recognize the enormous hurdles that auditors must overcome to adequately communicate the purpose and details of the process to create a clear path for mutual understanding of how the audit will be executed. This further illustrates the critical need for the audit team to leverage their communication skills to be successful.

      So, let us take the difficult task of marketing the audit department step by step. The first question you are probably thinking about is why it is such a difficult task. Marketing the audit department is difficult because throughout history, audit departments have carried a bad reputation of being nothing but an impediment for the business trying to complete its day-to-day responsibilities. From the business perspective, an audit is a disruption to daily operations because the auditors have to learn the business, ask questions, get system access, do process walkthroughs, ask more questions, pick samples, execute testing, find discrepancies, ask even more questions, and then issue a report stating what the business does poorly. Keep in mind, that is the business perspective, and while it does outline, at a high level, the general audit process, the audit is not actually much of a distraction to daily business operations. But you can understand why it is so challenging to try and market the audit process to a business owner when audit comes with all of these preconceived notions of being a disrupting force. Truth be told, effective audit departments communicate at a high level and leverage the minimal client meetings to obtain critical process information and data to complete the audit without bothering business personnel. The 10 characteristics of an effective department will be revealed and discussed in Chapter 12. But for now, the focus is on effectively marketing your audit department.

DEFINING INTERNAL AUDIT

      The first step in effectively market anything is to ensure you can define what it is you are trying to market. It is not possible to sell (market) a process to a business partner unless you can explain what it is that you are trying to get someone to accept. And if this process does not have a corresponding value to your partners, they will not want anything to do with it. Without any solid, detailed explanation, any potential business partner will not be interested in what you are selling. Got it? For auditors to be able to market their process, it has to be clearly defined.

What is the definition of internal audit? Well, there are two ways to define audit, and we are going to review both of them to ensure you have the correct perspective when speaking about the audit department. First, internal audit can be defined from the “book” perspective. Internal audit is an independent, objective process that can provide consulting services and process validation reviews focused on improving business operations and adding value. The focus for the audit department is to assist the organization's business units to achieve their objectives in the most efficient and effective manner with the least amount of rework. Internal audit is designed to partner with business unit personnel to facilitate a formal review process methodology to identify, examine, and evaluate the business objectives and corresponding risks, controls, and oversight within each operation. Now, that is what I call a comprehensive definition of internal audit! I know every person who sees this definition will want to immediately incorporate it into all of their internal audit marketing materials. The facts are stated and there is a clear definition and distinction of what audit is doing on a day-to-day basis to make every business process a world-class operation (and the envy of all their peers). If it was not clear enough in those last couple of sentences, that was sarcasm. Does the previous explanation define what internal audit represents? Yes, but unfortunately with these “book”-type definitions, it might only be clear to someone who has a baseline understanding