TIPS TO SURVIVE YOUR AUDIT...
"Nothing is certain in life, except death, taxes and audits", a phrase which I added to from a historic Benjamin Franklin quote. Whether it's an External Audit or Internal Audit, whether a Safety or Engineering audit, or even audits by Regulatory and Tax Authorities, all these audits have lots in common. The Auditors are there to verify your process controls, risk mitigations and compliance to rules. They request for data, they do checks, they ask lots of questions, they identify weaknesses and raise suggestions, they write reports, and they give ratings. At the end your Senior Management will look at the outcomes and make their judgement.
In my financial management roles, I've been audited many times. I took the approach to make the Auditors experience a love-hate one. I too wanted to terrorize the Auditors as I was tormented by some clients when I was at a Big 4 audit firm. Spinning to the other side I then took up roles leading Internal Audit functions and the torment returned, against me. I used this time to engage with Stakeholders at all levels of organizations and to listen to the Auditors views, to improve the engagement co-operation and the outcomes without compromising on the quality of the audit. Here are some of my generic tips to help you make your next audit more manageable... (If in hurry, just read the bold headlines)
Before audit starts:
1) Arrange a meeting with the Lead Auditor well in advance. Try to understand their audit process and approach in sufficient detail so you can identify any potential issues or risks to be understood or mitigated. You can share your own time challenges with the Auditors to include in their planning. It may be your first audit or a repeated audit, it remains a good step to achieve mutual understanding consistently throughout the process.
2) Ask the auditors before they arrive for fieldwork, what more can be prepared for them. They usually will send their requests but if you look at your work plan for the coming months, you may need to advise them upfront when best for the data to be requested and when best they could receive it. Such open and clear communication will be appreciated and allow for expectations to be met both ways.
3) Consider delegating the audit coordination role to a responsible staff. This way personal irritations of individuals can be calmed to a workable level. However, this could also serve as a bottleneck depending on the depth of the audit scope. The person allocated this role needs to put in twice the normal effort to ensure information flows fluidly and differences are dealt with appropriately.
4) Provide the data as per request and more, not less. This can be a daunting task when Auditors who may not understand your systems and processes, ask for the world of information. The next two tips will help.
5) Ensure the data request is discussed upfront to understand the specifications and purpose of it. To do this you and your team need to understand your own data capabilities. You may even need to research the data fields and layers available. This is to ensure the data extraction does not crash the operating systems. Consider proposing alternate data options to the Auditors as a compromise.
6) Do not just go and create the data required by mixing and matching databases. Last thing you need is spending over a week creating the data requested and the Auditors do not use it as it does not serve the purpose. Discuss the request with the Auditors and push back citing the immense resource challenge of preparing the data. However, be careful in case a bright Audit Senior steps up and shows you how easy it is to extract the data. So before pushing back ensure you consider all options.
7) In case the data volume is impossible to handle, then consider asking the Auditors to focus their data towards specific months or locations, where the data volume is more manageable. Here it's about providing solutions of compromise. Let the Auditors choose the refined criteria so they remain in control with their random selection and independent verification.
During the audit fieldwork:
8) At the opening meeting on day 1, provide the Auditors a presentation overview of your business operations. This could even take place weeks/months before or during any pre-audit stage. It's a great chance to show-case your department and to hear the Auditor’s first thoughts while building collaborative engagement. A more informed Auditor is able to do a better job and provide more valuable recommendations. Even if it's the same Auditors annually, a refresher will still add value.
9) Have daily close briefing sessions with the Lead Auditor. Here you can get a feel of potential issues which may require early clarification and also get first knowledge of any overdue items from your staff. Auditors may not be too critical of initial delays as they juggle the delays with other tasks. However it's best you probe them to be open even if it's just a light concern so you can take light steps to ensure it does not escalate.
10) For any interim audit issues uncovered, these could be addressed immediately even before the Auditors leave. They may still include it in their audit reports as they did find the issue during their audit. However the fact that it's resolved or implemented leaves a positive impression on the Auditors and your Leadership.
11) Ensure staff commit extra hours to cope with their daily duties and also with the audit requirements. The worst is to think that one question answered and you are done. There will always be more questions. There will also be more data required. So to ensure a smooth audit process the extra hours should be made available.
12) Reschedule low priority tasks and deliverables. If it's not critical it can wait a few hours or days. This applies to the department manager and the team. The aim is to offer the Auditors more of your time to allow them to conclude the audit faster and effectively.
Post audit fieldwork:
13) Actively engage with the Auditors until the audit report is considered final. After the fieldwork there may be questions from the Auditors for clarification. So encourage your staff to respond promptly and also interpret any future potential issues that may arise. Some Auditors leave the site with their final report ready based on the scope and depth chosen. Some may decide to continue with more analysis. Therefore best to adapt to the Auditors approach applicable to your entity.
14) Request a post fieldwork discussion with the Lead Auditor in case new information needs to be shared by you and any newly identified issues to be communicated by the Auditors. If you are expecting an issue raised and somehow you later uncover the facts which makes it a non-issue, then communicate this. It would save the time spent drafting the finding and saves your time in trying to cancel the issue when it is eventually raised.
Tips for Senior Leadership:
15) Encourage your managers and their staff to be complete in their responses to the Auditors. Staff should offer the Auditors opportunities to ask follow up questions and to also provide a bigger picture view for them. This way the Auditors will gain the best possible understanding before they raise any issues. Limited responses could lead to irritations at a later stage. Also the Auditors would engage with so many personnel that there is bound to be a few interactions which creates friction, especially if the deadlines are tight.
16) Leaders should set the tone from the top. They should sit with the process owners or their department heads and reassure them that it's okay to have findings arising from audits. Then remind them that the focus should be on the immediate rectification of the issues raised and through its sustainable implementations. Also lay the expectations that critical findings should be discussed separately and root causes analyzed to avoid in the future. This expectation will provide the audited management have a basic framework to work with.
The intention of the above is not the allocate blame or point fingers as to who is responsible for the poor engagement or poor outcomes. It's for sure not a complete list. The audit journey should be a joint one with both Auditors and Auditees taking the lead and maintaining order. This is not a science but it is an experiment. Some experiments will succeed and some may not. I have had the privilege of witnessing expertly engaged audits with no compromise on quality and yet there was no one person responsible for that successful outcome.
< written by Dipesh Narsai>
Feel free to read my other articles in this "Interesting Thoughts of an Auditor" blog series...
