Robert L. Mainardi - Beyond Audit

After the planning phase comes the audit fieldwork. During this phase, the auditors must continue to work the audit and business partner relationship each time client documentation or data is requested, clarification of a business process step is required, or validation of a potential deviation from the business processing standard is noted. In each one of the previously listed incidences, the auditor is going to be required to communicate directly with the client to obtain the information or gain an explanation of an unknown. This creates the perfect opportunity for the auditor to build additional rapport with the business partner in an effort to gain trust to strengthen the bond between the two. Think about not only how critical these interactions are with the client but also how difficult these can be to execute when it is being done remotely. Being in audit over 30 years, I can attest to how challenging the fieldwork phase is, especially when additional information, data, or detailed explanations are needed to complete a test. Now complicate that need with the facts of the client not being readily accessible or the questions requiring answers are difficult. That is what remote auditors are facing on a daily basis. During these remote audits, auditors may not know if a client is available for questions or willing to answer the phone when it rings. And if the client does answer, will the client have the time to discuss and explain the challenges the auditor is facing, or will a new meeting have to be scheduled to address the issues? Everyone in business knows how difficult it is to schedule business meetings with representatives from multiple units. While this type of situation will not stop the audit from progressing, it will impact the timing of the audit testing and will result in the auditors having to reacquaint themselves with the test requirements. All of these situations affect the timing of the targeted audit completion.

Also, remember to prepare for this impromptu follow-up meeting with the client, as the auditors must be ready with the exact topics, questions, and data which are to be discussed in this call. If the auditor is not adequately prepared for this call, I can guarantee you three things:

1 The call will not sound professional.

2 The audit client will not be happy with the interruption and lack of respect regarding effective use of their time.

3 The auditor will not receive all of the information required to complete the testing and possibly forget an item, which will require another call.

All three of these outcomes damage the audit and business partner relationship, and in established relationships create unnecessary erosion. It may not seem like a significant issue at the time, but the repeated calls or interruptions due to a lack of preparation on the auditor's part will create stress on the relationship, which impacts the audit team's ability to access critical information to complete the audit in a timely manner (close to the allotted budget) and establish a productive communication channel to facilitate issue validation, root cause, recommendations, and action plan discussion needed to deliver a value in the final audit report.

The relationship building in the audit report phase could be considered the pinnacle of the audit and business partner relationship due to the impact of the interaction between the two groups during this final phase of the audit. Think about how much back-and-forth there can be when the draft report is being created. The audit status memo that was mentioned previously in this chapter, along with the benefits it has, not only in the development of the client relationship but also in the report generation process, can and will be relied on heavily to effectively support the final audit product. For the audit report to truly be value-added, it must include specific, tangible, and data-supported issues identified by audit and validated by business personnel. The process of acquiring the data and verifying the veracity of the included report issues relies on a productive and amicable relationship between the auditors and the business team. In this situation, the strength of the relationship drives a more efficient audit process and a collaborative effort to generate the draft audit report as well as the final product to be distributed to the executive team. With a strong relationship, the report generation discussion will be based on agreed-upon data and facts and not subjective opinions and perspectives.

Over the past three decades of keynote addresses, conference workshops, and training events all over the world, I have always stated one undisputable fact about myself and my experience being an internal auditor: I was never the smartest or best auditor on the team, but I focused on building my business knowledge, observing successful audit and business personnel, executing assigned work to the best of my ability, and learning from my mistakes. In the end, however, I always credited my success of going from a staff auditor to a vice president of audit and facilitating training for over 30 years to my ability to communicate and build relationships both inside and outside of audit. Successful relationships will provide you with benefits ranging from learning from co-workers to successful partnerships with business unit personnel to add value. Use relationships to not only further your personal development, but also positively impact the effectiveness and efficiency of business processes you encounter throughout your career.

The final point to review before we leave the audit approach discussion during a remote audit is the wrap-up phase. This is not usually considered an official audit phase, as most groups consider the audit to only consist of planning, fieldwork, and reporting. Now, I know how it feels when the audit report gets finalized and distributed. There is a definite sigh of relief that the audit is complete, and you have almost certainly moved on to the next project on the list. But is the audit really complete and over? The answer to that is no. There is file clean-up, survey distribution, lessons learned, and annual risk assessment updating (if required). File clean-up includes an internal review to ensure all audit sections are complete with the proper testing referencing and required sign-offs are evidence on all work performed. Lessons learned is an audit team–only meeting where the participants on the remote audit discuss critical aspects of the audit, such as how well did we plan, use technology where applicable, develop audit testing linked to the business objective, and productively foster the audit and business relationship. The lessons learned can be compared and used in unison with the audit client survey results to identify gaps in the audit process and suggest audit methodology revisions to strengthen audit execution.

While these items in wrap-up phase are for the most part an internal exercise for the audit team, the audit survey process is still a critical outstanding item that impacts the audit and business partner relationship. The survey itself should have a targeted distribution. Many times, audit teams make the mistake of sending the survey out to the executive over the business process that was just examined and possibly including the business manager over the unit. However, if the audit team truly wants to solicit feedback on how well the audit was planned, the fieldwork was executed, and the report was generated, then you should be reaching out to the key business personnel contacts that the audit team interacted with during this challenging remote audit. Simply sending the audit survey to the executive or manager over the area being audited is not going to provide you with an honest assessment of how well the audit went or how effective communication was throughout the audit. That is going to require a different distribution to unfiltered feedback on audit's performance during this remote review.