Robert L. Mainardi - Beyond Audit

To emphasize and illustrate the remote audit approach concept, let's discuss how we as traditional auditors can effectively and seamlessly switch gears and go from the in-person approach to a remote evaluation of critical business processes. As in every assigned audit, the auditor should begin with an understanding of the audit objective. Unfortunately, most audit teams get assigned an audit and never bother to review the annual risk assessment to determine why this audit was included in the annual plan. The auditors just figure that the annual planning was completed, and it was decided to include this audit in the current year. What the auditors do not realize is that the information compiled in the annual audit plan provides a solid foundation as to what the business process includes, key personnel, systems utilized in the business process, as well as any potential process risks. Also included in the annual planning documentation is the audit history, which details when the area was last reviewed, what the audit rating (opinion) was, and issues identified that required management action. Auditors might not recognize how valuable this information could be, especially when it comes to auditing remotely. I will admit, not reviewing the annual planning documentation is probably less impactful when executing a traditional audit but it is significantly detrimental when performing a remote audit. Why? you may ask.

Compare the two approaches. In the traditional audit, you will get to meet the key players in person during an opening conference and walkthroughs and review the previous audit report (hopefully) as you plan. Conversely, in a remote audit, you will be given the names of the key players, but never meet, and you will not get to sit face to face with a processor during the walkthroughs and have to sort through those details via policies and procedures and follow-up questions. Definitely not as easy as it may sound. Additionally, by reviewing the annual planning documentation, the auditor receives valuable background information on the business process as well as the context in which the review was completed both from an annual perspective and previous audit. As we discussed in the previous chapter, you can never prepare enough, and in a remote audit, you have to prepare and plan twice as hard as before and be dedicated to the details of your audit methodology. Take my advice on this point and make your remote audit life much easier: Review the annual planning documentation, ask questions to the person who completed it, gain an understand of the business objective(s) and supporting processes, and set an initial scope based on the objective(s) and previous findings from the last audit. This first step in preparing for the remote audit will provide a solid foundation for you to effectively plan and build a test approach to satisfy the audit objectives and deliver a value-added report to your client.

After the review of the annual planning documentation and the audit team identification, it is beneficial to have an internal team meeting with all auditors who will participate on this project. Just like any other meeting, the facilitator (project lead/in-charge) must adequately prepare for this overview meeting with their audit team. Topics to be discussed and explained with include, but are not limited to, the business unit background, business objective(s), proposed initial scope, last audit's report, rating and issues, any open actions, and the reminder to be aware of how important communication is during a remote audit. To clarify these topics, consider business unit background. This information should detail the business unit's location, staff size, turnover statistics, management tenure, volumes for both transaction and dollar (if applicable), and current systems used. When it comes to business objective(s), the auditor has to understand what the purpose of this process under review is. More simply put, the audit team must understand the role this particular business process plays in the organization. Consider what product or information does this group create and is it for internal consumption or is it for the public. If it is for internal usage, another business unit or team is relying on this team's product and decisions will be based on the information provided. And if it is for public consumption, the risks become even higher if the process is not completed timely and accurately. Communication, as you will hear throughout this book, is going to be the cornerstone and foundation for the success of your audit function, especially while executing remote audits. One of the most underrated concepts of communication with audit clients is the fact that solid communication fundamentals start within your own audit team. When the communication requirements are stressed and enforced within your audit team, it becomes immediately transparent with your clients. Another benefit to strong internal communications is it becomes a habit to speak to your co-workers as it pertains to work challenges, client difficulties, or even clarifying questions about the process under review. The audit team should be filled with people who want to share all of their business and company knowledge, audit and business experience, and suggestions on how to handle a difficult task or client. Those individuals who openly share with their teammates create a strong communication base and functional team. Highly communicative teams not only create a strong, unified approach but also develop leadership skills as they continually practice explaining (in detail) how the audit process works, how the business process is focused on completing their assigned tasks, and how this particular business process links to the overall objectives of the company. Communication provides an avenue for ongoing development of business process knowledge that pays dividends no matter what position you have at the company.

Every audit you participate on will have challenges, but the remote audit will exacerbate simple ones into much more difficulties throughout the audit. Regardless of the audit type, the biggest challenge is availability of the client. Whether the clients like it or not, they should be a key participant in every audit due to their knowledge of the process, access and understanding of the data, system knowledge, and overall process experience.

I think many times auditors take for granted the availability of client access when executing a traditional audit. That luxury is missing during a remote audit. I know this may seem like a simple concept, but it plays a huge role when the auditor is trying to complete the planning process and is missing critical data or information to close the loop on one particular process piece. Gone is the time of getting up from your desk and finding someone in the process area to question regarding the missing information. An auditor's ability to follow up, ask qualifying questions, or retrieve missing documentation becomes much more complicated when they do not have immediate access to the business team. And there is no telling when and if your business partner is going to answer the phone to address the next question from their audit counterpart.

Another significant challenge during a remote audit will be obtaining the detailed process steps from start to finish, especially if you are auditing an area never reviewed before. Since there will be no documentation available from the previous audit (completed process map), the auditor will be responsible to obtain this process level information from their business client. Every auditor knows how difficult it is to create a process map from scratch; it takes time to review the most updated policies and procedures, examine supporting process data, understand the systems used, draft an initial narrative, and then meet with the client to clarify the understanding of the process as well as ask any outstanding questions. All these steps are necessary to develop a complete process map. In the nonremote world, you can expedite this process by sitting down and getting a walkthrough of the process with your business partner and asking clarifying question as you go along. However, in the remote audit world, it is not possible to perform a walkthrough over the phone or even in a videoconference. Trust me, it just does not work. That does not leave the auditor with many options other than to dedicated the time and effort it will take to become intimate with the policies and procedures (that you hope exist or are up to date) along with all the other data and information requirements to build a solid narrative of the process to be used to facilitate the phone discussion with the client. The more detailed the understanding of the business process, the more effective the process validation call will go with your client. This type of exercise requires excellent communication skills to ensure the auditor validates the process details and the business partner clearly understands the questions being asked. As you read on, you will see how communication skills are always at the foundation of success for any auditor in every industry.