This is a guest post by Jamie Ontiveros, a Certified Internal Auditor who has been a part of several large internal audit departments. Originally from the Detroit area, Jamie is now based in Denver, CO.
It’s known that the Internal Audit profession is migrating away from a compliance focus. They argue that this change in philosophy is a necessity if we’re going to provide more value to the business. Chief Audit Executives are taking the queue, as evidenced by the less prominent role that Sarbanes Oxley plays in audit plans at many public companies.
It’s one thing to call for this change, or to even scope more operational audits, but how do we go about actually providing that value? (i.e. what do we have to do differently tactically in order to produce greater value?) The good news is, not much.
Before we get going too far, let’s start out with a quick auditing 101 session as we’re all playing with different experience levels. Start off with a strong planning session in order to gain a solid process level understanding. Sometimes we auditors tend to focus on the controls, but we must remember that it is the risk that we’re truly auditing against. The control environment is the added layer management has implemented in order to reduce the risk.
You’ll be able to accomplish your objectives if you formulate your interview questions ahead of time based on the risks. You want to understand the process backwards and forwards, but never lose sight of the high level inherent risks. Consider this approach your sniff test. You’ll know if something the client says doesn’t sound right. That said, be mindful of what the client says during your planning sessions. I argue that client disclosure in addition to awareness are the keys to providing exceptional value. It’s not just about materiality.
Enter the Client Awareness Disclosure Map. Every management consultant and graduate student has a two by two table to more easily explain a business concept. This is my first contribution to internal auditing.
As you can see from the table, Client Awareness is displayed along the X axis, and Client Disclosure is along the Y axis. I wanted to keep the table simple, as there are merely four areas in which to plot your audit findings. The areas are not meant to be mathematical quadrants, so there aren’t any point scales. Let’s discuss.
Area 1 - You’ve asked about a process or risk, and the client has fully disclosed an issue they are having in their area. The issue is known to the client, but perhaps not to executive leadership. They may have also identified the cause of problem they are facing. You’re going to add value by giving ‘visibility’ to an issue that the client has likely addressed previously, but wasn’t able to get the necessary support.
Strength: Findings in this area indicate that your rapport with the client is strong. They disclose the issues to you in good faith. You provide assistance with a formal remediation plan and the business can move forward. You’ll know exactly what to look for during testing for evidence.
Weakness: If all of your findings are in this area, then it may be an indicator that your audit team isn’t digging deep enough during testing. It’s fine to put these items in your audit report, but too much focus on these findings without providing viable recommendations will feel like ‘gotcha auditing’ and may hurt client relationships and internal audit’s reputation going forward.
Area 2 - You’ve asked about a process or risk, and the client gives you a response that sets off your ’Spidey Sense’. The process may be well documented, and the client could be being forthright. They may honestly be unaware that they’ve said or done anything wrong. Perhaps the client should be performing an accrual at month end, but they fail to realize this requirement because they’re not accountants. You’ll have to find the root cause because the client isn’t aware of the issue to begin with. Your recommendations need to be solid.
Strength: Findings in this area indicate that your audit team has a solid understanding of the inherent risks. You’ve asked questions that identify potential issues that the client isn’t even aware of. You’ll know how to design your tests in order to evidence your suspicions. Professional skepticism is a trait that will help you identify issues in this area. You may have been told something in one meeting, but something contrary or different in another.
Weakness: If all of your findings are in this area, then it may be an indicator that your audit team isn’t digging deep enough. That is, if most of your findings are based on Inquiry. You also may have issues persuading the client that the findings are really ‘issues’. The client may provide the classic ‘this is how we’ve always done it’ response. So you’ll want to make sure that you have plenty of evidence to support your position. It’s fine to put these items in your audit report. Too much focus on these findings without providing viable recommendations may feel like technicalities. “We put in this control because audit said we had to”.
Area 3 - You’ve asked about a process or risk, and the client has not disclosed, fully or partially, any issue they are having. It’s known to the client, but perhaps not to executive leadership. The client has not disclosed the issue to you during questioning for any number of reasons. Perhaps they have been burned by audit in the past. Perhaps the company culture is harsh on failure, or is one ruled by fear. The cause of the problem may also be known by the client, but perhaps they are powerless to do anything about it, i.e. it’s a sensitive issue, or it’s the result of an executive’s decree.
Strength: Findings in this area indicate that your audit team has a solid understanding of the risks. Your team also has the technical skills to identify the issues via independent testing. Obtaining sufficient evidence during testing is not a problem if the test is designed and sampled adequately. You’ve audited according to the risk and found your mark. Doing so has allowed you to find issues that the client has not disclosed.
Weakness: If too many of your findings are in this area, then it may be an indicator that your audit team doesn’t have the best rapport with the client. Sometimes clients can tell you what to look for ‘off the record’, but that didn’t happen in this case. You’ll want to tread lightly here, and use this opportunity to build up the relationship by carefully managing the issue. It’s appropriate to put these items in your audit report, but too much focus on these findings without providing viable recommendations will leave the client feeling ‘burned’. If not managed well, these issues may hurt client relationships and internal audit’s reputation going forward.
Area 4 - You’ve asked about a process or risk, and the client has told you all of the right things. The client is unaware of any issues, and nothing that they’ve said gives you pause. You’re on your own in this area. Consider it uncharted territory. You’ll have to find the root cause of any issues in this area, because the client isn’t aware of them to begin with. Oftentimes the remediation is clear once the issue is known.
Strength: Findings in this area indicate that your audit team has a solid understanding of the risks and has the technical skills to identify issues via independent testing. Auditing against the risks and relying heavily on testing, versus merely inquiry, has led your team to the issues. It’s a clear example of finding what you’re looking for. You’ve identified issues, i.e. risk, that the client isn’t even aware of. Bravo!!
Weakness: There aren’t too many weaknesses in this area. Issues in any of these areas can bring value to the business, but I argue that issues in area four should be considered high value findings. We’re trained to think about significant issues from a materiality perspective, but issues with high materiality can be found in all four areas. It’s definitely appropriate to put these items in your audit report, but be sure that you’re not making a mountain out of a molehill.
In closing: Giving visibility to issues is a great way for Internal Audit to provide value to the business. Finding dollars is always a good thing, it’s not the only way to add value. Shedding light on risks the business didn’t know it had can be just as meaningful. The beauty of this approach is that it won’t take much retooling.
Arming yourself with a solid understanding of the risks, and using a combination of inquiry and detailed testing can be your key to identifying high quality findings. Once identified, you’ll quickly add value to your organization if you manage the issues correctly. How can you tell if you’re successful?
Start plotting your findings in these four areas, and trend your findings by area over time. Create a dashboard with breakouts that make sense for your organization: by audit, audit manager, auditor, area of the business, etc. Roughly speaking, you’ll want a relatively even distribution between issues identified by Inquiry and those identified through Independent Discovery (areas I & II and III & IV respectively). Your department can use the results to identify departmental training opportunities. How does your team trend?
Naturally client responses to the findings can and will vary. There are many ways to add value to the business, and bringing awareness to previously unknown risks is one of them. What better way is there to ensure that IA has a seat at the risk assessment/assurance discussion?
There is a connection between awareness and disclosure, that is human at its most basic level. ’What’s hidden versus what’s transparent?’ We audit process, but deal with humans. Let’s treat them as such with understanding of where each issue lies on the map. Doing so can provide insight in how best to address each situation. If managed appropriately, Internal Audit will provide value on every engagement.
Article and Comments »
