Beyond Audit

Auditing Remotely and Delivering Value

Robert L. Mainardi

• Publisher: Wiley
• Year: 2021
• Print ISBN: 9781119789604
• eBook ISBN: 9781119789611
• Edition: 1
• Topic: Business
• Subtopic: Auditing
• Index: Business

Your game plan for strategic success in today's remote audit department

Beyond Audit is your guide to taking advantage of this unique moment to review and enhance your audit methodology to improve execution, operations, and audit product. Change has been thrust upon the audit industry, and every company must adapt to business interruptions and remote work environments. Now is the perfect time for audit departments to step back and turn a critical eye on their own operations. We have an opportunity to identify new ways of increasing product offerings and building more effective and efficient operations, ultimately creating better results for our partners and clients.

This book will take you from a foundational understanding of the business environment through to a reflective review of your own operational effectiveness and efficiency. You'll gain access to the Audit Risk Barometer (ARB), an innovative self-assessment tool that scores audit department strengths and opportunities for improvement. This book also includes a detailed methodology for working with your business partner to ensure clear identification of business objectives. You'll also learn how to identify "true process risks" to ensure that testing remains focused and adds value. Finally, you'll learn critical skills and team development ideas for every level.

• Gain a fundamental understanding of today's business environment and how traditional and remote auditing fits into the new business puzzle
• Use the exclusive Audit Risk Barometer to conduct a valuable self-assessment and uncover your team's strengths and weaknesses
• Learn how to effectively and efficiently work with your business partner to identify objectives and value-add opportunities
• Access online resources, including video summaries and interactive tools to revamp your audit department

Beyond Audit incorporates links to online video summaries, templates mentioned throughout the book, interviews with experienced professionals, and an audit tracking software tool. This book is an enormously valuable resource for audit teams of any size and shape.

CHAPTER 1
What Happened

THINK BACK FOR A MOMENT. Do you even remember the beginning of the year 2020, which started with such promise? You probably made a couple of New Year's resolutions. Maybe it was something about your weight, exercise, or even your job. At work maybe you made a commitment to improvement. This was going to be your year – you were going to seek opportunities to lead jobs, take a leadership position, and maybe even get promoted. No matter what goals you set for yourself, you were certain you knew what you needed to do and how you were going to get there. You had a plan.

The one factor every person has to consider when making a plan is to ensure that all possible and potential roadblocks to achieving the goals are identified and considered. Now, while there is no way to consider, document, and explain every reader's personal goals, I can definitely speak on the objectives of an audit department. For more than three decades, I have been a team member in an internal audit department and/or partnering with them to create the most effective and efficient internal audit operation. And while each department is unique, the methods, direction, discipline, execution, and oversight of the operation remains the same. So, let us focus on the audit department and how they entered the year with a plan and an energetic team filled with optimism.

In the same vein that an individual would set yearly goals, so does the audit function. The chief audit executive meets with the leadership team and discusses the company's direction and how the internal audit department is going to partner with each of the business leaders to ensure the operations in every division are being completed in the most effective and efficient manner. And in order to provide that validation, internal audit will ensure that the process design, implementation, execution, reporting, and oversight are producing the intended outcome, no matter if the result is a physical production or a process. The audit chief knows the key to delivering a value product to their clients is to recognize that each process will produce an outcome; however, the internal audit team must verify and validate the outcome is the intended or desired outcome according to the business process requirements. With the stated objective to provide this type of specific value to their clients, audit departments realize the discipline, focus, effort, and dedication it takes to deliver.

AUDIT EXECUTION CHALLENGES

When the audit leadership team reviews all of the pertinent business activity data and comes together to discuss and create the annual plan, they consider the barriers the team will face to produce their quality product. These barriers include, but are not limited to, available hours both from a team and client perspective, data identification and availability, auditor experience and business knowledge, allocated time, as well as unplanned events. Now, I can assure you that when the audit leadership teams got together to build their 2020 plan, many challenges were discussed that could stand in the way of completing their audit plan. However, having the country shut down due to a virus was definitely not one of them. That being said, the audits that were in progress and the ones that remained on the plan when this pandemic hit the country must be completed. Multiple partners, both internal and external, need and rely on the audit results in order to plan the company objectives moving forward. But how is an audit department that relies on information, communication, and data from its business partners expected to complete the audit assignments when members of the department are no longer in an office where they can interact and obtain the necessary and critical information required to provide the quality validation of business operations?

As with any unplanned event, barrier, or obstacle, the team must adapt and improvise in order to overcome the challenges encountered and complete the assigned tasks. But how does an audit team or an auditor go about getting the critical information without meeting with the client to explain the needs and requirements in order to complete the job not only effectively but also accurately? Any auditor, whether experienced or not, will tell you that the internal audit and business partner relationship is the key to unlocking access to pertinent data and insight into the business process under review. Why is this relationship so important? The bold fact of the matter is, no one – either at work or in your personal life – is going to give you information regarding what, when, and how they do what they do unless they know and trust you. That is just human nature. And in your work life as an auditor, you already know that you are not going to be a person whom the business teams look forward to seeing on a regular basis. It is a stigma that has followed auditors since the beginning of the profession. In its simplest terms, auditors are there to ask the business personnel questions and verify that they are completing their assigned tasks as described, hopefully, in the policies and procedures. While the task at hand seems simple, any auditor will tell you it is a lot more difficult than it sounds – a prime example of saying it is so much simpler than doing it successfully.

So how does one accomplish this task of information gathering and knowledge development if they are unable to meet with their clients in person? This is where the auditor's job becomes 10 times more challenging than it was before the pandemic. The focus of audit departments worldwide has shifted in the second and third quarter of 2020. It went from analyzing data, partnering with a client to explain deviations, and developing value-added recommendations to identifying new ways to obtain the necessary information to do their jobs.

All internal auditors recognize the value that the business-level data has in the successful execution of audit engagements. Audit teams have become much more aware of how important communication, relationship building, and marketing the audit department has become in this new remote environment. For so long, internal audit departments have not placed enough emphasis on marketing their department in an effort to establish a strong foundation to build business partner relationships. If audit teams thought it was challenging before to get information from their business partners, they now face brand-new hurdles to leap over when it comes to acquiring data and information in this remote audit world.

The change that has been thrust upon the audit industry was not one that could have been predicted, but it certainly must be addressed if audit teams want to be successful going forward. There has been speculation that this remote environment could last through the coming year. If it was not evident before, each corporate executive and members of the corporate committees realize the critical role the audit department plays in the company and how much the business teams, regulatory bodies, external auditors, executives, and investors rely on the information produced and distributed from the audit teams. In order to address the needs of their internal and external clients, audit teams should take a step back and perform a self-evaluation of their internal process to ensure they have the following:

• Communication as the cornerstone of their department
• A commitment to building strong client relationships
• Focus on identifying and gathering data from a pure source
• Test plan developed from the business objective
• A report identifying root cause and linked to specific corresponding actions

This reflection on audit department operations will show the reliance on communication through all phases of an audit from the detailed plan through testing to reporting and action plan development and adoption.

How else would auditors be able to accomplish their assigned tasks if they did not have communicating effectively with clients as the number-one priority regardless of the audit phase or task? Unfortunately, not all audit teams emphasize client relationship development or communication skillsets when it comes to audit execution. Why? There is a misconception that the audit team can and will be given any data or documentation requested as mandated by the audit charter and the audit committee. And while this is true, the charter or committee documentation does not mandate the specifics regarding delivery of the requested data or information.

As every auditor will tell you, the work is never completed as quickly as they would like it. Time is one of the only commodities that no one can get more of – no matter what your position, job, or financial standings. There is nowhere to buy more time, not even on Amazon. If there was an option, everyone would take it. So, in the absence of being able to purchase more time, how do auditors go about getting the information? The key is and always will be their communication skills and relationship building. Remember, it was previously mentioned that the relationship strength is how you unlock the key to information. That strength will be based on the level of trust and experience your client has had with you during previous audit engagements. Here is the best explanation regarding the internal auditor and business partner relationship that provides the most effective illustration of the need for constant focus and development of a successful working relationship.

UNDERSTANDING YOUR ROLE

The analysis and explanation start with a remarkably simple question. As an auditor, could you do your job effectively without your business client? The simple answer to that question is no. There is no chance for an auditor to build effective (detailed) business knowledge, understand policies and procedures, document the business objective(s), recognize workarounds, gather pertinent business data, answer process questions, develop a detailed test plan, validate potential deviations from the work standard, identify root causes, create process-based recommendations, generate a clear, concise report, and verify action plan implementation and adoption without client participation. It would be a losing battle, not to mention a very time-consuming approach filled with business process assumptions. No auditor would want to generate an audit work file, and especially not an audit report, without having a clear understanding of the business and its corresponding objectives.

Now flip the question around. Could the business team do their job and complete their assigned responsibilities without internal audit involvement? The unfortunate answer to that question is yes. Absolutely, without a doubt, the business team could do their job with no internal audit help or intervention. If you asked the business process workers, they would all probably say their preference would be to perform their day-to-day responsibilities and activities without having to deal with anyone from audit. The business teams view internal audit as a nuisance, a bother, and an unnecessary interruption to their work. So, if the business team prefers no outside audit interference, how are auditors to go about breaking down the preexisting barrier that has been in existence forever? The answer is, through a dedicated effort on the part of the auditors to constantly be focused on the relationship.

While this fact of auditor “need” when it comes to client involvement during audits is daunting, there is a glimmer of good news. The need is not an insurmountable barrier but does represent a significant challenge to every auditor. But to overcome this barrier, the auditor will have to recognize and accept one indisputable fact when it comes to the internal audit and business partner relationship. And that fact is, no matter what type of relationship is being discussed – whether it is boyfriend and girlfriend, husband and wife, or auditor and client – there is always one person in every relationship who wants it a little more than the other. Okay. So, what does that mean? It means one person will always work harder and be more flexible to ensure the relationship continues to grow and stay strong. Auditors must realize early on in the relationship development process that we are the party recognizing we will have to work harder and be more flexible than our business partner to ensure the relationship stays strong and intact. What I must clarify for you is in recognition that the auditor must put in more time, effort, and dedication to foster the audit and client relationship. It does not mean in any way shape or form that the auditor should bend the rules or requirements during the audit itself. During the engagement, the auditor should keep the business partner “in the know” and ensure the work, status of project request, completed testing, preliminary results, and any potential issues should be reviewed, discussed, and validated with the business partner to ensure they are never in the dark when it comes to the audit status. While this might seem like common sense, there are often times when auditors forget to communicate the details of potential findings or work statuses. Surprises are fun and usually a good thing, except during an audit. If you want to keep your relationships strong with your business partners, always remember the role that clear, prepared, supported communication plays in developing, fostering, and maintaining relationships. Too often, auditors enter into exchanges (formal meetings or hallway discussions) with clients unprepared. I know this is not something you would do, but let us discuss the potential impact not only on the relationship with your client but also the development of the auditor.

A critical point that must be emphasized here is being prepared. You can never be too prepared for a meeting. Believe me, I know all the excuses for not preparing effectively for a meeting. You could say, I do not want to prepare too much because it will come off disingenuous. That is false. Being prepared does not mean to memorize what you are going to say. If you memorize what you want to say it will come off as fake and robotic. However, if you prepare effectively, it will show you are committed to the topic, understand the details, know where the data originated, and can effectively explain questions regarding the subject matter. If you do not adequately prepare, how will you know when to stop asking questions or when you have the information or data required? The keys to effective preparation for any meeting with a client are understanding the meeting objective and mastering the data to be discussed. With these two keys, any auditor can effectively and confidently communicate with the business partner. So, let's touch on both, briefly, to ensure everyone is on the same page.

CRITICAL MEETING KEYS

You would be surprised how many auditors go into a meeting with a client without a meeting objective. As a thirty-year audit veteran, I will tell you there were times when I relied on my experience to carry me through meetings. Because I have been in hundreds and hundreds of meetings over my career, I would tell myself that I would just “shoot from the hip” and use my “vast” experiences to get through a meeting. What a mistake! As I got older and hopefully wiser, I discovered no amount of experience can replace understanding the meeting objective and being prepared to discuss and drive targeted questions to address the meeting objective. Keep in mind, the meeting objective is the purpose or reason you are having this meeting. Objective as a noun will always mean purpose. Put yourself in the business partner's shoes. They will be thinking, why does the a...

Table of contents

• Cover
• Table of Contents
• Title Page
• Copyright
• Dedication
• Preface
• Acknowledgments
• About the Author
• CHAPTER 1: What Happened
• CHAPTER 2: Understanding the Remote Approach
• CHAPTER 3: Marketing the Internal Audit Department
• CHAPTER 4: Building an Effective Audit Team
• CHAPTER 5: The Methodology – Objective Recognition
• CHAPTER 6: Audit Fieldwork
• CHAPTER 7: The Methodology – Partner Results
• CHAPTER 8: Internal Audit Value
• CHAPTER 9: Internal Audit Dashboards
• CHAPTER 10: Communication Focus
• CHAPTER 11: Analyzing Internal Audit
• CHAPTER 12: How Good Is Audit?
• CHAPTER 13: Focused on Learning
• Index
• End User License Agreement