control, and governance
Request for Delay
A security company's CAE considers whether to accommodate management's request to defer a planned audit engagement.
John Mooring is the director of internal audit for Norex Security Operations Inc., a large provider of security monitoring services for business and residential clients with locations throughout North America and in some European countries. John has established well-documented pre- and post-audit routines, with which his staff is very familiar. To efficiently execute against its audit plans, the audit department’s projects must be scheduled months in advance. The auditors submit requests for information (RFI), along with notice of audit, a month before on-site fieldwork is planned. Responses to the requests are returned to John’s office, and the staff can complete much of the audit program at their desks.
One of John’s audit teams recently sent a notice of audit and RFI to one of Norex’s regional offices. A few days later, John received an email from the divisional senior vice president responsible for the region to be audited. The email read:
I understand your group is planning an audit of the Southern regional office next month. I wanted to let you know that there have been some recent organizational changes in the office. I think it would be better if we deferred the audit until we are able to get some of the organizational holes plugged. Additionally, we have been notified that the state has scheduled an on-site review for the same week your auditors were planning to be in the field.
I will keep you posted on our progress and let you know when I think we’ve got things squared away.
John followed up with a phone call to Marcus, who explained that he believes an audit at this point would just delay several of the changes they have in progress. He said it would result in the auditors “just writing a report that tells us what we already know and are in the middle of correcting.” Marcus continued: “The audit would really add little value, and I think the delay is the right way to go. Besides, the team is pretty overwhelmed right now preparing for a visit from the state auditors.”
John tells Marcus he will consider the delay. He understands the points that Marcus has made and wants to be sure his group is considered a value-added function. And given the current conditions Marcus described, an internal audit could cause even further disruption. On the other hand, if the situation is that bad doesn’t John have a responsibility to report it to executive management and the audit committee?
COMMENT ON THIS ARTICLE
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.