control, and governance
How Do I ... Avoid Surprises on an Audit?
Effective communication is the lifeblood of a successful auditor-client relationship. Without it, clients not only receive an inferior audit, but they may suspect that secrecy is part of the internal audit process.
Of course, internal auditors do not look to attack clients, spy on their department, or send top-secret missives to organizational management. To combat these perceptions, internal auditors need to practice effective communication and assure clients that they will not encounter any surprises. Equally important, internal auditing needs to avoid any surprises from the client, as these could lead to scope adjustment, an increase in the time budget, or a complete reevaluation of the entity’s risk profile. Communication before, during, and after an audit, as well as during nonaudit periods, is vital to keeping surprises to a minimum.
BEFORE THE AUDIT
Internal auditors should contact management before the engagement begins and explain how the audit process works. They also should take time to understand any limitations or constraints the client may face, such as extremely busy times during the day, important deadlines, business travel, scheduled vacations, or other significant factors that could impact the client’s ability to participate in the audit.
DURING THE AUDIT
Once the audit is underway, communication should be regular and consistent. And similar to information shared before the engagement, all client personnel should be kept in the loop. Ongoing communication, delivered with the correct style and approach, decreases the likelihood of surprises.
AFTER THE AUDIT
At the end of the engagement, many internal audit departments conduct a wrap-up meeting to discuss what was done right, what went wrong, and what could be improved. These meetings can be enhanced by inviting entity management to join the discussion. Including management signifies internal auditing’s desire for a collaborative effort, and it enables the auditors to receive valuable, constructive criticism from the entity’s leaders. The discussion can also help management learn more about the internal audit process.
Internal auditing and the entity succeed when the two parties establish a sustained, mutually beneficial relationship. According to The IIA’s definition of the profession, internal auditing is “designed to add value and improve an organization’s operations.” This objective cannot be achieved unless the client understands internal auditing’s work, receives ongoing communication, and encounters little or no surprises.
Adapted from "A No-surprises Audit" by Michael Swafford (Internal Auditor, "Back to Basics," December 2009).
COMMENT ON THIS ARTICLE
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.