So why do audit clients thinks I’m constantly inviting comment on how we should do our work? Do I come across as uncertain? Am I overly humble when I present them with audit findings, making them think that maybe they can bargain their way out of an issue? Does something in my body language suggest a wavering mind or a poor intellect?
I don’t mean the well-intentioned clients out there, the genuine ones that want to get assurance over their key risks and controls, and try and steer us towards the things they think are important. That’s great, we need more like that.
I mean the other kind. You know who I mean. The ones who can’t discuss an ineffective control without pointing out why we shouldn’t have audited it in the first place. The ones who can’t give a straight answer about an audit issue because they think they’ve found a loophole in our scope memo. The ones who can’t distinguish between audit finding and reporting a problem, from audit causing the problem. The ones with a dictionary of hard-to-define audit terms, who throw one of them into every sentence, to the point where you simply don’t have time to correct all of their mistakes or ask them to explain all their irrational conclusions.
“But you can’t raise an audit issue because you haven’t performed substantive testing.”
“Er, we can’t do any testing, because you don’t have any controls, you didn’t even know you were responsible for the risk until we told you about the issue.”
“Exactly. So you have to wait until we’ve put in the controls, then you can come back and test them, and if they aren’t working, then you can raise an issue”
“Really? Is that your suggestion? Is that how you think we should run our audit process? Are you just saying that so we don’t raise this issue, or do you actually think that it’s a good idea?”
“I truly think it’s the industry best practice of the future, and that you’d be negligent not to adopt it as a standard practice.”
“Huh. So what about this second issue then, which is that the new control you put in 6 months ago hasn’t reduced your non-compliance to this policy?”
“Well, you never raised an issue on that before we put in the control, so you can’t turn around now and raise an issue just because a control isn’t working.”
“Isn’t that the opposite of what you just said about the last issue?”
“Yes. Yes it is. That’s why I’m saying you need to make your audit process flexible, you see?
There must be something big at work here. Even when I’d written just the title of this blog on my screen, a colleague saw it, and immediately guessed that it was about these facile, knee-jerk requests from certain clients.
There is something deep in the psyche of these people, like a post-hypnotic suggestion, or maybe something more sinister. I suspect that its part of my newsletter conspiracy theory.
“Audit Myths and Legends
This week : How to conceal audit findings by constantly moving the goalposts!
Now we all know how audit love to find problems, things we’re doing wrong or things that just aren’t working. Well, it’s a 2-way street. Audit loves to hear any of your random suggestions for improving their process too! No need to think them through or to mention them before they found an issue. In fact, your suggestions don’t even need to be consistent with eachother (I still refuse to believe that’s not one word). That’s right – you can suggest 2 conflicting or opposite changes in approach, even at the same meeting. And the best bit, you can do this is a way that your suggested changes will always have the effect of making at least one issue disappear!”
Has that ever worked? I mean even if we were looking at overhauling our process, chucking out the fundamentals and starting from scratch, would these be the people we’d want to involve anyway? People who we already know have some serious flaws in the processes they operate? And more worryingly, people who can’t seem to focus long enough to acknowledge the nature and extent of these failings? Are these the qualities you look for in someone redesigning your processes?
But that’s not what they want either – they don’t want us to take their comments on board as part of a structured feedback process and integrate them into our next revision of the audit methodology. They want us to change it on the fly, there and then in the meeting, without taking other client input on the subject, without any consistency with the rest of the audit function, and without running it past the audit committee for their OK.
And that’s the problem right there, and I find myself heading towards a quite serious point, quite unintentionally. This slapdash attitude to established procedures, the assumption that if its not giving you the answer you want, you can find a way around it. There is much to be learned in examining the motives and methods of people who do this to you, and extrapolating that backwards to see how it dovetails with the issues you are raising. You may find that you’ve been missing the big picture.
Enough said. Keep it real.