Internal auditors are assurance providers charged with evaluating risks and providing stakeholders with reasonable assurance that risks are appropriately identified and treated. This usually begins with a risk assessment, followed by audit planning, which leads to an audit engagement and finally ending with an audit report containing issues that need to be addressed.
By now, we’ve all seen the standard suggested audit issue format:
- Criteria
- Condition
- Consequence
- Cause
- Recommendation
It has been effective for many years. Recently, I was part of a discussion in which some audit professionals who suggested an alternative approach…No Audit Recommendations. On the surface, that sounds shocking. But once explained, I believed it is something worth sharing.
The no recommendation approach still requires issue and cause identification. However, instead of focusing on recommendations that clients may or may not implement, auditors partner with clients and discuss management actions plans.
This approach can potentially reduce the number of hours spent report writing. Many of us already discuss the management action plan clients, so this would not change. However, consider the number of hours allocated to writing audit recommendations.  We are not necessarily experts at our client’s processes. When we find that something is not working properly, we may not know all of the details involved in fixing the issue. I’m not saying this approach will work for everyone, but I believe it is an interesting concept that can bring value to the right audit function.
Removing audit recommendations from audit reports have to potential to save auditors time and build better relationships with clients.
Your thoughts.
Good article. I’ve been a long time advocate that internal audit must be consultative and collaborative to add measurable value to customers. They have to go beyond check the box audit programs.
I don’t understand the point. My main focus as an Internal Auditor are the recommendations. If we work together with clients to develop and management plan we lost our Independence.
Interesting concept; we always have management action plans as their response to the finding. However, by not making a specific recommendation it DOES leave the options open for management to pursue. Hmmm….
It is interesting. I may introduce the concept to our organization.