Internal auditors are assurance providers charged with evaluating risks and providing stakeholders with reasonable assurance that risks are appropriately identified and treated. This usually begins with a risk assessment, followed by audit planning, which leads to an audit engagement and finally ending with an audit report containing issues that need to be addressed.
By now, we’ve all seen the standard suggested audit issue format:
It has been effective for many years. Recently, I was part of a discussion in which some audit professionals who suggested an alternative approach…No Audit Recommendations. On the surface, that sounds shocking. But once explained, I believed it is something worth sharing.
The no recommendation approach still requires issue and cause identification. However, instead of focusing on recommendations that clients may or may not implement, auditors partner with clients and discuss management actions plans.
This approach can potentially reduce the number of hours spent report writing. Many of us already discuss the management action plan clients, so this would not change. However, consider the number of hours allocated to writing audit recommendations. We are not necessarily experts at our client’s processes. When we find that something is not working properly, we may not know all of the details involved in fixing the issue. I’m not saying this approach will work for everyone, but I believe it is an interesting concept that can bring value to the right audit function.
Removing audit recommendations from audit reports have to potential to save auditors time and build better relationships with clients.