4 steps to clarifying audit issues
Every auditor has or will face situations where clients significantly pushback on audit issues. Internal Auditing is an independent and objective function tasked with evaluating management’s risk identification and mitigation strategies. However, when presenting potentially reportable items to management, that objectivity can sometimes disappear as auditors began vigorously defending audit items. This can lead to arguments with management at a critical point in the audit-client relationship management process. I believe there are 3 things we must remember and 4 things we must do when clients disagree with audit issues.
Remember the Following
- It is not always about the issue. There may be some underlying reason for the objection
- It is not personal, but your clients will most likely see it that way.
- You could be wrong
Do the Following
- Listen for Feelings
- Gather the Facts (question for facts)
- Reassess the Situation (Determine Root Cause)
- Restate the Position
I have said it before, being audited is very difficult. Audit clients are placed in the position of opening up so that auditors can evaluate risks & controls, give recommendations for improvement and reporting results to the governing authority. This process is designed to help the entire organization, however, it cannot always feel that way to those being audited.
I remember one engagement in which there were significant issues. The client baulked at every one of them. All were true, all were relevant, and all were risks. After spinning our wheels for a while, I finally asked, “What is the reservation regarding these items”. The client responded, “This makes us look bad!” I pressed on by asking if any of the items were untrue. They indicated that everything was accurate but did not reflect the will, drive and desire to do a good job. Overall, there was a feeling that the issues made them look like slackers who were not concerned about their jobs. It was at this point I decided that I needed to look at the situation differently.
Listen for Feelings
After talking to the clients, it was obvious the group wanted to preserve and protect the organizations assets. However, there were significant internal control weaknesses. They were frustrated because they did not believe they had the ability to change the control environment.
Gather the Facts
The facts clearly indicated that fraud occurred due to a lack of controls. The organization suffered a moderate monetary loss. Additionally, the unit was fined a small amount for non compliance with a new regulation.
Reassess the Situation
As I began to think about the situation differently, I discovered that while the facts were indeed correct, there was more to the story. The unit recently suffered a reduction in funding which resulted in the loss of not only positions but annual training. The training was extremely important as it ensured staff knew the proper internal procedures as well as new regulatory compliance issues. As you can guess, the fraud was a result of someone not following proper procedures.
Restate the Position
After carefully evaluating the situation, it was obvious that a true root cause analysis was needed. While the “facts” were correct, there were some additional items that contributed to the breakdown in controls. We reworded the report in a manner that highlighted not only the issue, but the true root cause. The clients, although not happy about what happened, felt comfortable with the way the report now presented the issue.
[fusion_builder_container hundred_percent=”yes” overflow=”visible”][fusion_builder_row][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][divider]
[/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]
