Читать книгу Beyond Audit - Robert L. Mainardi - Страница 15

Performing an audit remotely is not as straightforward and simple as you might think. There are thought perspectives that believe remote auditing is actually easier than in-person auditing. Think about that – there are no business disruptions, which are a constant complaint from your client. The audit team can just focus on the job at hand and evaluate the data and process under review. While that may sound like the utopia of audit (no direct client interaction and just review and testing), that is a bad assumption. Take a moment and consider how challenging it is to get someone from the business team to meet with you or give you inquiry access to their system; why no one from the business team has time to take another auditor through the business process; how long you have to wait for documentation you requested; why no one from the business team has time to discuss potential findings. Now there are exceptions where some audit clients are the most accommodating, open, and forthcoming business partners and will provide the time, data, and information needed to complete any audit request. But make no mistake about it, those types of clients are few and far between. Most clients view audits as a disruption to their day-to-day operations and no business personnel has time to waste educating the audit team on the business operations that the process owners believe the audit team should already know. I know it's an unfair assumption, but it is real.

To emphasize and illustrate the remote audit approach concept, let's discuss how we as traditional auditors can effectively and seamlessly switch gears and go from the in-person approach to a remote evaluation of critical business processes. As in every assigned audit, the auditor should begin with an understanding of the audit objective. Unfortunately, most audit teams get assigned an audit and never bother to review the annual risk assessment to determine why this audit was included in the annual plan. The auditors just figure that the annual planning was completed, and it was decided to include this audit in the current year. What the auditors do not realize is that the information compiled in the annual audit plan provides a solid foundation as to what the business process includes, key personnel, systems utilized in the business process, as well as any potential process risks. Also included in the annual planning documentation is the audit history, which details when the area was last reviewed, what the audit rating (opinion) was, and issues identified that required management action. Auditors might not recognize how valuable this information could be, especially when it comes to auditing remotely. I will admit, not reviewing the annual planning documentation is probably less impactful when executing a traditional audit but it is significantly detrimental when performing a remote audit. Why? you may ask.

Compare the two approaches. In the traditional audit, you will get to meet the key players in person during an opening conference and walkthroughs and review the previous audit report (hopefully) as you plan. Conversely, in a remote audit, you will be given the names of the key players, but never meet, and you will not get to sit face to face with a processor during the walkthroughs and have to sort through those details via policies and procedures and follow-up questions. Definitely not as easy as it may sound. Additionally, by reviewing the annual planning documentation, the auditor receives valuable background information on the business process as well as the context in which the review was completed both from an annual perspective and previous audit. As we discussed in the previous chapter, you can never prepare enough, and in a remote audit, you have to prepare and plan twice as hard as before and be dedicated to the details of your audit methodology. Take my advice on this point and make your remote audit life much easier: Review the annual planning documentation, ask questions to the person who completed it, gain an understand of the business objective(s) and supporting processes, and set an initial scope based on the objective(s) and previous findings from the last audit. This first step in preparing for the remote audit will provide a solid foundation for you to effectively plan and build a test approach to satisfy the audit objectives and deliver a value-added report to your client.

After the review of the annual planning documentation and the audit team identification, it is beneficial to have an internal team meeting with all auditors who will participate on this project. Just like any other meeting, the facilitator (project lead/in-charge) must adequately prepare for this overview meeting with their audit team. Topics to be discussed and explained with include, but are not limited to, the business unit background, business objective(s), proposed initial scope, last audit's report, rating and issues, any open actions, and the reminder to be aware of how important communication is during a remote audit. To clarify these topics, consider business unit background. This information should detail the business unit's location, staff size, turnover statistics, management tenure, volumes for both transaction and dollar (if applicable), and current systems used. When it comes to business objective(s), the auditor has to understand what the purpose of this process under review is. More simply put, the audit team must understand the role this particular business process plays in the organization. Consider what product or information does this group create and is it for internal consumption or is it for the public. If it is for internal usage, another business unit or team is relying on this team's product and decisions will be based on the information provided. And if it is for public consumption, the risks become even higher if the process is not completed timely and accurately. Communication, as you will hear throughout this book, is going to be the cornerstone and foundation for the success of your audit function, especially while executing remote audits. One of the most underrated concepts of communication with audit clients is the fact that solid communication fundamentals start within your own audit team. When the communication requirements are stressed and enforced within your audit team, it becomes immediately transparent with your clients. Another benefit to strong internal communications is it becomes a habit to speak to your co-workers as it pertains to work challenges, client difficulties, or even clarifying questions about the process under review. The audit team should be filled with people who want to share all of their business and company knowledge, audit and business experience, and suggestions on how to handle a difficult task or client. Those individuals who openly share with their teammates create a strong communication base and functional team. Highly communicative teams not only create a strong, unified approach but also develop leadership skills as they continually practice explaining (in detail) how the audit process works, how the business process is focused on completing their assigned tasks, and how this particular business process links to the overall objectives of the company. Communication provides an avenue for ongoing development of business process knowledge that pays dividends no matter what position you have at the company.