Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​The Dos and Don’ts of Small Audit Shops

A series of best practices can help departments of limited size make the most of their often scant resources.

Comments Views

​Many professionals from small audit shops face the challenge of managing an overwhelming amount of work with the limited staff at their disposal. Audit managers in these environments struggle to ensure work is performed timely and to fully leverage their available resources.

Reviewing several recommended practices, as well as common pitfalls, can help small teams stay on track and improve the efficiency of their audit work. These "do's and don'ts," in other words, help ensure small shops still have a big impact on the organization.


Announce the Engagement

The purpose of an audit announcement letter is to introduce the engagement's objective and scope, the planned audit launch date, the length of the engagement, and the auditors who will be working on it. Announcement letters are also a perfect place to formally set expectations for both the auditors and the client. Moreover, the letters provide an opportunity to highlight any additional information internal audit may need from the client during the course of the engagement and details that will contribute to the client's ability to ensure relevant resources and information are provided timely. Simply put, the more information auditors provide to clients at an early stage of an engagement, the less likely clients are to be anxious about it, thus enabling the process to run more smoothly.

Create Realistic Plans

Auditors can plan effectively only when they've determined exactly what they want to accomplish with the engagement and know the type of assurance they intend to provide. Negative assurance — providing assurance that no weaknesses or deficiencies exist — usually requires less time and fewer resources. Positive assurance audits, conversely, require more involvement and larger sample sizes, which translates into more audit time.

Additionally, while audit managers should always plan extra audit time for unexpected circumstances, they should avoid overdoing it. Allowing too much time for a simple and straightforward engagement may cause staff members to adjust and work less, creating a sense that they are entitled to the full time allotted regardless of whether it's actually needed.

Brainstorm With the Entire Team

If two heads are better than one, as the old saying goes, then three or more heads are even better still. Accordingly, audit managers should involve the entire team in brainstorming sessions aimed at preparing for upcoming audits. The sessions will help ensure everyone becomes familiar with the area to be audited and enable staff members to ask clients relevant questions, as well as answer any questions the client may have. Brainstorming can help speed up the audit program development process and lead to a more thorough, value-added engagement.

Clarify Audit Objective and Scope

Before even thinking about developing an audit program, auditors must first determine the objectives and scope of the engagement. They must clearly decide what the audit would aim to accomplish: Is it a compliance assurance engagement, a process review geared toward identifying risks and mitigating controls, or something else?

Ask Management

In many instances, a simple conversation with management can help ensure the engagement is directed toward value-added contributions. Auditors should never shy away from asking managers what concerns them, or keeps them awake at night, with regard to processes under their charge. Managers will often discuss their concerns freely, enabling audit to better tailor recommendations to the issues at hand.

Communicate Tasks to Staff Clearly

Effective, clear communication is especially important when an audit team comprises less experienced practitioners. New auditors may "attack" a task before they have a clear understanding of its objective. Team members instead need to fully understand the purpose of an audit before starting their work. Sufficient knowledge ultimately helps avoid surprises and make sure time spent results in valuable deliverables.

Monitor Work Closely

While avoiding micromanagement, audit leaders should strive to know what their staff members are doing every day. They should ask questions to probe the auditors' understanding of assigned tasks and then guide them with clear expectations for performance. Moreover, audit managers should hold regular staff meetings, asking team members to give briefings to the whole group about the status of their work. The updates will help keep the team lead on top of current projects, while also giving auditors a chance to ask questions. Plus, the regular discussions can help promote team building among staff.

Show, Don't Tell

Hands-on demonstration can be a powerful teaching method for audit managers. Whether someone is struggling to formulate risks or having trouble determining if a control activity is operating effectively, showing staff members how to perform the task at hand communicates in ways that theoretical, abstract explanation cannot. Enabling staff to watch more experienced team members perform their work, and giving them the opportunity to ask questions during the process, can provide for a robust, informative learning experience.

Sample Smart

A large sample does not necessarily constitute a good sample. If possible, samples should focus on a period of time that merits attention, or a certain individual. Or, the auditor may elect to choose larger amounts rather than small amounts, or vice versa, depending on the nature of the concern and the testing objective. Focusing the sample will help improve testing efficiency and provide more valuable deliverables. Moreover, using the same sample for multiple purposes can help optimize efficiency as well.

Send Clear, Timely Documentation Requests

After obtaining a clear understanding of the supporting documentation needed for an audit, practitioners should send documentation requests to process owners as soon as possible — right after the audit announcement, or directly following the kick-off meeting. Requests should be as precise as possible, and they should include a reasonable deadline. Moreover, auditors should make themselves available to process owners for any questions pertaining to the request. If the owner voices concern over the deadline, the auditors should offer to ask management for additional help, rather than "giving in" and granting a deadline extension. Otherwise, the auditor is just giving away valuable audit time that could be used for other tasks.  

Deliver a Clear Audit Report 

Concise, straightforward observations stand a higher chance of capturing readers' attention rather than long, elaborative ones. Lengthy introductions and process descriptions should be avoided in audit reports, saved instead for the workpapers. Reports should be short and practical, without compromising the intended message. Most importantly, auditors should keep in mind that if the audit has been well-prepared, and the workpapers are of high quality, report writing becomes much simpler. The information on hand merely needs to be tailored — adjusting, for example, any technical language — to the intended audience.


Avoid Deviating From the Engagement Scope and Objective

It is quite common, especially for inexperienced audit staff, to drift from the initial audit objective. Sometimes the auditor discovers legitimate issues that deserve attention but do not necessarily contribute to meeting the objective. Auditors should understand how to recognize and communicate these issues, include them in the notes for the next year's audit (or some other audit), and get back to the original path swiftly.

Don't Overdocument​

Well-documented findings are of great value to any audit. At the same time, though, auditors must be able to judge what constitutes a "reasonable" amount of supporting documentation — enough that any reader would reach the same conclusions as the auditor — without overdoing it.

Don't Delay Audit Review or Report-writing

Information is best captured when it is "fresh" in our minds. Hence, report-writing and review is easiest when performed as soon as possible. Prompt review and reporting helps make sure projects are completed as planned, frees audit staff for new engagements, and provides for continuity of output. Moreover, it ensures management receives timely, meaningful recommendations.

Avoid Unnecessary Meetings

Oftentimes, addressing an issue identified from an audit requires the involvement of several managers; auditors should avoid having separate meetings with these individuals, if at all possible. Discussing the audit report with all parties at once optimizes efficiency and helps ensure issues are clearly understood and that responsibilities and solutions aimed at addressing them are more easily identified.

Internal auditors should also invite to meetings only those managers necessary to the discussion. For example, auditors should avoid involving executive management in issues that are clearly operational nature, keeping discussions limited to process owners whenever possible. If, however, management insists on a more broadly inclusive approach, then internal audit must determine how to accommodate the request while still maximizing audit efficiency. Under such circumstances, auditors might consider sending draft reports to managers' attention but then limiting discussions with them to issues that have not already been addressed through meetings with the process owners.

Don't Start New Projects Too Soon

Audit managers should discourage team members from moving on to other projects before completing tasks related to the current engagement. Even better, they should avoid issuing new assignments until the current audit is completed, or at least very close to completion. Proceeding to a new audit while another is still underway in some circumstance may be necessary, but it may cause auditors to leave tasks unfinished as the new assignment takes priority, ultimately causing the primary audit to go on unnecessarily long.​

Optimizing for Success

When lacking a sufficient number of well-qualified, experienced staff members, small audit teams often feel unable to stay on top of their audit plans or adjust to unexpected circumstances. Nonetheless, today's challenging business climate demands that auditors continue finding new ways of improving their work efficiency while adding more and more value through high-quality deliverables. The audit "dos and don'ts" may in some instances seem intuitive, but adhering to sound practice on the profession's fundamentals can provide just what small-shop practitioners need to meet their often very big challenges.

Amra Durmišević, CIA, CISA, CRMA, and Berina Fazlić-Frljak, CIA, CRMA, are internal audit professionals in the financial services industry.​​

Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.​



Comment on this article

comments powered by Disqus
  • Gleim_Oct2018_Premium 1
  • IIA CERT CIA_Oct2018_PRemium 2
  • IIA CIALS_Oct2018_Premium 3