One definition of
postmortem by Merriam-Webster is an analysis or discussion of an event after it is over. In an internal audit context, it generally refers to a final audit of the project that involves identifying lessons learned, or evaluating a recently completed audit, for the purpose of improving future audits. It enables auditors to take a less than ideal situation and turn it into a learning opportunity. In fact, the more challenging the current audit, the more useful the postmortem is during the next audit.
Audit postmortems can be used as a learning tool for auditors who are particularly unseasoned, inefficient, or error prone; after pitfall-laden audits where cheat sheets would have significantly aided the audit team; as a library of materials to train new hires quickly; as transformational tools that convert problems encountered into future improvements; and as tools for continuity of knowledge and continual improvement within the audit function. When conducting a postmortem audit, there are several tools used to document any problems, adverse situations, and successes encountered.
Real-time Data Capture Form
Each challenge encountered can be captured on a prestructured form that can be used during or immediately after the current audit. It should include such topics as: data that is particularly difficult to locate, navigate, or test, and how each was ultimately resolved; people, departments, or audit client reports that require substantial lead time; audit tests that were most and least beneficial, for use in planning future tests; how and where the most significant findings ultimately were discovered; and areas that confused or delayed new auditors.
Audit Program and Report
After the audit report is issued, auditors may be tempted to file it immediately and move on to the next project. However, taking a few minutes to review each section of the completed audit program and audit report can derive benefits. Those details can remind the auditors of inefficient or challenging areas encountered and the techniques they ultimately used to successfully complete the audit. Noting key actions that powered the audit to completion improves efficiency by enabling the team to begin the next audit with those actions.
Team Members' Ideas
Most likely, each audit team member encountered some noteworthy difficulties and successes during the audit. Including each member's suggestions in the postmortem can provide unique perspectives. The fresh eyes of a junior auditor may provide some of the most creative insights. Out-of-the-box efficiency ideas might include suggestions such as:
- Could we "red letter" executive summary points within the report, in lieu of creating a separate executive summary? It took five hours to extract the executive summary points from our 30-page report.
- As it is doubtful that Department X will have time to implement our suggestions by next quarter's audit, could they concede that improvements are still pending, enabling us to simply re-note our findings next quarter?
- Because Department Y comprised 25 percent of our audit budget but we found no problems, could we reduce the audit cycle frequency of Department Y?
- When planning the next audit of Department Z, consider allocating 10 additional hours.
Some topics merit detailed explanation. For example, including screenshots that clearly illustrate where difficult-to-obtain data was found and how it was tested can be useful in future audits. All pitfalls or opportunities encountered during the current audit are fair game for inclusion. There are no extra points for brevity, as long as the expected future time savings exceed the time required to perform the postmortem.
A useful narrative might include topics such as:
- Suggestions for dealing with people who are only available at certain times during the day or when they are in the right mood (e.g., Bob in Accounts Payable leaves at 3 p.m. and hates data requests in the afternoon).
- Kick-starter actions that set in motion and drive the bulk of the audit work.
- Lists of the most helpful audit clients for each department and the best ways to involve them.
- Time killers (e.g., people, tasks) to tactfully avoid or limit to an acceptable level.
- Audit steps requiring detailed explanations or illustrations. Such details may be difficult to remember from year to year and will be unknown to new auditors (e.g., how to reconcile confusing reports).
- Items to request early, perhaps in advance of the audit team's arrival.
- Recommended level of experience for the audit staff assigned to each section.
- Parameters for what does and does not constitute a reportable finding.
- Ideal extent of documentation for each audited department, so auditors don't over- or underproduce.
- Tips that facilitate the exit interview or expedite the audit report.
- Preparation prerequisites before going to the audit site (e.g., specific workpapers or report sections to be reviewed, especially by new auditors, before beginning fieldwork).
Instructions for New Auditors
The lessons learned from mistakes made by inexperienced auditors may be helpful to include in the postmortem narrative. This information is beneficial when, based on current audit performance, it was evident that newer auditors lacked fundamental skills such as the ability to "see the forest for the trees."
An example instruction might read: "Although internal auditors perform testing on a sample basis, our overriding goal is to protect the organization. Therefore, when no problems are found in an area that had significant problems in the past, consider whether logical reasons exist for such improvement (e.g., systemic changes implemented by the audit client since the last audit). If no logical reasons exist for the apparent improvement, select a few more items to review. This does not mean excessive testing or overkill. It does not mean nitpicking until we find a problem. It simply means that 'no problems found' in your sample must pass a reasonable logic test."
Postmortems do not create problems. Quite the contrary, they simply shed light on the problems that already exist, and then involve brainstorming methods to improve them. At a minimum, postmortems help fulfill the audit director's responsibility to protect the organization by capturing relevant information so that a new director will not have to reinvent the wheel, demonstrate to one's superiors a tangible plan for continually improving internal audit performance, and illustrate a can-do approach that embraces problems and systematically converts them into opportunities for future improvement.