How do you update your audit plan and scope when expediting an audit?

In my experience, there is provision for special audit assignment in the approved audit plan for the year. So management could request for a special audit to be carried out without affecting timelines of other audit assignment. But in the course of an audit if it requires that the audit steps and scope should be changed as a result of new emerging risk or any other reason, it should be communicated to management and the Risk and Control Matrix updated to reflect these new risks.

Identify the reason for expediting the audit: audit objective changes, emerging risks, or requests from stakeholders. Evaluate any new or heightened risks that necessitate the accelerated timeline. Revisit the audit objectives to ensure they align with the current situation. Adjust the audit scope to focus on the most critical areas impacted by the change. Consult with the auditee, audit committee, and management for insights and expectations. Redefine audit criteria to match the revised objectives and scope. Prioritize tasks and resources to effectively address the expedited audit needs.

Audi Plan is designed based on data obtained so far and events occurred so far. The risks identified and assessed for materiality were based on the data and knowledge of the subject matter obtained so far. Once field work started there might be new information or events that occurred but not known at the time of planning are now discovered. This new information can be very significant matter that need to be disclosed to all stakeholders. Therefore, the auditor may consider revising or updating their plan and may also increase their scope to cover the period in which the event happened. Audit plan is therefore not a one time job. It need to be regularly reviewed.

Understanding stakeholder expectations and priorities is the key aspect for timely results. At the same time, communication within Audit team and clarity on deliverables are equally important. In my experience, if the audit team down the line is aligned and communicated regularly about change in the approach the chances of meeting the deadlines are higher.

For expediting an audit involving multiple stakeholders, always make it a point to: - Clearly identify stakeholders for each audit area / process. - Enquire about any planned leaves. - Alternate points of contact in case of unplanned leaves. - Establish a system of providing weekly progress updates to stakeholders. - Set-up weekly meet-ups with stakeholders to discuss any bottlenecks, delays, etc. Note: It is a good practice to include the above considerations while planning for an audit and not just at the time of expediting the audit.

Inform stakeholders of the decision to expedite the audit, clearly outlining the rationale behind it. Explain the implications of accelerating the audit, including any potential impacts on the process and outcomes. Detail the expected outcomes of the expedited audit to set clear expectations. Seek feedback from stakeholders to incorporate their insights and concerns. Request formal approval for any modifications to the audit objective, scope, or criteria. Reassure stakeholders of your commitment to maintaining audit quality despite the expedited timeline. Foster open communication lines for ongoing updates and collaborative problem-solving during the audit process.

In my experience, the Risk and Control Matrix (RCM) helps us to identify the high-risk areas and the limited resources allocated to these areas.

Adopt a risk-based approach to identify audit areas with the highest impact, likelihood, and urgency. Utilize a value-added approach to pinpoint audit areas with potential for significant improvement and efficiency gains. Assess each audit area for its potential financial and operational impact on the organization. Prioritize areas that are critical to regulatory compliance and legal obligations. Focus on audit areas that are subject to recent changes or have historically shown issues. Allocate resources to areas where audit findings can provide strategic insights for decision-making. Continuously reevaluate priorities as the audit progresses to adapt to emerging risks or findings.

One thing I have found helpful is that in streamlining the audit procedure to eliminate any unnecessary or redundant ones, I keep the audit procedure comprehensive enough to be able to cover all the objectives of the audit without compromising the audit quality.

Apply a risk-based approach to adjust the level of assurance and testing required for each audit area. Utilize a value-added approach to determine the most efficient types and extent of evidence needed. Eliminate redundant or low-impact audit procedures to focus on more critical areas. Incorporate technology and data analytics tools to automate and expedite audit processes. Continuously evaluate and adjust procedures to ensure they remain relevant and efficient throughout the audit. Emphasize clear documentation and communication to maintain audit quality while streamlining procedures.

To add further, the use of Continuous monitoring tools to collect and analyze data from various sources to detect anomalies or deviations in real-time is critical. The continuous monitoring tools generate alerts, provide dashboards for monitoring key performance indicators, and help organizations ensure compliance, manage risks, and improve efficiency. These tools also play a vital role in maintaining the integrity of processes, enhancing security, and reducing the need for manual oversight and audits.

Utilize data analytics tools to quickly analyze large datasets for trends and anomalies. Implement automation software to handle repetitive audit tasks and improve efficiency. Employ statistical sampling techniques to examine representative data without checking every item. Conduct interviews with key personnel to gather insightful, qualitative audit evidence. Use surveys to collect information and perspectives from a broader group of stakeholders. Perform walkthroughs of processes and systems to gain a real-time understanding of operations. Integrate cloud-based audit tools for real-time collaboration and access to audit resources.

Developing a report-writing checklist could bring standardisation and also avoid the use of words which may mean something different to the auditee.

For writing a concise & clear audit report, you should always remember the 5C's approach by the Institute of Internal Auditors (IIA): - Correct state: What are the ideal criteria against which you are evaluating, determined based on established policies & procedures, industry best practices or as agreed with process owners? - Current state: What is the current situation on comparing to the correct state? In other words, what did you discover during your audits? - Consequence: What is the risk that the current state possesses? - Cause (root cause): What is the root cause for the current state to happen in the first place? - Corrective action: What can be recommended to address the correct state and bring it within the risk appetite?