Auditing when those being audited don't have the time - 3 strategies

When you're performing audits in a challenging environment, can you relate to any of the talented (yet stressed) auditors in the photos below? My guess is "yes." Moreover, can you think of an audit environment today that isn't challenged in some manner?

Because so many industries are experiencing staffing shortages, I can't think of many organizations that have spare people in the lines of business just sitting around waiting for an auditor's request list to arrive. No, no spare staff, and the staff that are there are stressed beyond belief. Perhaps they're trying to perform month end closing; perhaps they're trying to launch a new product; perhaps they're trying to address customer concerns; perhaps they're working on a merger/acquisition deal; perhaps they're just trying to get the day-to-day work done with only 75% of the staff. The point is, there isn't a spare minute available for people in the lines of business to either gather audit documents or meet with audit staff. Yet...

...yet the audit has to get done. That part isn't up for debate. Chief audit executives have an Audit Plan approved by the Audit Committee, and audit slippage is viewed negatively. So what's an auditor to do?

Here are three strategies for auditing in an environment where those people being audited (the auditees) have no time for the audit:

1) Be sure to staff the audit with subject matter experts. Nothing is more inefficient, and annoying to auditees, than having an audit staffed with newbies who don't even understand what they are auditing. That quickly becomes a multi-week training session where the people in the lines of business have to train the auditor. And remember... they don't have time. This situation doesn't have a good outcome, and we all want good outcomes. Staff audits with subject matter experts who understand the audit area. This doesn't mean that every auditor on the audit has to be a subject matter expert -- that's impossible to achieve. But the audit lead needs to thoroughly understand the topic being audited. "Well begun is half done."

2) Read, read, read. The people in the lines of business have spent countless hours creating written policies, procedures, standards, risk assessments (we hope), forms, systems documentation, workflow documents, flow charts, website content, social media content, product announcements, meeting minutes, and project documentation. Read it. Compare what you read in one document to what you see in another document. Most talented auditors can glean enough information from digesting available information to have a pretty good idea of processes and controls in the audited area. This type of auditor will have extremely efficient and effective walk-through sessions with auditees because the time will be spent confirming and clarifying the auditor's understanding, not training the auditor from scratch. Instead of a total of 5 hours needed with the auditees, perhaps it's only 30 minutes, AND the result is likely more accurate. The auditees will be impressed that the auditor took the time. The auditees will be impressed that the auditor showed up at the walk-through totally prepared. This is a classic win-win.

3) Early agreement on audit logistics and mechanics. By this I mean who will receive audit requests? Does the auditee prefer one big audit request at the end of the day, or more easily-digestible requests during the day? How will documents be transferred? Is IT needed to set up those transfer protocols? Who's responsibility is it to create folders and get access? When something goes wrong, such as an auditor not being able to open a particular document, who troubleshoots that? Will there be daily agreement on outstanding requests so everyone's on the same page? Are there central repositories the auditor can visit to obtain certain documents, and if so, can the auditee attest to those documents being the most current documents (no auditor wants to spend time reviewing documents, and then get told "oh, no, the real ones are over here... here, use these."

I think we can all agree that a poorly-executed audit really annoys auditees, and not only gives auditors a bad name, but will usually lead to inaccurate audit results. Let's avoid this by staffing audits with subject matter experts, putting in the effort to understand the control environment by reading, reading, reading (and by golly, be prepared for that walk-through); and nailing down the audit logistics and mechanics.

The above also pertains to second-line-of-defense monitoring and testing activities. These activities, like audits, chew up time for the people in the lines of business. Let's have a win-win by having these activities be efficient and effective. Let's not look like the talented (yet stressed) auditors in the photos.