Navigating Ambiguity: Strategies for Handling Controversial Audit Findings in Internal Audit

Internal auditing involves finding inefficiencies, risks, compliance gaps, and areas for improvement within an organization's operations, processes, and controls. It aims to identify issues that may impact the organization's objectives, financial integrity, regulatory compliance, and overall performance. However, an audit finding may be controversial or ambiguous for any reasons. In such situations, it is required to understand the root cause and business impact of the audit finding to take the decision of closure on the finding or convince the auditee and reporting the finding. Following root cause wise analysis may be helpful for taking decision in case of controversial or ambiguous audit finding.

Absence of Process and Design Gap in Process: The lack of established procedures or guidelines can lead to inefficiencies, errors, or non-compliance. For example, if there is no documented process for inventory management, it could result in discrepancies and inaccuracies in inventory records, Stock outs, overstocking, blockage of working capital and risk of theft.

Similarly, Flaws or weaknesses in the design of existing processes / SOP can contribute to audit findings. For instance, if a company's procurement process lacks segregation of duties, it increases the risk of fraud or errors going undetected.

Absence of processes or Design gap in SOP/ process within an organization can have significant impacts across various locations. Without clear written guidelines, SOP’s and controls, there is a higher likelihood of errors, fraud, non-compliance with regulations, and inability to address emerging threats effectively at multiple locations and areas. In observations, where root cause is Absence of Process or Design Gap in Process, it recommended to report the observation in the audit report even after it has low financial impact at one location as it may have significant impact on the organization.

In response to such audit finding, engage in constructive dialogue with the auditee, emphasizing the observation's impact. Develop a detailed action plan to develop or update the SOP / Process with auditee / senior management and implement it across the business.

Non-Compliance by People in the Organization: Failure of individuals within the organization to adhere to policies, procedures, or regulations can lead to audit findings. This could be due to lack of awareness, insufficient training, or intentional disregard for established protocols. Non-compliance by individuals within an organization should be reported in an audit report when it represents a significant risk to the organization's operations, or compliance obligations. This decision depends on factors such as the severity of the non-compliance, its impact on the organization, the likelihood of recurrence etc. It is generally appropriate to report instances of non-compliance in the audit report under the following circumstances:

1. Non-compliance that is material to the organization's financial statements, regulatory obligations, or operational effectiveness should be disclosed in the audit report.

2. Non-compliance with SOP or policies that could result in fraud, errors, or misstatements should be reported if it undermines the reliability of financial reporting or poses a risk to the organization's assets.

Conversely, instances of non-compliance may not be reported in the audit report if they are immaterial, isolated, or have minimal impact on the organization's operations, financial statements, or compliance obligations. In such cases, auditors may choose to communicate findings through management letters or other channels for internal follow-up and corrective action.

System Limitations: Deficiencies in technology systems, software, or infrastructure can contribute to audit findings. This might include outdated software, inadequate security measures, or incompatible systems. In such cases, it should be reported in an audit report when they significantly impact financial information accuracy, increase the risk of misstatement or non-compliance, impair operational efficiency. However, if limitations are immaterial, known to management, management has effectively addressed them, reporting may not be necessary.

?

?

Example for handling the controversial or ambiguous audit finding

A major project with a budget of Rs. 1000 crores were successfully completed in September 2023. However, despite the project's completion, the capitalization of assets associated with the project was not performed until March 2024. This delay in asset capitalization stemmed from several factors, including the departure of the project manager from the organization in the first week of October 2023 and the absence of a replacement until March 2024. Additionally, the componentization of assets, a necessary step for capitalization, had not been completed by the time of the project manager's departure.

The audit finding highlights the delay in capitalizing assets related to the completed project, which occurred several months after the project's completion. This delay raises questions about the accuracy and timeliness of financial reporting, especially regarding the inclusion of project costs and depreciation in the organization's financial statements.

There is ambiguity regarding the responsibility for ensuring timely asset capitalization and the accountability for the delay. While the departure of the project manager contributed to the delay. Further, there is no financial loss to the organizations as this the matter of delay in capitalization (i.e. moving the CWIP balances to Assets)

In this situation, initiated constructive dialogue with the auditee and clearly communicate the impact of the observation that

1.???? Without timely capitalization, the project costs may not be accurately reflected, affecting key financial metrics such as profitability, asset utilization, and return on investment. This observation raises concerns about the reliability and completeness of the financial statements.

2.???? Delays in asset capitalization may erode stakeholder confidence in the organization's financial management and transparency, potentially leading to reputational damage and regulatory scrutiny.

Conduct the collaborative problem-solving sessions involving cross-functional teams from both the audit and operational sides. By encouraging active participation and knowledge-sharing, foster a sense of ownership and accountability for remediation efforts.

Develop Action Plan: Develop a comprehensive action plan outlining specific steps, responsibilities, timelines, and resource requirements for remedying the delayed asset capitalization and strengthening financial processes and controls.

Implement Controls: Implement controls and monitoring mechanisms to track asset capitalization timelines, escalate issues, and ensure compliance with accounting standards and organizational policies.

Conclusion:

By adhering to a structured decision-making process, communicating detailed business impact, stakeholder prospective and employing collaborative resolution strategies, auditors can address the controversial and ambiguous audit findings in a proactive and transparent manner, the organization can mitigate risks, enhance financial reporting accuracy, and demonstrate its commitment to accountability and compliance.