Q&A – you asked us A&R magazine Jul Aug 23
Q: Having issued our internal audit report, we have now identified an omission that changes the audit opinion. Should we withdraw the original and what evidence do we need to keep for any future external quality assessments?
A: Standard 2421 states that “if a final communication contains a significant error or omission, the chief audit executive must communicate corrected information to all parties who received the original communication.”
Step one is to decide on the significance of the error or omission. Would it:
a change someone’s mind about the severity of the findings?
b change a conclusion?
c change an audit opinion?
d change an agreed action/recommendation?
If it is not significant, there is no requirement to communicate, although being transparent using informal channels can help to build strong relationships.
If it is significant, step two is about communication. You need to provide evidence, so should formally share the corrected information via email, a memo, an addendum or a revised report, depending on what is appropriate. The audit charter should also detail reporting protocols.
Lastly, step three involves identifying the cause of the error or omission. It may be appropriate to include this in the revised communication to show due diligence. If it was caused by internal audit’s methodology, this demonstrates integrity and openness to continuous improvement. If it was caused by management activity, such as withholding information, then it is an opportunity to address any underlying governance and cultural issues.
Evidence can be obtained from:
• Internal audit policies and procedures for handling errors
and omissions.
• Email correspondence and other records showing how the
chief audit executive (CAE) determined the significance and
cause of the error or omission.
• Minutes of the board or other meeting where an error or
omission was discussed.
• Internal memos and email correspondence that show the
specific information that was communicated as well as how and when the communication occurred.
• The original and corrected final communication documents.
Communicating effectively about errors and omissions and their causes protects the integrity and status of the internal audit activity. Mistakes happen because internal auditors are human.
Q: I have been set a personal objective to deliver my audit engagements within budget, as I always take too long.
Can you give me any tips?
A: The first thing to do, as with any issue you find during audit testing, is to get to the root cause of the problem.
A timesheet, if you don’t already complete one, can be a useful tool to analyse how you spend your time – it may initially feel like a burden, but there are real benefits. Be honest with yourself and find what works for you. For instance, you might find that research takes longer than planned in the afternoon, because you get side-tracked later in the day. Scheduling that type of task first thing and more structured work in the afternoon may keep you focused.
Also consider the Pomodoro technique – having short breaks at regular intervals is thought to boost productivity.
The “technical skills” area of the Resources section on the Chartered IIA website has guidance to help with specific tasks such as engagement planning, effective report writing and how to approach unfamiliar areas that you need to audit.
Q: I want to develop my skills and am very frustrated because my head of audit won’t invest in a data analytics tool. I mentioned to a colleague that I’m going to investigate what we can do, but he said that only big companies buy these tools. Is this true?
A: No. Lots of audit functions use data analytics. Understanding how data provides insight and foresight is an important part of internal auditing.
Have you considered that your CAE might also be frustrated? It’s not an easy job and CAEs are often under financial pressure, trying to meet tight budgets with increasing demand for assurance. It’s not an easy job.
Share your ideas. Busy people rarely turn down help. Your proactive approach will probably be appreciated.
You could investigate low-cost options such as the advanced functions in Excel and Microsoft’s Power Bi. The Chartered IIA runs a practical course on data analytics and facilitates the Data Analytics Working Group, a self-help group for internal auditors who either want to learn or who have experience to share.
Q: I am planning an audit of crisis management. Is there an audit programme I can use?
A: We have a variety of guidance and information to help you create an audit programme. The Chartered IIA does not provide audit programmes, since each organisation has unique assurance needs.
Our recent guidance Crisis management: extreme events may be of interest, as well as IIA Global’s publication on Resilience amid extreme change. This year will be volatile as the cost-of-living crisis adds to the stresses caused by the war in Ukraine, energy crisis and post-pandemic issues. While there is intense focus on crisis management and resilience, the core disciplines of business continuity remain valid and important.
All of our support for these topics can be found in our “How to audit” section of the resources page on our website.
Got a question? Contact the Chartered IIA technical helpline on 0845 883 4739 or email technical@iia.org.uk
This article was published in July 2023.
