by Norman D. Marks, CPA, CRMA

Businessmen Looking at Computer MonitorsSo far, I have discussed “What Should Auditors Audit?”and “The Risks to Include in the Audit Plan”.

Now I want to talk about how we should staff the audit engagement and how technology can help us. We already know the risks that will be addressed in the engagement and whether it will be an assurance or an advisory (or consulting) project.

So, who needs to be on the project and for how long?

I like my audits to be crisp – short and to the point. I want the audit team to focus on the risks to the organization as a whole that we identified when we built the audit plan, and not be distracted by risks that are only important to the location. (I will listen to requests to expand the scope of the audit, but a good case will have to be made before I divert resources from another audit to increase the scope of this one.)

If they are to be crisp, the team has to include staff with the necessary skills and experience. I also want high quality results, so I will only assign junior staff where there is work that they can do without excessive hand-holding. I don’t assign staff just so I can train them; they have to carry their weight on every project.

The risk area may be one where my staff does not have the necessary skills and experience. In that case, I will either augment the team with a co-sourced consultant or an expert I can borrow from the business (generally somebody from another division or location), or I will outsource the project. I am reluctant to outsource an entire project because I like to develop and retain skills in-house. At minimum, therefore, the engagement will have an internal project manager responsible for ensuring the work is of the required quality and for the final report to management and the board.

Some internal audit departments have audit engagements that run for months. Mine rarely exceed 200 hours because they’re focused on the risks that matter to the organization as a whole; they’re not even close to full-scope audits of the location or process.

Analytics Can Improve the Quality of Your Audit

Technology can help the audit’s quality and efficiency. For example, analytics (whether using existing management reports or ones developed for internal audit) can provide insight into business trends and transactions that merit review; the software can be used to test data against pre-determined rules to identify potential anomalies or to sample activity for detailed testing.

In an audit that I performed years ago, I was able to chart the incidence of IT application failures and demonstrate to management that the rate of failure was increasing – indicating that the quality of application testing was insufficient.

In another audit performed by my team, they used analytics to show that the time spent by our in-house lawyers reviewing contracts was the same regardless of the size of the contract. Their analytics let them identify the volume of contracts of different values (i.e., how many exceeded $10 million, how many were between $1 million and $10 million, and so on) so that management could determine when a full and when a limited review should be performed by the attorneys.

However, care must be taken before investing hundreds of hours or thousands of dollars in technology. Many make the mistake of buying what appears to be the latest and greatest without first defining their needs. We must remember that our aim is a risk-based audit program and providing assurance on the risks that matter. Any use of technology should be focused on the risks we include in the audit plan. Don’t get the software and use it to do what comes easily (using the routines included with the software, or focusing on the data instead of the risk). We also need to make sure there will be an adequate return (ROI) from the use of the software.

Fortunately, modern analytics is often easy to use and even available on mobile devices.

I don’t understand why some auditors don’t have iPads or the equivalent that are loaded with ‘mobile analytics’ (the same software used by management) that gives them easy and ready access to corporate data. Do you?