Donald E. Sparks, CIA, CISA, ARM
In today’s fast-paced organizations, new developments can unfold at a moment’s notice. Critical decisions often must be made on compressed time schedules, requiring quick response and agility from relevant stakeholders. For internal auditors, serving the organizations effectively under these conditions means staying closely attuned to key changes and communicating any concerns timely. But despite these demands, many internal auditors rely on slow, tried and true methods of communicating issues to management and fail to meet their clients’ needs.
No one would disagree the traditional draft and final audit report is internal auditing’s best opportunity to get management’s undivided attention. It enables auditors to show management the benefits of the audit, helps demonstrate what internal auditing can offer the organization, and provides an effective means of sharing management’s reaction to findings. With full distribution to the senior management team and the board of directors, audit reports can serve as a vital communication tool and help promote the audit function.
Relying exclusively on audit reports for management communication, however, can be problematic. Reports may be delayed because of the complexity of issues or due to the sheer magnitude of audit work conducted. Moreover, management typically views audit reports issued after a decision or corrective plan has been initiated as if they did not exist. If sluggish report issuance becomes a regular occurrence, the damage to internal auditing’s perceived value can be difficult to overcome.
A brilliantly written audit report is of little value to management if it arrives too late to be fully considered and acted upon. Observations related to fraud, waste, or abuse, for example, may require immediate attention. Or, a gap in organizational governance or policy may point to risks that must be addressed before a formal report can be issued. Moreover, information gleaned from continuous monitoring/auditing processes must often be responded to quickly, otherwise defeating the purpose of such timely analysis methods.
More responsive, expedient forms of communication are necessary to address these types of circumstances. An alternative to the audit report, for example, would be to issue a “management letter” — a timelier, streamlined document aimed at conveying a substantive issue. When a situation requiring swift reporting arises, internal auditors can summarize the issue in the letter and distribute it to all relevant parties. Just like an audit report, auditors can use the letter to outline the criteria, condition, cause, effect, and recommendations. Management can include its response, and the two parties can agree on an expected completion date.
Issuing a report on an important issue in a matter of hours, rather than several days or weeks, can be tremendously advantageous. The timely response can shine a bright light on the audit team and demonstrate its ability to add value. Moreover, as internal auditing continues to gain acceptance at organizational leadership tables, providing expedient helpful service can help maintain that cherished seat.
To comment on this article, e-mail the author at [email protected] Donald E. Sparks, CIA, CISA, ARM, is a vice president, Audimation Services, in Lake Mary, FL.