What’s in an action plan for audit findings?

The Yellow Book requires the auditor to give the auditee a chance to respond to findings. Many audit teams call these responses an action plan for audit findings.

However, the Yellow Book is vague about the content of the auditee’s response. A wise auditor will ask for specifics from the auditee so the findings are easier to follow-up on later.

So, why is the Yellow Book vague about the content of the responses? Maybe it is an oversight or maybe it is because the main goal with this particular standard is to enhance accountability and transparency, two of the GAO’s favorite concepts! The auditee’s action plan for audit findings shows the reader (transparency) that something is going to be done about the problems identified (accountability).

The action plan also lends a balanced tone to the report because the auditee has a chance to point out when the auditor is completely off-base. In contrast, the AICPA auditing standards are not focused on accountability and transparency, so audit reports created under AICPA standards are one-sided documents where only the auditor’s side of the story is shared.

Some auditees refuse to play along

When I think about an action plan for audit findings, I am reminded of an audit of a state agency comprised mostly of attorneys. We wrote them up for several significant findings, and the attorneys agreed at the exit conference to implement the recommendations. We kindly asked for their response in writing, so we could put it in our report.

What we didn’t do is give them any guidelines for their action plan – such as a firm deadline or maximum length. So, after the attorneys explained their situation to every powerful political decision-maker that would listen (the Governor, the Comptroller, the Speaker of the House, the Legislative Budget Board), the attorneys kindly gave us back an eight-page(!!!) response to our findings that had nothing to do with our recommendation.

They used fancy legalese and personal visits with powerful politicians to skirt accountability while delaying the publication of our report for another month.

Oh, joy!

We kindly told them to cut their response down to 200 words or we would do it for them. They dragged their feet for another whole month before giving us responses that still didn’t respond to our findings, although we did have to give them credit for making their response shorter.

Then we (not so kindly) included a follow-up comment in our report pointing out how weak their response was. Then the attorneys not so kindly complained that it was unfair of us to respond to their response because they wanted the last word!

So much drama could have been avoided if we had clearly stated our expectations regarding the content, length, and timing of the action plan for audit findings ahead of our audit (of course, this assumes that they would have played along with our expectations!).

What should be in the action plan for audit findings?

Nowhere in the Yellow Book standards does it say how long the client’s response should be. So you are on your own with that parameter!

But the standard does require that the auditee include planned corrective actions (an action plan) in their response.

6.57    Auditors should obtain and report the views of responsible officials of the audited entity concerning the findings, conclusions, and recommendations in the audit report, as well as any planned corrective actions.

But, that is where the GAO stops. The GAO is not specific about what should be in the audit finding action plan. Here are a few key questions the auditee could answer in their action plan:

• Do they agree with the audit finding?
• What steps are they going to take to resolve the condition statement and the cause statement of the finding?
• Who is going to take action? (Don’t name names, but instead name a role. For instance, say “City Manager” instead of Joe Bob Briggs!)
• When are they going to take action?

No surprises, please!

Hopefully, by the time the report draft is shared, the auditee is well-aware of what the auditor is going to say and is not surprised by the report draft. Talk about drama!

Section 6.61 counsels us to get feedback about our report early. It asks us not to surprise the client with the findings at the end of the audit.

6.61    Providing a draft report with findings for review and comment by responsible officials of the audited entity and others helps the auditors develop a report that is fair, complete, and objective. Including the views of responsible officials results in a report that presents not only the auditors’ findings, conclusions, and recommendations but also the perspectives of the audited entity’s responsible officials and the corrective actions they plan to take.

Written or Oral?

The end of Yellow book section 6.58 suggests that the auditee’s action plan for audit findings should be in writing. Then the very same section waffles a little bit and says that oral comments or oral responses may be the most expedient way to get the audit done.

If oral comments are used, the auditor needs to write up the response and give it to the client to verify that the auditor understood the response and will correctly represent it in the report.

6.58     When auditors receive written comments from the responsible officials, they should include in their report a copy of the officials’ written comments or a summary of the comments received. When the responsible officials provide oral comments only, auditors should prepare a summary of the oral comments, provide a copy of the summary to the responsible officials to verify that the comments are accurately represented, and include the summary in their report.

Practically, the give and take necessary to clarify oral comments would not have worked with the agency full of attorneys. But, for some clients, it will work like a charm and significantly reduce the time involved in the reporting phase of the audit.

6.62    Obtaining oral comments may be appropriate when, for example, there is a reporting date critical to meeting a user’s needs; auditors have worked closely with the responsible officials throughout the engagement, and the parties are familiar with the findings and issues addressed in the draft report; or the auditors do not expect major disagreements with findings, conclusions, or recommendations in the draft report or major controversies with regard to the issues discussed in the draft report…

Auditors get the last word

It is also a good idea to remind the auditee that you will have the last say in the audit report. If you cannot come to an agreement with the client, then you can respond to their response.

Sometimes clients give us responses that have nothing to do with the issue, or they may promise something that you know they are unable to do. Section 6.59 tells us that we need to evaluate the responses of the client and can mention our evaluation in the report.

6.59    When the audited entity’s comments are inconsistent or in conflict with the findings, conclusions, or recommendations in the draft report, the auditors should evaluate the validity of the audited entity’s comments. If the auditors disagree with the comments, they should explain in the report their reasons for disagreement. Conversely, the auditors should modify their report as necessary if they find the comments valid and supported by sufficient, appropriate evidence.

It also counsels us that even if the client says they are going to fix a issue, it does not mean that we delete the issue from the report. The issue and its resolution still need to go in the report – again to enhance accountability and transparency.

You don’t have to wait forever!

And if there is conflict, as there was with those verbose attorneys, the auditee may delay their response which will result in a delayed publication of the audit report. If the auditee drags their feet, the GAO allows us to publish without their response after a reasonable amount of time.

6.60    If the audited entity refuses to provide comments or is unable to provide comments within a reasonable period of time, the auditors should issue the report without receiving comments from the audited entity. In such cases, the auditors should indicate in the report that the audited entity did not provide comments.

What is a ‘reasonable amount of time?’ You have to decide that. If your audit only lasts a week, then a two-day turn-around seems reasonable. If the audit lasts four months, two weeks seems reasonable. Whatever you decide, I recommend that you inform the auditee of your expectation before the audit commences while everyone is still friendly.

So there, you ornery attorneys!

Want to know more about how to write findings? Check out this short on-demand video.