Audit 15 Fun Podcast: Scope Creep

Special thanks to Jon Taber, CPA CIA CFE CFF for allowing Yellowbook-CPE.com to share his Audit 15 Fun podcast on Scope Creep featuring Leita Hart-Fanta, CPA. Audit 15 Fun airs one relevant, 15-minute internal audit webcast at least every 15 days.

You can listen to Audit 15 Fun on Spotify and Apple Podcasts.

Transcript

Jon Taber:

Welcome to the Audit 15 Fun podcast. My goal with this podcast is to bring relevant internal audit topics to the table, at least every 15 days.

Today, I have the honor to have as my guest, Leita Hart-Fanta. She’s the owner and founder of YellowBook-CPE.com, which focuses on continuing education for government auditors.

Welcome Leita to the podcast. It’s an honor to have you on.

Leita Hart-Fanta:

Thank you. Thank you so much.

Jon Taber:

Yes, absolutely. We’re going to be talking about scope creep. You wrote an article on the topic. I thought it was a really good article and a really relevant topic to the community.

So, before we get started, Leita, I want to share a quick story really quick here.

I reached out to the community for them to share some horror stories of scope creep. And I have one. I mean, it doesn’t sound too bad. But, if you think about it, it is really bad because the person said, “I started an audit of a large infrastructure project and ended up doing finance, logistics, IT and a source-to-pay project. It was one thing and it turned into something completely different.

Leita Hart-Fanta:

Yeah, and how long did it take them?

Jon Taber:

That’s a great question. I didn’t have a chance to ask.

Leita Hart-Fanta:

Did that audit have a birthday or an anniversary?

Jon Taber:

Maybe a baby could have been born.

Leita Hart-Fanta:

Maybe two babies! Holy cow.

Jon Taber:

All right, before we get started, do you have any horror stories to share?

Leita Hart-Fanta:

Oh, gosh. Well, I’ve been working with audit teams. I’ve probably worked with hundreds of audit teams. I see a lot of wasted time when I consult with them or teach classes for them. I think it all boils down to three main basic project management skills.

You’ve got to have a plan and that’s our objective, scope and methodology.

The second thing is you’ve got to have deliverables along the way, so your supervisors and your stakeholders can check in and make sure you’re on the right track.

The third thing is you got to have time limits.

I’ve seen auditors do one of those things wrong or all three of those things wrong. Then the audit has a birthday.

What I was thinking about this morning before we talked is I have a friend wanting to get another job. But she agreed to stay on until the audit was finished from federal auditors who are auditing a pandemic program. And these auditors have not finished the job. It’s taken them three years to finish the audit. So, she can’t get another job because she made this promise to her boss that she would hang on until the audit was finished.

What you’re doing, too, when you do scope creep is you are torturing the auditee. They are like, “Get out of here. When are you going to get finished with this project? You just keep digging and digging and digging.” As we know, every place we audit is different degrees of messy.

You could live your whole life there if you wanted picking away at them, just basically torturing the auditee.

So, scope creep isn’t just bad for your project and for you and how you look to your stakeholders as far as your productivity, but it’s also really not nice to the auditee. It’s not, it’s not a good thing to do to them.

Jon Taber:

Yeah, yeah, that’s a great example. Three years? We talked about audit fatigue and that is audit torture. That’s a different level.

Leita Hart-Fanta:

Audit fatigue is where there’s one auditor, two auditors, three auditors on the same subject. Audit torture is where one horrible auditor is there for two, three years, and won’t let up!

Jon Taber:

You had some things there that you mentioned, like project management skills, having a plan, having deliverables, having timelines as a way to reduce scope creep.

I do have another specific question from the community as well. The pain point from this person is that stage between field work and reviewing. Field work is getting done. It’s moving to reviewing. It’s getting to the manager, the director, VP, whatever. He’s like, “Why didn’t you look at X, Y, Z?”

Leita Hart-Fanta:

You know who’s fault that is? Who’s fault is that, ultimately? A director is not happy at the end that you didn’t look at something. That’s a fault of the deliverables.

So, I see this a lot. I see where the audit director or CAE gives somebody an assignment and then expects a miracle in six months. Instead of managing projects, keeping track of them and asking for deliverables along the way and correcting them before they go the wrong direction. That’s a function of deliverables. When I hear that, clients call me and say, “Hey, we got a problem with our projects. We got a scope creep issue. Can you fix it?” Honestly, the first place I look is to the directors and the management.

Right now, I’m rewriting someone’s manual to comply with the new IIA standards. And, what I’m noticing in the standards is, “The CAE will, The CAE will, The CAE will…” So, the standards are kind of demanding that the CAE gets involved in the process as it is proceeding instead of waiting till the end.

If your audit director complains at the end of the process you went the wrong direction, why didn’t they catch you earlier?

Jon Taber:

Right. Great point. Just review early and often, right? You have to have discussions.

Leita Hart-Fanta:

That’s why we have the concept of deliverables.

Jon Taber:

Yes, yes, absolutely. All right. Last question for you, Leita.

This is another one also from personal experience that was shared.

Sometimes, you say that to the director, VP or CAE, “Hey, let’s review early and often. Let’s talk about these things.” And then the person may say, “Hey, okay, let’s do that. But at the end, when I’m reviewing stuff, I just thought of something. There’s a risk there I see that maybe you guys missed, and we just need to go where the risk is.” So, how to respond to that?

Leita Hart-Fanta:

Know what the risk is.

So, if you do value finishing a project, you must, at some point, say, “Let’s just finish what we got in front of us and then we’ll do another project to tackle that risk.” It really depends.

The story I tell in my seminars is that my husband and I built a house outside of Austin in the country after our kids moved off to college. We downsized and because there’s these beautiful trees on the property, we had to custom design the house. Really get specific about what we wanted. That took a long time. It’s kind of like a good audit. You take a long time to get really specific.

But right after the builder had put up the frames to start pouring the foundation and we agreed to everything, I went traveling. Because the pandemic lifted, I went to see my sister-in-law. She had this unreal walk-in shower that was just enormous! I said, “I need that in my new house.”

Here’s where scope creep begins.

I called the builder and I say, “Stop work! We need to put in this new shower.” He said, “Well, I can do that, but…” Then he gave me all the options. Like you can reduce the size of your master bedroom, which was already smaller than it should have been because of the trees. Or, you can get rid of your master closet. Or, we can bump out the side of the house, get a variance from the city, reframe. It will take a couple of extra months. Any of these activities involve re-plumbing and, at a minimum, it will cost $40,000 bucks, plus extra time. That’s what you have to think. Of course, I stuck with my old, original plan. At some point you have to say, “Let’s just finish what we got in front of us.”

Jon Taber:

Right.

Leita Hart-Fanta:

I would say after you do the risk assessment and you define your objectives and your scope and your methodology, you try to do everything you can just to stick to that. Don’t say things like, “Hey, while I’m out here, while I’ve got this data in front of me, let’s massage it this way. Why don’t we run some queries this way?”

That basically negates your risk assessment and throws away all the planning you just did. Trying to tack on another bathroom. Your audit is going to look like a hodgepodge. You will have this beautiful facade on your audit. And then you have a tack-on the side. That was another problem with tacking on the bathroom. It was going to mess up the format of the house from the outside.

At some point, you just have to finish what’s in front of you. But I can see how this happens to people because their curiosity just keeps rolling and rolling and rolling. Yes, they talk to people and these other risks come up. But you have to think about when that happens, should I make another project for this and get rid of other risks? Should I revamp my entire audit plan and get rid of these other risks that are minor? Maybe I can’t do the audit I originally intended. I have to carve out spots in my audit. Get rid of things I was planning on doing to take this risk into account, like taking your master bedroom and replacing it.

You’ve got to be conscious and get everybody to agree this is the way you want to go. Including the stakeholders, including the client and document it and know how much it’s going to cost you to do it. Then do it. Just don’t ‘do it,’ because you’re going to end up with a mess. And an anniversary. And a birthday.

Jon Taber:

Ha ha. Right. Yes

Leita Hart-Fanta:

It’s hard. Auditing is hard. And auditors… I’m afraid a lot of auditors think they’re not being thorough if they don’t look at everything. And so, it hurts their feelings to skip things. But while they’re sitting there looking, looking, looking at this particular subject matter, what they’ve got to realize is back up, look at the big picture for the whole organization. While they’re fussing over something, maybe not so significant here and experiencing scope creep, something else in the organization is on fire and they’re not looking at it.

I want my house to be absolutely perfect. And everybody wants their audit to be absolutely perfect. But it will cost you in time or money.

Jon Taber:

No doubt. Yes.

Leita Hart-Fanta:

I still wouldn’t be in this house. I wouldn’t be sitting in this house today if I kept going, “Oh, you know, my kitchen, I need some more, you know, whatever it is.”

There’s this guy in Austin, who’s a gamer. He has more money than God. He’s super successful. Has this house in the hills that he keeps adding on and adding on. It’s got secret rooms and turrets and towers and connections. The thing is just spreading and spreading and spreading. He just has all the money and time in the world. So, he comes up with an idea and he just tacks on a tower. But that’s not our gig, right? We don’t have all the time and money in the world.

Jon Taber:

There you go. That’s a great example.

How much is it going to cost? You know, What’s the price tag? Is it worth it or not? And great point from you there. I guess the only people who can do it are the ones with infinite budgets, which I don’t think it’s the case for internal audit departments out there.

Leita Hart-Fanta:

Some internal audit shops, I have to be honest, I work with do seem to have infinite resources because no one’s paying them any attention. And the audit, the auditee or the organization hires them just for the name. But doesn’t really want their audit results. So, if the auditor spends two years on a project, they don’t really care. They’re glad the auditor’s busy doing something and not looking at the real stuff. I’m not really doing a risk assessment and really understanding where the real problems are.

They’re just glad. They’ve checked the box. We have an auditor. They’re busy. Don’t talk to them. You know, like that. There’s a lot of situations like that.

Jon Taber:

Yeah, yeah. That’s a different discussion, though. A different root cause there is more of the strategic piece versus, but yes.

Great, great examples, Leita. I appreciate you being on the podcast. For those who want to connect with you on LinkedIn or just want to learn more about the work that you do, what’s the best way for them to do so?

Leita Hart-Fanta:

Yellowbook-CPE.com is my brand. I’m on LinkedIn that way. And I have a website that way. You’re welcome to write to me at info@yellowbook-cpe.com. I’d love to be connected with you guys.

Jon Taber:

Thank you so much.

Want to learn more about scope creep?

The self-study Audit Reporting Bundle is just what you need to get up to speed! Complete the included two courses, one video and one self-study. Purchasing as a bundle saves $75 and provides 11 hours of Yellow Book qualifying CPE credit. By the end, you’ll be able to differentiate among the contents of a performance audit report. That includes the audit objective, scope and methodology, and audit results.

Need more in-depth training? Leita invites you to one of her most popular classes, the Virtual Audit Bootcamp scheduled for December 9-13. Students explore each phase of conducting a government audit while complying with significant Yellow Book and IIA standards. Learn and create key audit deliverables (such as objectives, risk assessment, key controls, findings, tests, and audit documentation) to succeed as an auditor. And there’s a bonus to help you develop your interviewing skills! Earn 7 extra hours of CPE at your own pace with a complimentary self-study course, Interviewing Skills for Auditors.