Why an audit peer review is like a trip to the dentist

An audit peer review is like a trip to the dentist; both are pretty annoying experiences, but both are ultimately good for us.  A dentist keeps your gorgeous teeth in your mouth and a peer review keeps your professional credibility in tact.

The dreaded dentist

Last year, one of my fillings fell out and I ended up in the dentist’s chair yet again.

As he was poking around checking out the spot where my filling used to be, he also found 5 – yes 5! – other cavities… a record, even for me.

This was, of course, very upsetting because they were directly behind my upper-front teeth – my precious, smile-pretty-for the world, orthodontist-adjusted, front teeth.

But what made me even more upset is that I was in this same chair a few weeks earlier for my 6-month cleaning and they had missed seeing these cavities.  “What do I pay you for?!?” I thought.

When I complained, he explained that they hadn’t x-rayed my front teeth for five years.  He intended to, and it was part of his care plan for me, but for some reason it didn’t happen.  In other, more punny words, my front teeth had slipped through the cracks!

He also said that dental hygiene is ultimately my responsibility.

“Hey,” I retorted, “I already brush two times a day with a sonic toothbrush and floss every night!” But he added a fluoride rinse to my routine and suggested I brush, then floss, then brush again.  Holy cow is that an intense, but I’m doing it out of fear of losing my teeth.

You see, last year one of my good friends (and her husband), who had chosen not to care for their teeth, had all of their teeth pulled and replaced with dentures.  It was, and still is, as awful as it sounds.

Ultimately, he agreed to x-ray my teeth – all of my teeth – every year and keep a close eye on the front ones.

But you know what?  My filling shouldn’t have had to fall out for him to see these other cavities.   He should have had a better system in place.

And that gets me to the peer review

The Yellow Book requirements for audit quality control are also very intense.  Lots of layers of controls, that some might consider overkill.  But the GAO thinks that your front tooth  – I mean your audit credibility – is worth it.

Steps that lead up to an audit peer review

Let’s review the steps that lead up to an audit peer review in light of my dentist analogy.

Yes, the GAO expects you to brush and floss.  This can by likened to auditors gathering the necessary evidence to back up their findings and conclusions.

The GAO also expects that someone who is not involved in the brushing and flossing verify that brushing and flossing occurred.  This is what is commonly termed ‘quality control.’   I liken this to my every 6-month, teeth-cleaning visit to the dentist. My own procedures at home have never been enough because I can’t see and repair my own teeth, just as I often can’t see where I missed something in the audit documentation.

But that is where the dentist stopped.  I brush and floss and he verifies that I brush and floss.  This seems like a pretty good system – but it is not good enough on a Yellow Book audit.

The GAO keeps going and going

In addition to auditors doing the work and making sure their work is reviewed, the GAO adds two more layers of quality control.

Wouldn’t it have been great if my dentist sat down with the results of his work every year and noted where his procedures had fallen apart?  This is where he might have caught that he hadn’t x-rayed my front teeth for way too long.

Well, the GAO really likes that idea and requires auditors to pause, at least annually, to look at their own procedures and make sure they are operating as intended and fix the ones that aren’t.  And the GAO requires that audit shops summarize the results of these monitoring procedures in a written report.

And wouldn’t it have been great for my front teeth if my dentist hired someone to visit every three years to make sure that he was doing his annual monitoring reviews?  That external review would give me, the consumer of his services, that extra bit of assurance that he’s taking care of me.

The peer reviewer’s primary job

That is what a peer review does; a peer review verifies that an audit organization has its own quality control systems in place to ensure that all findings and conclusions are backed up with compelling evidence and that the audit organization is complying with standards.  Peer reviewers should be independent of the audit organization and they visit every three years.

And although a peer reviewer does actually look inside a few customer’s mouths for cavities – excuse me – a peer reviewer does look at a sample of audit documentation to make sure it meets standards – reviewing audit documentation is not the peer reviewer’s primary job.

The peer reviewer’s primary job is to make sure that the organization has its own quality control system in place.  The peer reviewer looks at a small amount of audit documentation only to verify that the audit organization’s own quality control systems are working to correct errors.

Whose idea is all this?

Did the GAO come up with this intense quality control system on their own?  No, they got it from the COSO model.

The COSO model recommends both continuous and periodic monitoring controls.  If you would like to peruse the GAO’s version of the COSO model and what they have to say about monitoring, please see the Green Book sections 16.04-16.10.

In the GAO’s mind, we auditors should model good behavior.  It would be hypocritical of us to expect our auditees to implement layers of controls if we auditors don’t have layers of controls in place, too.

Audit peer reviews prevent decay

Keeping your teeth pretty and healthy and keeping your audit shop compliant and functioning takes diligence and continuous effort.  Because anything left on its own, without correction and care, will decay; teeth decay and audit processes decay.

The peer review is just the final step among many that the Yellow Book requires so that an audit team’s credibility remains in tact.  Credibility is everything in auditing. If no one believes our audit findings and conclusions, we might as well not have done the audit.

If you want to nerd out a little bit, please check out the requirements that relate to quality control and peer review in the 2018 Yellow Book.  Look at chapter 5.

And check out these two courses for a friendly, easy-to-read analysis of both the Green Book and the Yellow Book.  I am also leading a full-day class on internal controls at the Austin Chapter of the TSCPA next month.

As always, thanks for reading