Audit Program: Fresh vs. Canned?

Ah, soup in a can. I ate a lot of it – especially in college – because it was so easy and fast to make and I knew very little about cooking. I survived on cheese and crackers, ramen, Ragu and canned soup. My mother-in-law took pity on me and taught me how to make real chicken soup, entirely from scratch with no cans involved. Then the canned stuff didn’t taste so great any more.

Fresh or canned audit program?

In the same way, as you evolve as an auditor, a canned audit program won’t look as appealing any more.

When you first started auditing, the canned audit program was a lifeline! You held on to someone else’s audit program for dear life because you didn’t really understand what you were doing. But after conducting a few audits and having your work reviewed by supervisors, you learned how to gather convincing evidence.

Three ways to get to an audit program

When it comes to designing your audit approach, what should you do? The audit program is a commonly used document that list the procedures you plan on conducting in order to reach a conclusion against your audit objective. There are three ways to achieve this:

1. Use a canned audit program;
2. Modify an existing audit program; or
3. Create a fresh audit program from scratch

Option 1: Copy the audit program the auditor used last year [commonly referred to as the SALY (Same As Last Year) approach], find one on the internet, buy one from an audit service like PPC or request one from another auditor.

Should you use an audit program someone else developed? Someone who isn’t even on your audit project? Usually the answer is no. You should create your own audit program.

Because the authors of these canned (or already written) programs made some assumptions and wrote them for a particular set of circumstances, they won’t likely be the best fit for you on this engagement. It’s sort of like heating up a can of canned soup. It’s pretty good, but you know there’s something better. In using a canned audit program, you will likely do test work you didn’t need to do or, worse, not respond to the risks you’ve identified.

Option 2: This is a little better than Option 1, because you aren’t just blindly accepting the canned soup you were given without any modification. However, you’re still being swayed on what the best procedures are using someone else’s opinion. Remember, they aren’t there with you and don’t know what you know. Again, you might end up doing unnecessary extra procedures. This is akin to doctoring the can of Campbell’s soup by adding some fresh chicken and veggies. The flawed base of the soup is still there, so it won’t be quite right.

I do see a lot of ‘historical’ audit programs when I work with large audit teams. Audit programs just get bigger and Bigger and BIGGER every year since the next generation of auditors tack on a few more procedures. It reminds me of this quote from Calvin Trillin, “The most remarkable thing about my mother is that for thirty years she served the family nothing but leftovers. The original meal has never been found.”

If you do decide to copy another auditor’s program, make sure to clean it up before testing. Remove irrelevant or unnecessary procedures entirely or replace the unwanted procedures with something you know will be faster and/or provide better evidence.

Option 3: Creating a fresh audit program from scratch is the best approach. It only takes about 30 minutes to write down viable ideas for audit procedures. After working with the client for a bit, you will know where the risks are and where you can easily access convincing evidence when it comes time to write the audit program. In the long run, you will likely save time if you write your own audit program because it is customized for your situation. See this blog post for more on how to write a fresh audit program.

When is a canned audit program preferable?

A canned audit program can be an efficient way to run an army-style audit. What I mean by this is when multiple teams need to be sent to multiple locations to do the same work and report uniform or similar results back to headquarters.

For example, let’s say you are a state-level auditor. You need to visit 20 municipal grantees to ensure compliance with the terms of a new grant and then summarize the results in one overall report. In this case, you could send 20 different audit teams out with the same canned audit program and expect them to report back similar results to summarize in the master report.

But in most cases…

Again, an audit program written specifically for the circumstances of each individual audit is best in most cases. Each auditor should, after spending some time gathering information on the subject matter and becoming familiar with the nature of the evidence available, write their own audit program from scratch. I’ll leave you with a quote from Thomas Keller: “Once you understand the foundations of cooking – whatever kind you like, whether it’s French or Italian or Japanese – you really don’t need a cookbook anymore.”

Want to learn more about this subject?

Want to shore up your foundations of auditing? Join Leita at the next Virtual Audit Bootcamp, April 17-21… Space is limited!