In this episode of THE SAMPLE, Leita Hart-Fanta, CPA covers the concept of mirroring the objective in the internal audit report conclusion.
Welcome to The Sample, a quick discussion of auditing concepts and terms that will help you do your work. Conducting an audit in accordance with auditing standards is no small feat and I want to support you. We’ll be referring to the GAO, IIA and AICPA literature to bolster our conversations. Let’s get started.
In this episode I answer the question, “Why should the internal audit report conclusion mirror the objective?” The conclusion and objective should sound like each other, just in reverse. The conclusion, of course, answers the objective.
Consider this paragraph that performance auditors put into their audit reports if they’re following Yellow Book standards. The second sentence. Those standards require that we plan to perform the audit to obtain evidence as a basis for our findings and conclusions based on our objectives. So we have two deliverables at the end of an audit: the conclusion against our objective and findings.
Now what I see out there in practice when I’m working with various audit teams, is I see that some auditors somehow got the idea that their main goal in doing an audit was to generate findings. That’s not really what you’re after. You’re after the answer to your objective. You’re after that conclusion, which some people call audit opinions.
As you’re after, as you’re pursuing, the answer to that objective, you see things along the way that you need to report to those in charge of governance. And those are called findings. So findings are secondary. The conclusion is primary. And because of that, I recommend that you put the conclusion to your audit as the first line in your audit report because that’s what you’re really going after, and that’s where you should focus the reader’s attention, the user’s attention, on that.
For instance, look at this audit report. I love how they put the internal audit report conclusion on the very front page against their own objective. That is very cool. See, here’s their objective, but they put the conclusion right on the front page. Yeah! Nice.
Let’s look at a few objectives and let’s ask ourselves, “Could we conclude against that objective?” Alright. So for this one, I’m going to say, “Yeah, we could conclude.” See how that mirrors and looks and sounds pretty much exactly the same? Nice. Okay.
Would you be comfortable concluding on this one? Personally, I would not, because I do not like the words economical and effective. However, if it says that they were following IT purchasing regulations issued by the state, I’d feel more comfortable if I just left out these braggy words here of economical and effective.
How about this one? Would you feel comfortable concluding on this? Too much squishiness, vagueness, and general words in this one. I don’t like it.
How about this number three? I’m not crazy about that either because I don’t know what asset you’re talking about, or which component or principle of internal control you’re focusing on. This is too broad for me still.
This one, the last one, is something I feel like I could conclude on. I’m kind of digging it. Although medical equipment is a little bit of a broad term. Maybe we need to get more specific about the controls in place, maybe some criteria. But I feel like I could conclude, “The cancer clinic is not protecting medical equipment from theft.”
So, of course, this is a super short video. If you want to learn more about why those objectives weren’t so great, I recommend a short video that’s available on my website called How To Tackle a Challenging Audit Objective.
That wraps it up for another episode of The Sample. True to the nature of a sample, we didn’t talk about everything, so you’ve probably got questions. Write to me firstname.lastname@example.org and I’ll do my best to fill in the blanks. Thanks for playing.
For More Info: