Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Narrator (00:07):
You're listening
to the Assurance Show.
The podcast for performanceauditors and internal auditors
that focuses on data and risk.
Your hosts are ConorMcGarrity and Yusuf Moolla.
Yusuf (00:20):
Today we are
continuing our little mini
series on performance audit.
We previously spoke aboutthe forward work plan,
very high level, then wespoke about getting balance
that work program, andthen planning with data.
Now, I know there's obviouslylots of other things to
talk about as it relates toplanning, but I can't imagine
that there's a lot that wewould want to say, beyond
what we've already said, thatauditor s aren't already doing.
(00:41):
We're going to now dive intoa few things around conduct.
So this is mini seriesepisode number four, and
we're talking about conduct/ execution / fieldwork.
Conor (00:52):
Yeah, and they're
all pretty obvious things,
and little observationswe've made over the years.
But they're still things thatare important to help make your
life a bit easier as you workthrough your performance audits.
Yusuf (01:03):
And we find it useful
to remind ourselves of
these as we start conduct.
And.
depending on the nature ofthe audit, remind ourselves
during conduct as well, becausesome of the audits that we
get involved in could havea conduct phase that go for
three or four months really.
The first of those, and we'vebeen told this for many many,
many years obviously, isbegin with the end in mind.
(01:25):
So what is it that we needto report on at the end, when
we're developing questionsthat we want to ask of client
or the auditee, and when we'redeveloping our working papers
and when we evaluating theevidence that has been provided
to us or any information thathas been provided to us, we
want to understand what theend result is so that we don't
(01:46):
go into rabbit holes thatwe don't want to explore.
And also we get all theinformation that we need
to be able to report sothat we're getting that
information early in nothaving to chase it up later.
Conor (01:58):
Yeah.
So what we find is it's beenquite helpful right at the
start of Conduct, if youcan, even towards the end
of planning, trying to puttogether a framework or shell
for what your report mightlook like in the end, because
it's quite a good way to keepyou disciplined as you go
into your conduct, to keepyou out of those rabbit holes.
And obviously that may changeas you work through your audit
and new evidence comes tolight, but it's really good
(02:19):
insofar as possible to establishthat framework upfront.
The other thing that it helpswith it ensures that the working
papers that you have supportingthat end result report are not
just cookie cutters from yourprevious performance audit.
And that you've actually thoughtabout, what's the objective
of this particular review?
What are the sub objectives orlines of inquiry and working
(02:40):
back from that such that yourworking papers are, set up as
efficiently as possible, just tohelp you get that information.
Yusuf (02:47):
Yeah.
And often when we setup our working papers.
It's not just about whatnormally would fall into a,
table within the document ifyou like being the objective
and the criteria, the linesof inquiry, the specific
questions you're going toask, the audit approach,
the evidence you're going tocollect, often you want to have
contextual information as well.
And what we found is thatputting that contextual
(03:07):
information upfrontin the working paper
serves two purposes.
One is it helps in answeringquestions that we asking
during, conduct, but alsoit helps then piece the
information together that.
we need for the report.
So you need the contextin order to conduct the
work, but you also needthat for reporting later.
Conor (03:25):
And it's really helpful
having that context upfront in
your working papers where youhave multiple entities you're
dealing with because theymight each have a different
take on the particularcontext as it applies to them.
So it allows you to crystallizethat in your head and then
perhaps if you need to teaseout later on what the context
is in terms of your reporting.
So whether that's the macrolevel across your entire
(03:46):
jurisdiction or you're talkingabout the context for each
entity you're auditing, thenat least you've got that
information there ready to go.
Yusuf (03:53):
So that leads into
the second point and that
is sometimes it's easierto actually write the
draft report as you go.
So you spoke about puttingthe template together
towards the end of planningand early in conduct.
During conduct, if you're ableto start writing the report
based on information that you'veconfirmed, that means that you
get a headstart firstly, onreporting, but also it helps
(04:14):
you identify those areas thatyou may be lacking information
in, in order to be able toreport early on so that you
can feed that into conduct andnot have a reporting phase that
goes longer than it should.
Conor (04:26):
Yeah.
So it identifies any potentialgaps that you have in your work
that you may need to address,which is obviously important
from an evidentiary perspective.
The other thing it helpswith is we all have to work
through levels of hierarchyfor approval when it comes
to reporting and so forth.
So what we found in the pastworks quite well is the sooner
the better you can show someof the senior leaders in your
(04:48):
audit organization how ourreport's shaping up and get
their input that can actuallysave you a bit of time towards
the backend of reporting.
Yusuf (04:56):
Okay.
The third one, And this is abit more logistical, but is
more of an efficiency saverreally is that, specifically
for longer audits, you oftenneed to have some sort of
status update on the auditeither externally or internally.
Externally you usually can'tget away with much more than
an actual status update becauseyou're not always able to talk
(05:17):
about findings early, et cetera.
However when we're doinginternal status updates unless
we have a very rigid approachas an audit team or an audit
office, it makes sense tonot duplicate effort and not
create additional overheadthat doesn't necessarily
add to the audit itself.
(05:38):
So what we mean there isdon't create lots of status,
update documents and statusupdate powerpoint decks,
et cetera, just to satisfyongoing management of the audit
unless you really need to.
if the person that youreport to really needs it.
Sure.
However it is far morebeneficial to create those
(05:59):
reporting artifacts and updatethose as you go and use those
as status updates instead,because that means that you're
not duplicating efforts.
And you're just aiming towardsthat overall final delivery.
Conor (06:10):
And this goes to
one of our recent episodes.
where we spoke aboutsimplicity in how you conduct
your audit and why that'simportant for everybody.
Now, if we're spending timecreating all these artifacts
for our internal reportingprocesses that don't contribute
to the final output.
Then we're potentially creatingextra work firstly, that doesn't
need to be done, but we'reactually creating a distraction
(06:32):
also and getting away fromthe end goal to develop a
report, not to develop a wholeraft of internal documents
that actually are nevergoing to be external facing.
Number four on our list offive issues today is around
the mechanisms we use toactually collect audit evidence.
Obviously the pandemic issuesand the lack of auditors
(06:52):
being able to attend theworkplace or auditees offices
and that sort of thing.
That's caused us to createnew ways in which we
collect that evidence.
And some of the observationswe'd have around that certainly
the past couple of yearswould be the establishment
of things like SharePointsites by audit offices and
Other mechanisms like thatwhereby the client auditees, so
(07:14):
generally government agencies,when they're putting together
all their documents, they canactually lodge them straight on
there through a secure process.
And that's quite efficientfor a couple of reasons.
Firstly, it means that ifthere are significant amount
of documents, then they candrip feed those documents in
there, which allows you toprogress your audit and review
those documents as you go.
it also means that you don'thave to, for example, monitor
(07:36):
emails or have lots of phonecalls which can be really,
really time-consuming whendocuments are coming through
that process, you've basicallygot a one-stop shop and we've
seen that working really wellon some recent engagements.
Yusuf (07:48):
Yeah.
So the whole secure portalthing I think has been going
for awhile, obviously we'veseen maybe even complete
demise now of physicalevidence being collected.
So that's been happening overthe years and we've moved more
towards electronic evidence.
There's a few challengeswith electronic evidence.
The one is that if you'recollecting that evidence via
email it's not necessarilythe most secure mechanism.
(08:11):
And like you said, it isn't themost efficient either . both for
the auditee and for the auditor.
So for the auditee, they'vegot to then, try to reconcile
what has been emailed and whathasn't been emailed and the
auditor has to reconcile whathasn't been emailed and what
has, so it's on both sides.
So if you have a portal.
You can upload documentsto that is secure.
(08:31):
It's quite easy then to see whathas been sent, what versions
of documents have been sentAnd what hasn't been sent.
And you can reconcilethings like dates, et
cetera, quite easily in alist type format like that.
The other thing is that whilethis is very relevant for
performance audit, where we'regetting data from outside of
our organizations, typically,you know, so the audit office
is getting data or informationdocuments from organizations
(08:53):
that are separate to theaudit office, albeit within
the same government bodies,even with internal audit
where you are within the sameorganization It's even easier
than to set up Teams sites orthe like SharePoint sites or
Google drive or whatever else.
Again, avoiding emails backand forth or private chats
(09:13):
that go on and making itsuch that the evidence is
collected in one place andcan easily be reconciled.
Conor (09:19):
And audits are all
about collaboration, both
collaboration within the auditteam, but also collaboration
with the entities thatare subject to the audit.
And if you have that visibilityamong all the stakeholders
about what's been providedand where it is, then that
transparency just providesfor a more seamless process.
Yusuf (09:35):
Yup.
Conor (09:36):
The fifth item is
around data validation
and how important it is totry and do that as early
on, as possible during theconduct phase of your audit.
So what are wetalking about there?
It's quite possible thatduring your planning, you
received some data from theentities subject to the audit.
You may even have looked atsome open data, but once you
get into conduct and planninghas been signed off and the
(09:57):
objective and everybody's clearabout what you need to do it's
really helpful to get on thefront footand go back to the
entity as soon as possible andtalk through what you think
you're seeing at that earlystage in their data, because you
will have collected it possiblyfor a different purpose.
You'll be looking at itfrom a different angle.
You may be joining itwith other data for the
(10:18):
objective of your audit.
So it's helpful then to revisitthat as early as possible, the
entities, just to let them knowwhat you're seeing and to get
their input and perspectiveon things that, for example,
you may be misinterpreting.
Yusuf (10:30):
In an ideal world,
we'll do this within
the planning phase.
We know that practically thatdoesn't happen very often.
And we often end up withinwhat is the conduct phase
of our audits and we'restill validating data.
So in an ideal world, likewe said, you'd validate
all of that upfront duringplanning so that when you get
to conduct you're really justdoing the last piece of the
analysis however, practicallywe do find that this happens
(10:51):
very often during conduct.
What you want to avoid here.
So why are we doing this early?
What we want to avoid is gettingto the end And realizing that
we've used the wrong datafields or we don't understand
exactly what a data field means.
And therefore all ofthe analysis that we've
completed has been basedon a misunderstanding
of the data really.
So the earlier on duringconduct, we can go to the client
(11:15):
and show them what we're seeing,to the extent that we can, the
better it will help us to reviseany work that we need to do.
Cause there's alwaysrevision with data.
having discussions with theclient and showing them what
we're seeing early on asexamples will help them confirm
what we're seeing or point usin a different direction . And
then that becomes useful todo early on because when we
(11:36):
get to reporting, there's nodebate as to what we've seen.
And the results are prettymuch validated by then.
Conor (11:42):
And sometimes it can
be tempting when you grab a
whole heap of data to try andinternally analyze it to the
Nth degree so that you feelas if you've got something
rewarding or useful to goback to the client with.
But just a note of cautionthere, that that can actually
work against you because youmay be, like you say, chewing
up a lot of time and resourcesin doing that where you could
(12:03):
have cut that off early.
Had you just take an initial,look at what you have and
go back to the client andtalk to them about it.
Yusuf (12:09):
And some of it could
be as simple an answer as
now, I'm going to give youa different set of data
because what you're lookingat isn't fit for purpose.
We've seen that so many timesand most clients will be helpful
like that because they wantus to get the right answer.
Conor (12:21):
To summarize the
discussion today, we're
talking about conduct.
Just some observations we'vemade over the years, firstly,
looking at your working papersand when you set them up, have
the end in mind, know whatyou're going to be reporting
on and set yourself up forsuccess as early as possible.
Number two flows on fromthat, think about trying to
(12:42):
draft your final report asyou go now, obviously that'll
change and shape shift alittle bit and may move, but.
if you do that in parallel,that can save you a lot
of time in the long run.
Number three, try and cut downany administrative overhead.
Don't create lots ofinternal artifacts just for
the sake of creating them.
Number four.
The increasing use ofsecure portals to obtain
(13:02):
audit evidence as we go.
And then number fivethe importance of data
validation during conduct.
Yusuf (13:09):
Good stuff.
So next up, we'lltalk about reporting.
Last episode of theperformance audit mini-series
so stay tuned for that.
Thanks Conor.
Conor (13:16):
Thanks Yusuf.
Narrator (13:17):
If you enjoyed
this podcast, please share
with a friend and rateus in your podcast app.
For immediate notificationof new episodes, you can
subscribe at assuranceshow.comThe link is in the show notes.