Opening and closing meetings: an audit's success often hinges on the first and last contact with the client

Internal Auditor, Feb, 2004 by Larry D. Hubbard

FEW WOULD ARGUE THAT conducting successful meetings is an essential skill in today's business environment. For auditors, the initial client meeting at the start of an audit--the opening meeting--and the final meeting to wrap-up the audit--the exit or closing meeting--represent two of our most important formal interactions with the client. Each of these meetings provides internal auditors an opportunity to demonstrate their skills in leading meetings with management, as well as to communicate key points about the engagement.

Auditors need to think carefully about their agenda and approach for these two meetings, as they will constitute the client's first and last impression of the audit. Keeping several basic principles in mind when preparing for the meetings will help ensure the right topics are covered and that clients walk away with an adequate understanding of the audit group's work.

OPENING MEETING

The opening meeting usually represents the first chance to meet with audit clients in a formal setting, and it often sets the tone for the rest of the engagement. If clients feel apprehensive about the audit, this meeting can serve as an opportunity to put them at ease and clear up any misconceptions. By covering the following areas, auditors can begin laying the groundwork for the audit and start the auditor-client relationship on a positive note.

PURPOSE OF THE AUDIT Auditors need to explain the reasons for conducting the engagement so that clients understand why they're being audited. Reasons can vary widely depending on the circumstances, but the purpose for almost any audit generally can be conveyed in terms of The IIA's definition of internal auditing: "... to evaluate and improve the effectiveness of risk management, control, and governance processes." Auditors can also discuss why the client's particular business unit was chosen for the audit by explaining the department's risk-based selection process.

DEFINITIONS Members of the audit group should plan to discuss the meaning of internal control and risk to ensure everyone shares a common understanding of these fundamental concepts. If the auditors and management differ on their interpretation of these terms, the audit is unlikely to be a success. Whether terms are defined based on The Committee of Sponsoring Organizations of the Treadway Commission's Internal Control-Integrated Framework, the Canadian Institute of Chartered Accountants' Guidance on Control, or another commonly used risk and control model, agreement with management is essential. Auditors should also make sure that management understands internal auditing's role in the organization's control, risk management, and governance processes, as well as the difference between internal and external auditing. Furthermore, to ensure management understands internal auditing in general, auditors may want to provide an overview of processes such as audit planning, risk assessment, and control testing and reporting.

MANAGEMENT INPUT Many audit groups find it helpful to ask for management's input about planned areas of focus for the audit. Instead of asking about problem areas or weaknesses, auditors should ask management to explain major risks they face in achieving business objectives. Framing the discussion in this way focuses attention on challenges and opportunities for improvement rather than on how managers are performing. Auditors should tell management in advance that they will be asked about risks so they can have time to think about their answers before the meeting.

REPORTING One key area of interest to management will be the way in which internal auditing plans to communicate the results of the audit. Auditors should discuss the audit reporting and follow-up process, as well as any other planned means for providing audit feedback. When explaining these processes, auditors may want to use the word results rather than findings to describe the information to be provided. Because findings often carries a negative connotation, using this term may give the impression that the audit group intends primarily to look for deficiencies in management's work. The term results, however, carries a more favorable connotation, and using it can help establish a positive starting point for the audit.

The discussion of reporting should also cover whether or not the auditors will issue a formal rating or opinion on the status of controls at the end of the audit. If a formal rating will be issued, auditors should review the criteria used for the rating and explain the meaning of ratings scores.

WRAP-UP Because managers are often pressed for time, they will likely be anxious to know how long the audit will last. Auditors should either set a firm exit meeting date or offer a target date for the conclusion of the audit. Some audit groups also share the budgeted number of audit days with the audit client to convey the level of effort to be expended on the engagement. In addition, some groups tell management the price of the audit to the organization, using the number of budgeted days multiplied by the average cost of an audit day. Providing this information focuses everyone on the importance of efficiency and effectiveness during the engagement.