Seeds of Improvement - Brief Article

Internal Auditor, Oct, 2001 by Courtenay Thompson

For one company, quality workpapers and audit reports couldn't replace good audit findings.

OSE, THE GENERAL AUDITOR for ABC Inc, a multinational organization based in the United States, and Alexandra, the company's director of IT Audit, were returning to the office from a meeting with the top auditors for XYZ Corp., another company that does business globally. At the meeting, there had been a lengthy discussion about the importance of audit findings because the XYZ approach was quite different from that of ABC.

"Were you surprised at the lack of emphasis on audit findings?" Jose asked.

"Not really," Alexandra said. "I used to work for a company that had a similar approach. I think that was one reason its audit department was downsized and eventually eliminated. The internal auditors were referred to as 'no findings auditors.'"

"Do you know why we focus on findings here at ABC?" Jose asked.

"Not really," Alexandra said.

"It has to do with our remote locations," Jose replied. "With all our branches, there has always been tremendous exposure in the field, so management wanted a strong audit function to check on cash and inventory in the field. Because we had more than 1,000 locations, management relied on internal auditing to check those areas they couldn't check on themselves."

"But how did that get us to where we are now?" Alexandra asked.

Jose smiled. "I think it is because we focus on audit results," he said.

"Others focus on audit results too," Alexandra responded.

"I know, I know," Jose said. "But the results are usually related to audits being completed on time and within budget, the quality of working papers and audit reports, and whether the annual audit plan was completed."

"Aren't those important?" Alexandra asked.

"Of course they are," Jose said. "But not as important as good audit findings. You can have all of those things without having important findings. In today's changing, high-tech, global environment, things don't always function as intended. The best way for us to help management and the organization is by problem identification and resolution.

"Problem identification is also challenging and fun," Jose continued. "So we get to add value and enjoy our work more."

"Thank heaven management agrees, Alexandra said.

"It wasn't always that way," Jose said. "We used to report to executives who didn't want internal auditing to rock the boat. Any errors or fraud findings were seen as evidence of the manager's incompetence instead of opportunity for improvement."

"What changed that?" Alexandra asked.

"A major fraud," Jose said. "A senior executive set up a company to bill ABC for services never rendered. He also submitted fraudulent travel expenses.

"I never heard that," Alexandra said.

"That was before you were hired and before we had a written fraud policy that established consistent treatment for perpetrators," Jose explained. "That executive was allowed to take early retirement and make restitution. The case never was made public. Today, the same case would be referred to law enforcement."

"How did that impact internal auditing?" Alexandra asked.

"We were treated fairly," Jose responded. "Internal auditing had raised some questions about the vendor and executive travel, but the questions were removed from our reports prior to issuance. Back then, internal auditing reported to the chief financial officer and, frankly, some issues just didn't get reported. That was one reason the internal audit reporting relationship was changed so that we report to the chief executive officer."

"What else changed?" Alexandra asked.

"We took a hard look at the audit exceptions that we did report," Jose said. "Most of them dealt with symptoms and compliance issues rather than the cause of the exception. For example, we might report that support documents could not be located for two out of 25 payments made and recommend that management do a better job of assuring that transactions are supported.

"The recommendation resulting from that review was that we should more fully develop findings," Jose continued. "Discussions with other internal auditors, as well as research of accounting literature on audit failures, led us to believe that failure to follow up on exceptions and other indicators of fraud was a major reason auditors missed things. As soon as we committed to finding out the reason there were exceptions, our important findings increased. We also started looking to see whether there was a fraud occurrence if and when we identified a control breakdown. That's when we started detecting fraud.

"After we began reporting more valuable findings," Jose continued, "we started spending more time on high-exposure areas, such as construction and lease costs, because ABC spends so much in these areas. It soon became obvious that we could recover several times our audit costs by auditing the books and records of our contractors and vendors. Our top recovery was more than $1 million from one landlord for escalation costs. I believe we have historically recovered five to 10 times our audit cost in these areas.