Making Internal Audit Recommendations That Get Results

Auditors spend a great deal of time and energy examining processes, analysing procedures and transactions, and identifying control weaknesses, yet the real value we add for organisations lies in our audit recommendations.

Management expects auditors to apply their business knowledge and their ability to analyse root causes to recommend process improvements that reduce risk, increase efficiency and align with business goals in the short and long term. Internal audit teams must also decide the scope of their recommendations for the issues they find. Approaches can range from “just fix it” to a very detailed list of steps, depending on company culture, risk appetite, the maturity of the audit group and other factors.

Below we look at some approaches that best show the advisory side of our profession in the guidance we give management.

1) Identify the root cause(s)

Yes, we have a finding, but so what? Some issues look easy to fix, yet there may be more beneath the surface. For example, the finding “The report had no approval signature” is easily resolved, and the obvious thought is “well, sign it”. That may be an acceptable fix, but unless we identify the root cause the situation is likely to recur. Possible causes of the real problem include:

• No one was assigned as the signatory.
• The person who used to sign has left.
• There is no procedure showing who is responsible.
• Responsibility is unclear.
• The task has not been given priority.

Another example: “Manual journal entries (MJEs) were not approved by a supervisor.” The auditor must gather and write down all the facts. In this case, any of the following may be happening:

• There is no formal procedure or policy requiring approval.
• The supervisor has left and no replacement has been assigned.
• In accounting, the person who requests an MJE is the person who approves it.
• Only certain MJEs require approval.

Through conversations with auditees and process reviews, the auditor is in a privileged position to identify the factors that trigger the problems and reach the root cause. Once identified, these should be discussed with management so that compliance can be achieved.

2) Write the finding

When an internal auditor encounters a control weakness, the focus should be on the facts, without judging the situation or its circumstances. The auditor should always remain impartial when assessing the condition and its effect on process performance, with business objectives and risk appetite in mind. Based on the information gathered and the facts established, the auditor can write up the issue. For example: “From a sample of xx MJEs, representing x% of the population and y% of the value, yy MJEs were noted as having no associated formal approval because of ________. MJE approval oversight may have lapsed because of ________.”

3) Make the recommendation

Audit recommendations are guidance highlighting the actions management should take. Once implemented, they should reduce process risk and improve performance. Depending on company culture and the impact of the issue, recommendations can be more or less detailed. Auditors must strike a balance between being too simple and providing overly detailed procedures that try to do management’s job. The relevance and severity of the finding will also affect the tone of the report. For example: “Management could / should / must take the following actions…”

The level of a recommendation can vary with the relevance and complexity of the issues raised. We can sort them into a few categories:

• Direct actions: When a root cause has been correctly identified, the auditor can recommend specific, achievable actions. In some cases these can be implemented during fieldwork and noted in the report as “addressed”. For example: “The accounts payable clerk should be trained on how to process certain payment types to ensure correct coding is used.” The recommendation is very specific, but it is still for management to decide the tools and timing.
• General recommendations: Sometimes several business groups are involved in resolving an issue, and defining the actions takes a joint effort. The auditor can offer direction but probably not a detailed action plan. For example: “Managers should notify HR and IT of any change in their organisation at the same time, so that appropriate user profiles are maintained. A formal procedure should be defined to make this happen.” Here the auditor leaves the options open but sets minimum requirements.
• Detailed recommendations: When the organisational culture is on a learning curve and the internal auditor has subject-matter-expert level knowledge of the process audited, a specific recommendation can be offered. For example: “A procedure for managing and allocating deferred revenue should be defined. It should be formally approved by all relevant stakeholders, training should be given to everyone involved, and it should be built into onboarding training for new finance staff. Training records should be kept on file to demonstrate compliance.”

4) Management action plans (MAPs)

Next, coordinate efforts with stakeholders. The auditor is uniquely placed to break down silos and identify process breakdowns caused by poor communication, lack of formality, undefined responsibility, resource availability, inadequate segregation of duties, redundancies and other challenges. As an internal advisor, the auditor not only helps management recognise these situations but is also an agent of change with a process-improvement mindset. From the start of the audit it should be clear to the auditee that the reviewers are on the same team, and that the overall aim is to increase stakeholders’ comfort with company performance in terms of internal controls.

When management receives the audit report, it is obliged to provide a set of actions that address the findings. These are generally known as management action plans (MAPs). Although MAPs are management’s responsibility, they often seek internal audit’s input. In general, I advise auditees to follow the SMART methodology:

• S – Specific: As far as possible, avoid vagueness. “Staff will be trained” is less specific than “Procurement staff will be trained in these specific procedures”.
• M – Measurable: You cannot manage a process you cannot measure. For example: “By June, 80 percent of procurement staff will have been trained in these procedures, and by December all staff, including new hires, will have completed the training.”
• A – Achievable: Each action plan item must be achievable for the group and the whole organisation. “All manual journal entries will be reviewed and approved by a supervisor” may be hard to meet; in a mid-sized company, given the volume, a position might have to be created just to comply. “All MJEs above the company-defined threshold will be reviewed and approved by a supervisor” addresses the risk and can be done with reasonable effort.
• R – Relevant: Consider whether the action plan item aligns with overall business goals. For example, “All anti-money-laundering procedures will be made available to all bank staff” may be less effective, since some procedures may apply more to private banking than to retail banking.
• T – Time-bound: Actions must be completed within a set timeframe, or they are unlikely to be carried out. Timing should be revised as needed during follow-up. MAPs may include specific dates, though approximations and ranges are acceptable. For example: “Actions will be implemented by the second quarter.”

Keeping these definitions in mind allows the auditor to support management’s efforts to create and submit MAPs that can later be verified for effectiveness.

5) Follow up

The internal auditor’s role does not end when the audit report is delivered. Once the period set in the MAPs has passed, the auditor should verify that the committed actions have been implemented and that they address the risks identified. Only then is the audit cycle complete. Do not neglect follow-up.

Following these steps may not guarantee that every issue internal audit identifies during an audit is magically resolved, but it will help improve the recommendations internal audit gives management. It is not enough for internal audit to flag problems and walk away. To deliver real value to the organisation, internal audit can play a vital role in advising on solutions and making sure the hard work of improvement is completed. Better audit recommendations go a long way towards those goals.

This article is an adaptation of “Making Internal Audit Recommendations That Get Results” by Hector Garcia, an active community member of Audiopia, a learning and collaboration platform for internal auditors, published on Internal Audit 360. Source: https://internalaudit360.com/making-internal-audit-recommendations-that-get-results/