Internal Audit Tips

In this post, I will summarise my write-ups on Internal Audit and audit tips I shared on LinkedIn posts.

Internal Audit Tip #1 : Always keep it in Writing.

In some of the instances Internal Auditors find themselves in awkward situation when an auditee changes his/her verbal statement. I think this is experienced by each and every Internal Auditor at least once in their career. So what should you do?

• Always share MOM with auditee or anyone with whom you have meeting and specifically ask at the end ” If you have any disconnect then do let me know”
• After taking a walkthrough of any process do prepare documented process note/ Risk control matrix/Process steps or any thing you understand to document that walkthrough. Also get it vetted by process owner through mail.
• Always take written responses on your queries, even if they are silly ones. The objective is to promote the culture of written communication.
• Always send reminders for data request on mail only.
• Always take written responses from management against every observation. Even if it is closed during the audit period.
• Give versions to your audit report. For eg. V1.1 , V1.2 and so on.. objective is to create log of every changes made

Internal Audit Tip # 2

While working on excel, no matter how heavy or small your file is .. Please press CtrL + S In every 5 minutes.

Internal Audit Tip #3

Always keep a copy of raw data you have received from the auditee. No matter whether it is available on maill or you can ask same data from auditee again, still make a separate folder for raw data and working files respectively. Also, try to do each and every analysis on saparate sheet .

For example you did some analysis on your data and came to some conclusion and then you come up with another idea.. in this case you should again make copy of raw data and start your analysis on a fresh sheet. You can also make copy of previous analysis if you think it already has lot of V-lookups and applying same on fresh sheet will waste lot of your time .

Internal Audit Tip #4

Whenever you suggest some process improvement, always back that with some data points if possible. What lot of new comers do, is they search for best practices and compare it with current process and suggest improvements based on that benchmark only. Thereafter they sit on that suggestion till closure meeting.

In the closure meeting, when management asks for some data points or any other rationale, the only answer left is- ” we will get back to you”.

Now, you have a very short time and auditee will also not be as supportive as they were earlier. At last you will have to drop that point because you could not prove the basis. You just have best practices that you had searched online or what you had asked your friends in the industry

Internal Audit Tips #5

Things you should keep in mind while preparing an Internal Audit Plan:

1. Hot spots/ Risk surveys done by some big advisory firms ( Easily available on Internet)

2. Previous audit plans, to understand ageing( Since when a function is not audited)

3. Check previous audit reports (Function with high risks should be frequently audited as compared to low risk functions)

4. Attrition rate ( More attrition = More risk)

5. Discuss with HODs for their inputs

6. Discuss with Risk team for Inputs (In some organisation risk and audit are part of same department)

7. Regulations ( Some of the regulatory audits are obviously part of your audit plan)

8. Top business carrier(Topline , bottom line , Mazor expenses)

9 Size of your team/budget

Internal Audit Tip #6

It is your duty to take Auditee in your confidence from day one. Make him understand that you are here not to just pin point his/her mistakes. You are here to help him so that his life become easy in future by improving current process and filling the bridge between management and his/her department.

Trust me once you are successful in this task, your output from the audit will increase manifolds.

Internal Audit Tip #7

The most important point of your audit observation is root cause analysis a.k.a. RCA. Your recommendations as well auditee comments will be based on the RCA only and finally management actionable will be also based on your RCA only.

Let us understand this with an example. Suppose while doing audit, you find that there are some wrong deductions of TDS in a few instances. There could be multiple reasons leading to this scenario:

1. The whole process is automated and system erroneously deducted wrong TDS

2. process is completely manual and wrong deduction is due to human induced error.

3. Process is automated but somebody has changed the masters with or without authorisation or some manual intervention is there in an automated process.

4. Certificates for lower deductions are not updated in system

5. And many more …

So, there could be multiple reasons and you have to be accurate with your RCA and suggest recommendations to ensure that the same gap will not be repeated in future.

Internal Audit Tip #8

Some times freshers feels the pressure of finding good observations and start asking people in the process (the one they are auditing) for it. Yes it really happens. It is the role of every manager to tell his/her team not to do so.

The prestige of entire department is at stake or you can say that every team member is an ambassador of audit department.

No matter how talented you are, if you are directly asking auditee for issues then your whole talent is a waste. Trust me they will make fun of you behind your back for this .

Have confidence and just cover whole process. The first basic thing is to understand how that department works and what is the workflow of that process. If you are able to this than only you can give assurance 🙂

Internal Audit Tips #9

Must have heard- Easy to break a stick but not a bundle of sticks!

So What lot of newbies do, is that they put lot of small observations on the table, as the only thing they can see at that time is number of observations. Now let us understand this with an eg. Suppose you have put forward 3 observations

1. Wrong data uploaded on companies website ( Product details, partner details or any other information) due to user error

2. Maker checker process is not there for information to be uploaded on website: Process Gap

3. Change log not maintained for changes made on website.

Now let us combine all sticks(observations) together

1. Wrong information posted on company’s website because maker checker process is not in place and changes on the website could not be tracked as change log is not maintained. Also data sent in excel sheets for updation are not password protected & kept in shared folder where it can be accessed by other users

See yourself, the weightage of latter observation. This is what you need to do. Finding a good observation is only 60% work, remaining 40% is how you present them to management. A single observation might appear meek but when smartly bundled up can be very impactful.

Internal Audit Tip #10

Once you send a set of observations to the auditee for responses, do not sit and just wait for revert. Start working on possible reverts instead. Think like the auditee would and start preparing counters for possible replies. You can do further data analysis for making your audit observation more stronger.
The only thing you should learn is don’t go slow and alway keep yourself on toes.

Internal Audit Tip #11

Track your data requirements just like your observations. Every time you send the data requirement to the auditee, it must be in following Format(Table)

1. Sno.
2. Required Data
3. Initial requirement date
4. status : Yes/No/Partially received
5. Date of receiving :
6. Remarks (If any):

Audit Tip #12

If you have ever been a part of corporate trainings, you must have heard that your goals should be SMART – Now, think of SMART as an abbreviation and the outlook changes.

Similarly, your audit recommendations should also be SMART:

S – Specific (It should be specific to your observation)
M – Monitor-able (you need to monitor your observation from time to time hence it should be monitor-able)
A – Achievable (Your recommendation must be achievable )
R – Realistic ( Should be realistic & based on practical environment in the organisation)
T – Time bound (Obviously there should be some timelines for Closure.

Hence, #Audit recommendations should also be #smart

Audit Tip #13

Never overboard Auditee:
Try to step into their shoes while raising any observation or putting some recommendation. Think practically and don’t just go by the industry standards or benchmarks.

It is quite possible that a control, which can be easily placed in one organisation but impossible to replicate in another organisation.

Sometimes auditee comes under the pressure and accepts impractical observations or unachievable action plan. But later-on if that actionable is not achieved on the due date then you will be only answerable to board. They will ask you if it is not feasible than why just you put it on your report at first.

Audit Tip #14

Don’t become a Checklist auditor:

Whenever you are about to start an audit, you will surely get some checklist- either from last year’s audit working papers or from your Managers/Seniors. Most of the freshers, especially in consultancy, stick to that checklist only and do not invest time in developing new checkpoints.
There could be many reasons behind this viz. shortage of time, lack of experience , work pressure etc.
They forget that if same checkpoints are performed last year, then the possibility of finding substantial observation from them is very limited( I am not saying ignore them, do your testing on previous years checkpoints also)

But, keep looking for new checkpoints after going through the complete process, while testing old checkpoints, engaging in conversation regarding processes with auditee etc.
But don’t just follow 10-20 pointer checklist, do your value-addition to it.

Do follow for more such tips , also visit my blog alkitjain.com