A Quick Introduction
As I mentioned before, my organization started with the introduction of PRINCE2. My internal audit department is making sure we are learning the lessons we need to learn. The best way to do that is to practice what we preach. So we’re applying PRINCE2 to internal audit. If you are interested, you can find the first article about starting up a project here.
In order to be relevant, our PRINCE2 project needs to at least assist in optimizing the internal audit process. Putting aside a number of nuances, there are mainly two ways to do that: either through simplification or through increased quality and confidence in the process.
The project brief, which we renamed to audit brief, does both. Let’s first look at how it contributes to increasing quality of the audit engagement.
Bilateral commitments in the announcement
Internal auditors are used to working with an audit announcement letter. It is a real letter to the auditees, a short document that announces the audit, explains its purpose gives some insight in how it will be conducted. Now I’ve been both auditor and auditee. There is one thing that I never liked about the announcement letters: they are usually clear on what you need to do as an auditee, but they provide little insight in what you can reasonably expect from the auditor.
PRINCE2’s project brief serves a similar purpose as the announcement letter, but it is a lot more detailed. It provides a lot more information to the auditees, including information on what they can expect from the auditors. In contains an engagement from the audit team about content, timing and deliverables. There will be another advantage in a couple of years: as the “audit brief” follows the structure of a typical project brief, our PRINCE2 trained auditees will recognize the structure and the content of the document.
Increased Clarity on Approach
The project brief has a number of required parts that clarify a lot of the approach to the auditees. First, there is the project product description which provides an explanation on what can be considered a successful project by clarifying what the products coming out of the audit need to comply with.
A traditional audit product is a report. But the report needs to contain findings that need to be verifiable and factually correct. These findings need to be confirmed by the auditees. Recommendations need to be made related to the findings. Good recommendations are recommendations that are not developed in an ivory tower, but are implementable in the context to which they apply.
All of these aspects are known by good internal auditors, because they know what the professional framework of the IIA asks of us. However, I am sure that few of us have ever considered whether our auditee knows all that. Because most auditees don’t know what they can expect in terms of results.
PRINCE2’s project brief requires the project manager/auditor to be clear about his products as well as about the tolerances considered acceptable in order to call these deliverables good. The wiggle room reduces significantly.
PRINCE2 requires the auditor not necessarily to increase his quality but to increase the accountability and the transparancy about his quality. And that is a good thing. Because if the question ever becomes: “who guards the guardians?”, the only acceptable answer is:”We all are.”
Increased Clarity on Relevance
The background section of the project brief traditionally explains why a project takes place and in what context it occurs. Within an internal audit setting, there are two main reasons why an audit can occur: either the audit is part of the planned audits or it was explicitly asked for by one of the directors of the board. If it is part of the audit planning, it was identified based on the risk assessment done at the beginning of the audit period.
The background section provides auditors with a wonderful structure to allow them to succinctly explain the impact of the activities under audit on the overall strategy of the organization. This makes it understandable for both board members and auditees. That again is a requirement I don’t often see in audit announcement letters.
It may also address at least some concerns on internal audit being detached from the key strategic aspects of the organization. By developing a good background section, as an auditor you have the opportunity to motivate why you are auditing the area under audit.
Similarities
There are aspects that are present in both documents. The scope and the scope exceptions, the limitations and assumptions, the planning are all elements which are present in both the project brief and the announcement letter.
I have found, by using the project brief as a replacement for the traditional announcement letter, that PRINCE2 requires you to be even more methodical in developing each of the paragraphs of that essential document.
Conclusion
While the jury won’t be in until the end of the project, the start-up phase of our audit has fared well by using the PRINCE2 approach. I will keep writing about the results of our work.
Exploring The Black Box 