Make sure you know what you did

Looking for better methods

I was recently reading a paper by Kieran Healy of Duke University on workflow applications. I am always on the lookout for workflows that simplify or optimize our way of generating reports and this one came highly recommended by Dr. Drang, so I had to go and take a look. You can find this interesting and well written paper, titled “Choosing your workflow applications” on his blog, which is an excellent read as well.

Striking a chord

In his paper, Prof. Healy lists some basic principles to adhere to when researching and writing scolarly papers. One of these principles really struck a chord with the auditor in me:

“(…) Perhaps the most important thing is to do your work in a way that leaves a coherent record of your actions. (…)”

This piece of advice is essential for any internal auditor. In whatever we do, in any type of audit activity we perform, we need to explain what we did and how we performed the work. Sadly, that is often not the case.

A disconnect between workprogram and working papers

I conducted my first peer review in 2003, and I’ve done quite a number of them since. One of the most frequent findings is a disconnect between the workprogram on the one hand and the audit documentation, the so called working papers on the other hand. For clarity, the workprogram dictates what the auditor should do, while the working papers should bear witness to what the auditor has done. Logically, a well executed audit would consist of workprogram steps that are linked to working paper documentation.

Now, I’m not implying that the audits I reviewed that showed this deficiency were bad audits. On the contrary, most of the deviations from the initial plan as documented in the workprogram made sense … once the auditor in charge had reviewed the working papers, spent some time reflecting on what had happened and then explained to me why they had to deviate from the plan. Which begs the simple question: why not document it properly from the outset?

Audits are often intense events in which a lot of work needs to be performed in a limited amount of available time. Especially when you are working remote, you only have a limited time to perform the work. Working paper documentation is understood to be essential, but is sometimes neglected. The same with adaptations to workprograms. And while I understand that resource constraints impose a lot of pressure on audit teams to go ahead and start the new audit, documentation really needs to be done right. Here is why:

Three reasons to document appropriately and timely

There are three important reasons why both workprogram and working papers need to be correctly documented:

1. If you are subjected to a formal peer review, one of the aspects the reviewer will focus on is the alignment between workprogram and working papers. They expect you to be able to show you have been complete in your work, and this is the only evidence that exists of that;
2. If you document it now, you will spend less time than if you need to document it later. Going back after a couple of months, chances are you will barely remember why you made certain adaptations to the workprogram. Remember that recollection is fickle and very subjective. It is therefore likely your documentation will be less complete if you need to document retroactively;
3. Not all of your audit findings will be appreciated or even accepted by the auditees. Hence, it is very important to appropriately document your work while you are doing it. It avoids you having to redo certain analyses or certain work in case the findings are contested.

Accurate and complete working papers, including properly signed off workprograms that accurately reflect the work done are essential to the fiability of your work and the trust the auditees and the board can put in your work. Now that’s a good reason to properly and timely document what you do and how you do it, even if it takes a bit more time than you anticipated.