The relation between audit reports and working papers

Audit reports tend to be overly long

I’ve mentioned before I don’t like overly long audit reports. The length usually does not add relevant information for the audit committee and only aims to prove to the audience how much time and effort the internal auditor put in that specific audit. While commendable this is not something I should read in an audit report. It’s understood that you do your very best. If you sign off in accordance with IIA standards, you say as much. Only a lot shorter.

I know plenty of internal auditors that feel they need to show the work they’ve done. They reaction is understandable, because the only work the audit committee will ever see is the audit report. The need to be accountable is entirely normal for someone who checks on accountability all the time.

Make sure to adequately document your work

“Make sure you adequately document your work,” is something the beginning auditor hears from day one of their career and it tends to stick, as much as the use of most copiers and how to make a good cup of coffee. Often, it sticks too hard, and the need to document is reflected in the audit reports.

Am I saying you should not adequately document? No, not at all, but documentation and evidence should be in your working papers and not in your audit reports. Your main audit report audience is your audit committee member, who has no added value in reading how you performed test X of Y. They hired you for your competence, and it is your professional judgment as to how you execute your testing.

To compare, while it’s interesting to find some information on the bridge you’re about to drive across with your car, such as how high it is, when it was built and how much it cost, you will not stop to contemplate the redundancy data and the calculations the engineer made when building the bridge. You assume that engineer knew his or her job. It’s the same with an audit report.

Auditees can get additional information based on good working papers

But what about that other audience, my auditees? What if they want additional information? Well, that’s where working papers come in, and that’s where working paper documentation becomes so very important. It is entirely acceptable to allow an auditee access to copies of carefully selected parts of the working papers. Of course you will need to clear it with the audit committee, but in essence there is nothing wrong with it.

Working papers need to be “in order”

Now, this imposes requirements on the working papers as well, an often neglected area of our work. In order to ensure that working papers can adequately be presented to auditees or even third parties, where relevant, they need to be “in order”. I’ll blog more about working papers later, but let’s define “in order” now.

For working papers, I would define “in order” as:

• Organized
• Clearly written
• Documenting interviews and test performed
• Concluded on
• Supportive of the conclusions of the audit report, including complete evidence
• Empty of all documentation that does not directly offer support for a test, a position during the interview or a conclusion
• Empty of all personal opinions or inappropriate comments or remarks
• Reconciled to the final version of the audit report
• Signed off on by the CAE or the responsible for that audit

In the next week, we’ll discuss each of these elements more in detail.