The Objectives-Focused Auditor

The key to getting a good answer is asking the right question.  It all depends on how you frame the issue.  My friend Hiram Hasty recently reminded me of this fact.

One of the questions auditors frequently ask is “do I have to do a walkthrough every year?”  The answer is “no,” which is usually how I answer the question.  The standards do not require walkthroughs.

But Hiram re-framed the issue by asking (in a very Socratic way) “can you meet the audit objectives related to understanding the client and its environment without doing a walkthrough?”  

The initial question was “what procedure do I have to perform?” which leads to a very rigid, rules-based answer. Re-framed the issue becomes “what procedures are available to me to meet my overall audit objective?”  The resulting answer is better because it forces you to think through the issue and not just reach for a convenient answer.

I was just reading the Risk Assessment Audit Guide, the gray box after paragraph 4.38, which takes on the issue of the client’s documentation of its internal control.  The question people ask is “my client is a small business that doesn’t document its internal control.  Is that a material weakness?”  

The audit guide offers the following.

To evaluate whether inadequate documentation is a control deficiency and, if so the severity of that deficiency, it is helpful to consider how the client can meet its control objectives without adequate documentation.

The advice in the audit guide is to take the same strategy Hiram took with regard to walkthroughs.  Reframe the issue.  Start with overall objectives and proceed from there.

You must be logged in to post a comment.