Adam Travis, CPA, CISA

Transcription

1 Adam Travis, CPA, CISA

2 Northwest Missouri State University Bachelors of Science Accounting Master s in Business Administration Certified Public Accountant Certified Information Systems Auditor Department of Defense Office of the Inspector General Auditor Department of Agriculture Group Chief / Systems Accountant

3 Issued/Received/Oversaw over 200 Notices of Findings and Recommendations Issued/Received 14 Disclaimers of Opinion and One Unmodified Opinion on reduced scope audit This has occurred amongst 7 different management groups

4 In Audit, what is the best opinion an auditee can achieve? A. Unmodified/unqualified B. Qualified C. Disclaimer of Opinion D. Adverse Opinion

5 E. The Opinion that most accurately represents the environment being audited We have defined success of the audit based on the result or opinion rendered and have assigned a negative connotation to findings and weaknesses Although semantical, this paradigm is really at the heart of defining the auditor/auditee relationship and how auditees really approach controls

6

7 There is not a book titled Auditors are from Venus, Accountants are from Mars There is not a separate language that requires a translator or Rosetta Stone Auditors do not have a preference on the outcome of the audit. There isn t some greater audit glory based on the opinion rendered. Auditors are just as validated by a clean opinion as they are one where issues are identified Auditors are not paid by the finding. There isn t a gotcha mentality. In fact, it is often more work for an auditor to document and issue a finding

8 NON-JUDGMENTAL FEEDBACK

9 THERMOMETER ANALOGY

10 Final: How does your management define a success? Goal A: To achieve a clean opinion on our FY20XX financial statements OR Goal B: To continue to develop processes and controls around reporting

11 A successful audit Is an organizational tool for continuous improvement Is not a destination - You can utilize the results as a measuring point but the audit result is not the finish line. Utilizing it as a finishing point leaves a let down or pivot point once the audit is complete that leads to complacency. It is a proactive mindset to approaching system analysis and process development Reveals blind spots - The audit is a tool that allows for an independent look at processes and controls outside of the context of our general business performance by individuals

12 We often design our systems to fulfill our mission critical needs and then attempt to back into controls after the fact: Are we getting payments out the door? Are we getting users signed up for the programs?

13 By relegating the Audit to a separate goal or function, we isolate it from our core business, our processes, and the development or our systems We often exist in an environment that silos business, accounting and auditing into separate efforts - This creates a seemingly endless amount of retro-fitting, manual workarounds, and meaningless work credited to serving the audit that is a result of poor system and control design

14 Is there anything you would stop performing if I told you that your audits were going to magically disappear and never return? Or More direct: Are there any controls you perform because an auditor told you to do so?

15 Despite your passing score, these controls are not operating effectively Even worse, this creates a distance from the control development process that prevents organic and natural development of process improvements from you and your staff But the auditors told me to do it.

16 An NFR consists of Five Components: Condition/Background Criteria Cause Consequence/Effect Corrective Action/Recommendation

17 An NFR consists of Five Components: Condition/Background Argue that the auditors didn t know what they were looking at Criteria Ignore as there is nothing actionable and isn t about my business Cause Argue that the auditors didn t know what they were looking at Consequence/Effect Argue that the auditors didn t know what they were looking at Corrective Action/Recommendation Utilize as a checklist to appease the auditors

18 The first step of the process starts with evaluating an overarching theme that is hinted at but isn t specifically referenced in the NFR: Risk Assessment Good Corrective Action shouldn t start with a checklist approach to the Corrective Action, but a truly candid evaluation of the risk around this control and the failures identified Adam s Proposal: Change the Name to Notice of Findings and Risks and modify the recommendations section

19 What we can find when we take a risk-based approach: 1) The auditor/assessor has truly misinterpreted our control or not looked at the correct documentation. Solution: Look toward our Policies, SOPs, Cycle Memorandums and identify how we can better communicate the process Accountants must reframe the auditor s misinterpreting controls as a sign that others within our organization may be miss-using or miss-relying on this control

20 2) We have an actual hole within our control Solution: First, look to define the exposure and if possible isolate the population. Do not try to bury the needles in the haystack. (You do not want to have the needles extrapolated across your entire population) Isolate the Needles into a small, easily identifiable stack of needles. Creating better segmented populations creates better testing and will generate more actionable findings.

21 Embrace the Audit Mindset Challenge yourself and/or your staff to constantly being seeking process improvements, automations, and improved controls outside the audit context. If we can possibly being doing better, we should be exploring those opportunities. Be brutally honest in your Cycle Memos, and when submitting a population. Do not bury the lead!

22 Have an audit mindset in the development phase of projects/implementation. Take an opportunity to learn or expose yourself to audit criteria. Engage your internal audit staff early and often. If you have the opportunity to do a detail or experience from the other side, it is mutually beneficial.

23

24 Disclaimer: I have both issued and received a recommendation on this. This is also a control scenario I have used as a training technique to get our group talking about documentation, and process improvement.

25 I invite all questions or comments -if you disagree with anything I said, please come to the front of the line.