Every Staff Auditor knows how to interview audit clients. But that isn’t enough when they become an Auditor in Charge.
Last week, we discussed the general lack of training as auditors move up the chain from Staff Auditor to CAE. In this second part of the series, we are going to dive into the conversations junior auditors have with management and contrast them with the types of conversations their leaders are having.
A Staff Auditor assigned to audit an HR function, for example, would expect to have initial conversations with HR practitioners to understand their processes. These conversations tend to feel like interviews and of course most introductory audit courses cover interviewing skills. The purpose of the conversation is to have the auditor understand more about the processes so that they can be appropriately risk-assessed and tested. In some organizations, the Staff Auditor may report results back to management, but in most cases, this falls to the AIC (Auditor-in-charge) or Audit Manager. These conversations are largely tactical and, as long as the auditor is asking the right questions and taking good notes, their information-gathering purpose will be fulfilled.
An AIC on the same HR audit described would probably participate in these direct interactions as well, executing some of the interviews and assisting the Staff Auditors in developing the interview questions. The AIC’s role, however, goes far beyond this data collection. In most cases, the AIC will be responsible for some kind of written communication (Entrance Memo), a preliminary meeting with the audit client, and significant follow up communications.
The audit client may be nervous that audit will treat them unfairly or will demand too much of their staff’s resources. Therefore, all communications require mature judgment. Beginning with the tone set in the initial Entrance Memo, the AIC does not wish to sound accusatory or personal, but rather like a teammate who is going to help the organization become more efficient.
AIC candidates must be trained on:
- Effective Entrance Memos
- How to develop a good understanding of the audit client prior audit results, status of identified issues, general attitudes about risk and the role of audit, experience, etc.
- Requirements for an effective preliminary meeting, including audit timeline, purpose, and audit/client expectations during the review
- Leveraging critical thinking to respond to client concerns while executing audit’s mandate
Throughout the audit, the AIC will be communicating findings to management, typically the managers of the people being interviewed, observed, or tested by the staff auditors. Furthermore, the AIC will have to decide which conversations should be escalated within audit (to their manager and/or director) and within the client organization (to a department head or even a C-suite executive). AIC Training must also include a discussion of the organization’s priorities, culture, and protocols to ensure that new AICs can judge which observations require immediate escalation, and how hard to push.
I hope it’s obvious by now that the communications task of the AIC is far more complex and requires far more judgment than that of the Staff Auditor. A Staff Auditor sees the outcomes of the process and executes, but an AIC takes more ownership and has much more leeway in delivering the right audit for the client under review.
It would be grossly inefficient for an AIC to attempt to train her staff while the audit is in progress. She is making dozens of decisions deciding what to do, who to speak with, what NOT to do, etc. She has a good foundation for these decisions based on experience and prior conversations with client management. Her team will see what activities were chosen but will have limited exposure to which options were considered but rejected. AIC-focused training is the best solution to allow Staff Auditors to consider the challenges of being an AIC in a controlled environment, with real-time coaching to enable them to assume this more strategic role.
When I teach AIC training, either within a company or as a general session, typically 8-10 hours is focused on general communication principles, with an additional 6-8 hours focused on knowing when/how to escalate (which is tailored to different organizations).
Next week we are going to discuss the communications considerations undertaken by more senior audit leaders. Hint: It’s definitely not easier at the top!