An idea that I have been kicking around for a few years is why organizations don’t maintain a list of audit questions they have been asked in an Auditor Question Log? Such a log contains the questions, responses and the organization’s supporting policies or documentation.
The Dumb-Newbie-Question Problem
Asking the same question year over year (and comparing the answers) has its merits in the tricks and tips of auditing. For an auditor, a deviation can indicate a poor process or internal control risk. There are also the dumb-newbie-questions. You know the ones if you have been part of an audit. The newly minted auditor asks a question that they should have learned in Accounting 201. Dumb newbie questions are a cheap way for accounting firms to train articling students. Unfortunately for the client, it not only consumes time and is frustrating – it wastes the true value of an audit: challenging the organization.
An Audit Question Log
The idea behind an audit question log is to record the questions and responses asked in an audit and to categorize them. The categorization will include what the question relates to, who answered the question, when was it asked and how does it relate to an existing processes or control. The following table lists a potential list of attributes for a question log. As well, download the Microsoft Excel template.
|Attribute||Description and Comments|
|ID||An unique identifier ideally a simple sequential number.|
|Fiscal Year||To which fiscal year(s) does a question pertain to.|
|Asked?||Who asked the question? Keep a list of not only the person’s name but also the audit organization they worked for.|
|Audit||In which audit was the question asked? For many organizations it is hard to keep track of which auditor belongs with which audit and when they are starting or stopping. Take a few minutes to radio collar your auditor before they start work in your organization.|
|Answered||Who answered the question from your organization?|
|General & Sub Area||What is the area of interest the auditor is asking the question about? The general area is a drop down and there should be no more than about dozen (e.g. Assets, Expenses, Controls, etc.). The sub-area is free text and is used to hone the nature of the specific question.|
|Question||What was the question? Surprisingly this is often difficult to pin down. Sometimes auditors mumble, sometimes they don’t know the area well enough to articulate a question and sometimes it is a subterfuge. Be sure you understand the question before you answer it.|
|Response||And what was the response? Cut and paste from emails, notes from a verbal discussion are fine.|
|Comment||Anything else you want to add that is not otherwise identified in another column? Try to avoid comments like ‘not the most stupid audit question ever asked but a very strong contender’.|
|Company||What is being audited? Not needed for small companies or organizations. A life saver when you are dealing with a complex organization.|
|Policy||Do you have a policy and/or procedure to back up your response? No is okay, it is being created is better and yes is preferred.|
|Link||It is 10pm, do you know where your policies are? Include a reference to the policy.|
Costs of the Question Log
The cost of an Audit Log is nominal but real. Your organization needs to create the log, write down the questions and the corresponding response to the question. The largest portion of this cost, researching and responding to a question, you will pay for whether or not you have an audit log. The organizational challenge is changing the way your organization thinks about audit questions. You need to think about having a log well before the auditors troop in, you need to educate your staff to use it and record the questions/answers and then you need to review and debrief it after the audit.
These activities seem trivial in abstract and exorbitantly high during the pitch battle of year-end.
The Benefits and Use the Question Log
The log can benefit both the auditor and the organization however. For the auditor it demonstrate that the organization takes things like internal controls serious enough to write them down. It also provides an organizational perspective of what has been tested in the past. If there are dozens of questions over many years relating to custody of the petty cash system and no questions on the custody of attractive assets – well maybe petty cash can be given less attention this year and the auditors should be asking where are pinch-able and costly assets being stored?
For the organization, the audit log helps in a number of ways. Before an audit starts, answer the common questions that have been asked numerous times in the past. Thus when the auditors arrive, have the twenty-something read and review the questions from prior years. They can certainly perform tests on the controls relating to the questions but that is a better use of time then asking what ‘AP’ stands for and how do you spell it.
Next take a hard look at what the auditors have reviewed in the past and get ahead of them by reviewing what they have not asked about. Returning to the above example, do you really know where your expensive attractive assets are – maybe a policy, procedure and process should be started now well before the panic of year-end.
Leveraging the Log
View the time and effort responding to audit questions as an asset rather than an expense of year-end. Like any good asset, the responses should be protected and managed. For example, use the audit log as a training tool for your staff so that they understand the value and purpose of your procedures beyond being a simple set of rules to follow. An Accounts Payable supervisor should not only be able to answer an auditor’s question about segregation of duties (e.g. separate vendor setup from invoice entry from batch approval for payment) but also WHY this is important and HOW the organization has expressed the importance through a corporate policy or procedure.
Heck, at the post-year-end party, run a Jeapordy style game ask the auditor questions to different teams and see who wins. If most of your staff can understand and answer most of the auditor’s questions – everyone wins – even the auditors.
Container versus Content
Most of the above discussion focused on the content of the audit log; the questions and responses stored within it. Spend a few minutes thinking about the container the log is stored in as well. Excel is fine but a SharePoint list might be better. Ideally ensure the container has version and access control and that you can see who added/changed what when. After all, someday you may want to audit your Audit Log!
Thoughts on the Audit Log?
Drop me a note if you think there is merit in setting up the log and the attributes you have created for your own list of questions.