As a chief audit executive (CAE) I am responsible for, and review, reports. In fact more of my time is spent reviewing the work of others than writing my own. As a CAE for a small audit service I do still undertake work myself. In both I wrestle with the challenge of ‘get it out of the door’ and ‘it’s not perfect yet’.
I have been reading a book about writing by an academic, Howard Becker, on writing. He picks on this tension perfectly in the context of academics writing about their research. He puts it perfectly, it is all about risk. The risk of issuing a report that it not right, not perfect, not able to be criticised. As a CAE I have to sit in front of the senior management team, in front of the audit committee and explain and justify the report. What if I cannot defend it (whether mine or a colleague’s work)? I am accountable even if not responsible for all audit work. When I worked in a professional services firm rather than in-house – what if the managers and client would not pay for it?
On the other side, the report’s due; the audit committee papers deadline is proximate; I need to get ‘chargeable’ work out of the door; the audit plan is needing to be finished. These are all things that force me to publish ‘sub-optimal’ work.
Audit reporting is thus a risk-based decision. What if the management team don’t like the report? What if it is wrong? What if I don’t publish a report? Will I miss the chance to enter the debate; to make a difference to the client’s operations?
I guess there is no answer and it must be a decision of the individual CAE. I cannot provide a specific answer applicable to every situation. My advice is to take the 24 hour rule. if you have doubts, no report or deadline cannot wait until the following morning. Sleep on it. Imagine that it was published the night before the next morning when you review it. What would have happened? This normally lets me ‘feel’ whether it is enough.
I believe internal audit should stand above the here and now and that internal audit should be risk-based not issue-based. As a general rule then it is better to issue a higher-quality (fundamentally right but not perfect) opinion, than it is to issue a wrong one. The wrong opinion will be remembered far longer than the one-day delay on the report.
Take a risk! – but a managed one.