Corporate Investigation 5 Best Practices for Internal Audits
Conducting internal audits of your company’s compliance mechanisms and its business practices is a great way to discover potential sources of legal liability, as well as ways to make your company operate more efficiently. However, not all audits work the same. Some can be poorly planned or inexpertly executed. Others are all-encompassing, conducted efficiently with little wasted time or money, and produce actionable recommendations that alleviate the most pressing concerns of all of the stakeholders involved.
Certain best practices should be followed to ensure that an internal audit is a successful one rather than a disappointing one. Over the course of years of experience, our team of internal auditing consultants and professionals at Corporate Investigation Consulting have found that the following five best practices are among the most important.
1. The Final Audit Report Needs to Be Concise and Actionable
The final audit report is the culmination of the internal audit. It is the document that the internal auditors end up handing over to the company and its stakeholders. The report is probably the single most important aspect of an internal audit because it communicates the audit’s findings, provides its recommendations, and summarizes the investigation.
It is hard to overstate the importance of a good final audit report. However, it is easy for internal auditors to lean towards the over-inclusion of information, generally in an attempt to avoid the potential for leaving out relevant or important details or because of the time that the audit took to uncover them. Taking this route, though, inflates the length of the report and often provides details and information that are not very valuable. They may also do little other than to add bloat to the report.
A better practice is to make the report quick and concise, focusing on the important information that backs up recommended changes and other conclusions, and little else. This helps steer stakeholders towards the outcome that will help their company, giving them guidance for improvement without making them wade through extraneous information.
2. Always Look Out for a Lack of Duty Segregation
Internal auditors should always beware of a lack of duty segregation within a company, whether for audits of compliance procedures or business practices.
Duty segregation refers to how many steps that one person does in a row within a specific process or function. An example of a lack of duty segregation is when a single person is responsible for:
- Receiving cash payments as a cashier,
- Balancing the cash drawer at the end of the shift or business day,
- Recording the amount in the drawer,
- Depositing the money from the drawer into the business’ bank account, and
- Recordkeeping of bank statements.
When one person or party is responsible for so many steps in a row, it opens up the possibility for costly errors or intentional and potentially even criminal misconduct. Because one person is responsible for so many steps without intervention or supervision, it is easy for them to act in their own interests and then cover up their conduct after the fact. It also presents the opportunity for innocent mistakes to be made at one stage that skews the results for the rest of the process.
Auditors should be on the lookout for these situations and give them extra scrutiny. Pulling out what is really going on during these situations can be trickier than normal.
3. Never Blindly Take Someone’s Word for Anything
Internal auditors should behave like investigative journalists, confirming and corroborating any statements given to them by employees and other workers within the organization being audited. Uncorroborated statements must be taken with a grain of salt, and if there is no way to find supporting evidence to back it up, then the speaker’s motivations must be scrutinized closely before a decision is made as to whether they are reliable or not. Even if they are used during the audit, any information that they provide or that they lead to should be denoted with an asterisk.
4. Always Remember to Keep the Goal of the Audit in Mind
One of the most important things that internal auditors have to do during the execution of the audit is to keep their focus on the goal of the process. Not all audits have the same goal – some focus on the company’s compliance measures, while others focus on business efficiency, and even within these general categories different audits can serve different purposes. Staying on track of the current audit is one of the most fundamental best practices in all of internal auditing.
It is also one of the most important, though.
If an audit gets sidetracked by extraneous information that is outside the scope of the inspection or that does not alleviate or dispel the concerns of the stakeholders to the company, at the very least it will slow down the audit until it can get back on track. If it never returns to the intended focal point of the audit, the resulting final audit report will be unsatisfactory or nearly useless to the company’s stakeholders.
5. Document the Auditing Process
Finally, a best practice that is frequently overlooked is documenting the auditing process. Including documentation into the process can seem like a waste of time. However, it pays some very important dividends to those who take the time.
Auditors who take meticulous notes of the process, the findings, and how the auditors moved forward with those findings can find themselves with an additional source of strong support for their eventual conclusions and recommendations.
Internal Auditing Professionals at Corporate Investigation Consulting
Planning for and then executing an effective internal audit takes skill, experience, and a meticulous attention for detail. The auditing experts at Corporate Investigation Consulting have built a long track record of successful audits for companies large and small, including in a wide variety of industries, from pharmacies to laboratories to law firms.
Contact them online or call them at (866) 352-9324.