You asked us a question via the technical helpline:
Why do audits sometimes take longer than the time allocated and how do you deal with it?
There are many reasons why an audit engagement can overrun its allocated time. Some are unpredictable at the time of planning and others might be due to poor audit practices or management.
It is therefore important to assess whether the reasons are unavoidable or avoidable as there are different solutions.
We have set out some of the potential pitfalls that lead to time overruns and how you can prevent them from happening.
Preparation
Allocating an amount of time to carry out an audit engagement is not an easy thing to do. It’s not an exact science and while experience helps there are many variables to consider, including:
- the nature and scope of the review,
- whether it is an area that has been reviewed before,
- the complexity of the review and potential for subject matter or co-source expertise,
- the level of audit experience required to undertake the review,
- the risk maturity of the area,
- location of audit work, and
- the level of supervision and review.
Audit managers and internal auditors need to work together to determine what feels like a realistic time allocation bearing in mind the greater the complexity the more time will be required.
There is a need to balance working effectively and efficiently with a realistic view as to how long the work will take. Sometimes the work will have to be delivered in time to achieve a key date, such as a board or audit committee meeting.
Documenting of a plan of work will help in the organising and allocation of your time during the audit; Practice Advisory 2200-1: Engagement planning provides guidance on this.
If you tackle preparation thoroughly you’ll have a better estimation of the time that is needed reducing the likelihood the audit will overrun.
Time management
Plan ahead to make the best use of your time during the audit by booking meetings in advance of the start date of the audit and by talking to people about the information that is needed.
For example you may need to talk to the IT department about compiling a report to enable some audit tests. Treat the audit like a project mapping out key events and meetings to increase the likelihood of meeting targets.
If for any reason there are any hold ups, e.g. sickness or unplanned leave of key contacts, time could be spent on some preparatory work for the next audit.
Supervision and performance management
Time budgets and the actual time spent on individual audits will be one of the key performance indicators for internal audit. Failure to achieve delivery within planned timescales will increase the risk of failing to achieve the wider assurance plan.
Internal audit management must ensure tight control is maintained over these budgets, ensuring action is taken to keep audits on track; looking at time management techniques where necessary and possibly including this as a risk on the internal audit risk register.
Regular contact between audit manager and internal auditor during the audit are the best way to review progress, provide advice and manage time. Schedule these into the project plan for the audit but in doing so recognise that the extent of supervision required will depend on the proficiency and experience of internal auditors and the complexity of the engagement.
Gathering audit evidence
The gathering of audit evidence may reveal an unexpected problem that requires more work to fully understand thereby increasing the amount of time needed to complete the review. This could be the emergence of a risk that is not being controlled, not enough or too many controls to manage existing risks or a serious control failure. The likelihood of any one of these happening is increased in an area that has not been audited before.
In all cases where something unpredictable happens it is best to discuss the situation with your manager and the operational managers concerned to decide what needs to be done and how long it will take.
One possibility is to agree upon another, follow-on audit engagement so you will not exceed the time you have been given. A further option is to agree a time extension based on an estimate of how long the additional work will take.
In due course the audit committee will need to be informed of what happened and the decisions made.
Communicating internal audit evidence and recommendations
Internal audit reports are a means to an end. They set out a convincing case for change with agreed actions to increase the likelihood of achieving objectives. Reports need to be clear, concise and credible.
If for whatever reason management don’t like what they are reading or it is difficult to agree the way forward then the time needed to complete the audit engagement is likely to overrun its allocation.
The way to avoid or at least limit the impact of this eventuality is to discuss audit findings, what they mean and possible solutions with operational managers as the audit proceeds. Such discussions may provide further insight into how and why things are happening and ensure the audit report has an appropriate accuracy and balance.
It is also advisable to have a closing meeting to the audit engagement to reiterate key points, verify accuracy and begin talking about possible solutions. This will ensure there are no surprises when a draft audit report is prepared.
Having done everything possible to prepare a meaningful and constructive draft audit report operational managers may be obstructive, using delaying tactics simply because they don’t like the results of the audit. If this occurs reasonable time needs to be given to progress the draft report to a final report but this should done within a clear deadline.
Inefficiency in the audit process
Taking all of the above into account it may be that the audit process is simply inefficient.
The application of ‘Lean’ principles to encourage working in a more efficient and effective manner may be an approach to consider. For example, ensuring that internal audit resources are focused on delivering value to key customers, streamlining the processes and behaviours that support this; prioritisation of the areas of scope, so that the most important areas are looked at first, rather than those that can be done most easily; and proactive discussions throughout the engagement to clarify or validate whether further detailed testing is necessary.
Resist the temptation to over-audit - information is "sufficient" if it is "factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor."
Reviewing the way audits are done is obviously a bigger strategic issue but taking this step may be important if audits are not as effective with regular time overrun across the function as a whole.
Further reading
Standards
Internal auditors must develop and document a plan for each engagement, including the engagement's objectives, scope, timing and resource allocations.