International Journal on Governmental Financial Management – 2008 133

DETERMINING AUDIT FINDINGS

Frank Knight knightfold@ripnet.comConsultant, CanadaThis article explores some of the challenges in developing audit findings. The message isthat there are more ways than one to approach the audit and that theauditor should not beconstrained by a rigid application of the standard methodology. We present here twoalternative approaches. Simply stated they are:Traditional Model: What should be; what is; finding results from identification of a gap or difference.Alternative (or Converse) Model: What is; what could be; finding results from judgementof whether appropriate / not appropriate in the circumstances.

Traditional Model

The standard approach is to compare what is in place againsta standard or criterion. Theauditor defines what should be in place to manage a function. In financial audit, the auditrefers to GAAP (generally accepted accounting practices). In performance audit, theauditors develop audit criteria against which the management systems, procedures and practices can be compared.The auditor can then determine whether the organization is being managed according tothese standards. In this way, the auditor generates findings where there is a gap betweenwhat should be in place and what is in fact in place. The auditor thus identifies a findingas a situation where there is a discrepancy between what should be (the criterion) and whatis. In this way findings are generated. This is the theory normally presented in auditmethodology.Furthermore, it is commonly believed that without a criterion, a finding cannot exist. In practice, this is not a reasonable assumption. Especially in performance audit, it is possibleto encounter situations that had not been anticipated. Or, the experience of the auditor isinsufficient to develop a sufficiently complete set of criteria to apply to the area beingaudited.During the audit process, the auditor may sometimes encounter, or observe, a situation thatis obviously, or apparently, wrong but for which, no prior criterion had been developed.Some auditors then go back and “invent” the appropriate criterion. This is notintellectually honest.

134 International Journal on Governmental Financial Management – 2008

Where an unsatisfactory situation is encountered where no prior criterion has beendeveloped, the auditor should recognize, nevertheless that a reportable observation has been made. When discussing this type of observation with the management of theoperations, it should be explained (if the original set of criteria had been given tomanagement prior to the start of the audit) that no prior criterion had been developed butthe concern is still a reality. Management should be persuaded that there is a concern, or,if there is a good explanation for the problem, the observation should take this intoaccount.

Alternative (or Converse) Model

Another approach, as often applied in social studies, is to examine what is in place, i.e.how the managers are managing their business. With this approach, the auditor notessituations where results are not being achieved, where errors are occurring, where there iswaste or mismanagement. Also, of course, the auditor notes, and in some cases providesassurances, where the operations are carried out successfully.With this approach the auditor still needs to know what is usual practice and should alwaysdevelop appropriate criteria. This knowledge and set of “expectations” is needed toconduct the audit. The emphasis of the audit work, however, is on understanding how themanagers have chosen (or been forced) to manage the particular situation. The concepthere is that if it works (and that there are no serious risks that it may fail in a particular situation) then the auditor may accept that it is appropriate even if it is different fromnormal practice.At the same time, the auditor should understand why it may differ from the criteriadeveloped before-hand or, where no criterion had been developed to address the situation,why an additional criterion is required. There can be many reasons why it does notconform to normal practice.In discussion with management, the auditor confirms that there are problems or reasons for doing things differently, and determines the cause(s) of this condition. Thus the auditor confirms the situation and determines what observations are appropriate in thecircumstances. Then the auditor concludes what changes should be made to improve themanagement structure, processes and practices and makes recommendations.Often in governments that are short of funds the “best” management practices may not berealistic. For the auditor to recommend more funds (or suggest systems that would be beyond the budget of the organization) will not be helpful in the situation. The auditor should suggest perhaps different methods, or different allocation of effort to improveoverall performance.

International Journal on Governmental Financial Management – 2008 135

The Difference

In practice, both directions of logic are used. Yet, it is important that the auditor is awareof the alternative approaches. Understanding the reality and adjusting expectationsaccordingly is more realistic, and certainly more useful, than limiting the audit process toone of comparing “what is“ with “what should be” to produce the audit findings. Not Necessary to Have Every Criterion Addressed and Every Finding ReportedThe “traditional” approach is often combined with the insistence that every criterion should be addressed and a finding reported, either that the practice is consistent with the criterion(a positive finding) or that there is a deficiency (a negative finding). The difficulty withthis is two fold:The auditor is forced into reporting matters that may not be of significance; and/or In some cases, extensive evidence (e.g. a large sample size) is required to ensure thevalidity of a positive finding (i.e. the provision of assurance).There should be continual review of the audit work to ensure a trade-off between allocatingscarce audit resources to insignificant areas and obtaining sufficient evidence to arrive atsupportable conclusions for significant findings. This means that the auditor should notalways attempt to produce a complete set of findings.It is more important to report on a few key audit concerns than provide a “complete” auditcoverage. Furthermore, many small findings can detract from the main message theauditor wishes to provide management. Some managers want to be provided all thedetailed findings, while others want a concise report that conveys just the importantmessage. This is a reporting issue but from the findings perspective, the message is thatmany detailed findings are not necessary.In most cases, where the report is more than say 15 pages long, there should be anExecutive Summary. This should provide a clear and meaningful message that has limiteddetails. It should provide a summary of the audit objectives and scope, the main findings,the significant conclusion(s) and a list of the more significant recommendations containedin the main body of the report. Even in the main body of the report, it is preferable to keepthe communications simple and clear, placing detailed calculations and listings of detailed observations in appendices."