Module 4 - Engagement Communication Phase

8/9/2021 Module 4: Engagement Communication Phase
Module 4: Engagement Communication Phase
Site: New Era University Printed by: Methly Joy B. Moreno

Course: ELECT4-18 - Professional Electives 4 (Operations Auditing) Date: Monday, 9 August 2021, 4:35 PM
Book: Module 4: Engagement Communication Phase
https://college.neu.edu.ph/mod/book/tool/print/index.php?id=188278 1/16
Description
Lesson 1: Title
Table of contents
1. Introduction/Overview
2. Engagement Communication Activities
3. Using the CCCER/5C Model to Document Findings

3.1. Criteria
3.2. Condition
3.3. Cause
3.4. Effect
3.5. Recommendation
4. Making Findings and Recommendations Persuasive
5. Using Quantitative Methods to Improve the Quality and Impact of Audit Findings
6. Persuasion and Diversion
7. Developing Useful, Pragmatic, and Effective Recommendations for Corrective Action
8. Internal Audit Resolution and Follow-Up
1. Introduction/Overview
Communications occur throughout

the engagement, and communicating outcomes is a critical component of all
internal audit engagements.
Regardless of the content or form of the
communication, which may vary, communication of engagement outcomes “must be
accurate,
objective, clear, concise, constructive, complete and timely”.
2. Engagement Communication Activities
Perform
observation evaluation and escalation process. Once one or more observations
are identified, the internal audit team must assess
each observation using an
evaluation and escalation process and determine the implications those
observations have on the resulting
communications for the area under review.
Conduct
interim and preliminary engagement communications. As indicated, internal audit
communications occur throughout the
engagement, not just at the end. Matters
often arise during internal audit engagements that warrant management’s
immediate or short-term
attention. Timely communication of such matters allows
management to address and resolve them sooner, sometimes before the
engagement
is completed. Other information that may be conveyed to the auditee on an
interim basis during the engagement includes, for
example changes in engagement
scope and engagement progress.
Develop final
engagement communications. At this point, the internal audit tea, is ready to
consolidate and synthesize all the evidence
gathered during the engagement.
There is no single prescribed way for expressing overall engagement results.
Options include:
Listing and
prioritizing control observations but stopping short of reaching an overall
conclusion or expressing any level of assurance
regarding the effectiveness of
the auditee’s controls.
Reaching a
conclusion known as negative assurance. Internal auditors express negative
assurance when they conclude that nothing has
come to their attention that
indicates that the auditee’s controls are designed inadequately or operating
ineffectively.
Reaching a
conclusion known as positive assurance. Internal auditors express positive
assurance when they conclude that, in their opinion,
the auditee’s controls are
designed adequately and operating effectively.
Distribute formal
and informal communications. Final engagement communications should include the
purpose, scope, and results of the
engagement. The purpose represents the
engagement objectives, that is, why the engagement was conducted and what it
was expected to
achieve. The scope defines the activities included in the
engagement, the nature and extent of work performed, and the time period
covered.
The scope also may identify related activities not included in the
engagement, if necessary, to delineate the boundaries of the engagement.
Results include observations, conclusions,
opinions, recommendations, and action plans. The final engagement
communications also may
contain the auditee’s responses the internal audit
teams conclusions, opinions, and recommendations. The observations that
should be
included in the formal, final engagement communications are those
that must be reported to support, or prevent misunderstanding of, the
internal
audit team’s conclusions and recommendations. Less significant observations may
be communicated informally. Conclusions and
opinions express the internal audit
team’s evaluations of the observations. Recommendations, which are based on the
observations and
conclusions, are proposed actions to correct existing
conditions or improve operations. Action plans document what management has
agreed to do to address the internal audit teams observations, conclusions, and
recommendations.
Perform
monitoring and follow up procedures. It is very important for the internal
audit function to determine the corrective actions on
engagement observations
and recommendations were, in fact, taken by management and at the actions taken
remedied underlying
conditions and a timely manner.
3. Using the CCCER/5C Model to Document Findings
The vast majority of what

internal auditors do is verify that conditions are consistent with relevant
expectations. The expected performance is
determined by company policies and
procedures, laws, regulations, standards, SLAs, and similar guidelines.
Internal auditors also examine the
design of programs and processes to
determine if the design is conducive to the achievement of company objectives.
Internal auditors must document

relevant information to support their conclusions and the results of the work
performed. So, when internal
auditors find discrepancies between what is
expected, and what is occurring, they prepare what is commonly referred to as a
finding. A finding is
the name given to the discrepancy between what is
expected and what is actually in place, as discovered by auditors during the
course of their
work. A finding provides the details about the anomaly and is
determined as a result of the procedures performed by the auditor. When
conditions meet the criteria, the auditor’s communication can indicate that the
performance was satisfactory.
In some organizations, the term

“finding” has been replaced by other labels such as “opportunities for
improvement” or “observations.” In other
organizations, the term is still being
used, but it is reserved for the more serious items, while medium or lower risk
observations are labeled
“observations.”
When preparing the finding, it is

very helpful to follow a systematic framework and the CCCER/5C model is widely
used. While some
organizations add other elements, such as “risk” or impact
rating, these are additions and seldom a replacement.
3.1. Criteria
The criteria are the performance

standards or expectations set by relevant stakeholders. The criteria are used
in making the evaluation or
verification, and consist of the expected
performance.
When performing financial

reviews, the criteria would consist of relevant accounting and financial
standards that dictate the recording of
transactions for financial statement
purposes. Criteria can also be established through external expectations like
those encapsulated in
government laws and regulations. Others are based on
internal expectations such as those defined in the organization’s policies and
procedures
that govern employee conduct, the use of company resources, and
procedures describing how control activities or operational activities within a
process should be performed. Lastly, the criteria can be a combination such as
those reflected in contracts and SLAs.
3.2. Condition
The condition refers to what the

auditor discovered as a result of applying auditing procedures. It is the
factual evidence that the internal auditor
found during the review. Internal
audit procedures include gathering testimony, reviewing documents, observing
the work conditions and
dynamics, and performing calculations of important
figures, where applicable.
Whereas the criteria are what

should be in place, the condition is what is in place. The finding exists
because there is a difference between the
criteria and the condition. What is
happening is not what should be happening, so this creates a deficiency that
warrants reporting.
3.3. Cause
The cause is the reason the

condition exists. The cause explains why there is a difference between expected
and actual conditions. Internal
auditors should search for and identify the
root causes of the condition. Failing to do so will result in the auditor
working with the symptom(s) of
the problem and in the end making inadequate
recommendations that provide an insufficient solution.
Getting to the root cause of a

problem is not always easy. In many cases, there may not be just one reason,
but rather several factors creating
the problem. Larger issues often follow
this pattern and internal auditors should be cautious not to attempt to
describe the root cause without
exerting sufficient efforts to find it.
Another challenge with getting to

the root cause is that it takes additional time and effort on the part of the
auditor. Too many auditors develop
overly ambitious work programs that attempt
to cover a very broad selection of review areas, leaving little time for
in-depth analysis of findings.
This creates a dilemma for well-intentioned
auditors, who then limit themselves to “skimming the surface” on issues,
without spending enough
time diving into the problem areas to fully understand
the causes, triggers, impacts, and consequences of problems identified.
3.4. Effect
The effect constitutes the

consequence of the condition identified. It relates to the risk or exposure the
organization, program, process, or others
will face because the condition is
not consistent with the criteria. The effect is the impact resulting from the
problem itself. A helpful approach to
document the appropriate effect, and to
make sure that the auditor has in fact identified a finding worthy of being
included in the report is to ask:
“So what?” Why should anyone care about this
condition? because it has a drastic impact.
If the auditor is unable to

articulate the consequence of the finding, the auditor may also have difficulty
convincing the auditee that there is in fact
a problem that warrants their
attention and correction. Furthermore, being unable to verbalize the
consequence will often identify a preference
on the part of the auditor, rather
than a real problem.
3.5. Recommendation
The recommendation is the action,

or collection of actions, that if successfully implemented, will neutralize the
cause, stop the effect, and restore
the condition to the desirable state (i.e.,
criteria). The effectiveness of the recommendation will depend on the auditor
fully capturing the details
about each of the components of the CCCER model. By
elaborating sufficiently on each of the components, the finding will be
convincing and
compelling so that the reader comes to the same conclusion as
the auditor who identified the deficiency.
Recommendations should be cost

effective when correcting the problem. Care must be applied so the cost of
correcting the deficiency does not
exceed the exposure or loss the deficiency
is identifying. It is also useful for the auditor to consider the principles of
effective processes when
making recommendations.
4. Making Findings and Recommendations Persuasive
Findings and recommendations will

be persuasive to the extent that they convince the reader that there is a real
problem that requires
correction. This can be achieved through a number of
actions:
Quantify as
much as possible. When internal auditors write reports and fail to provide data
that support their arguments, the reader is left
wondering whether there is
really a problem.
Make sure
findings are significant. Since organizational management is increasingly
dealing with complex and worrisome risks, managing
large volumes of
transactions and monetary amounts, and faces constant time limitations, they
should not receive audit findings pertaining to
minutiae.
Consider the
cost/benefit involved. Internal auditors should evaluate quantitative and
qualitative costs and benefits in an effort to refrain from
presenting problems
that are not particularly significant and require a higher cost to correct.
Use
appropriate language. Internal auditors should know who their readers are and
make the language appropriate for the audience.
5. Using Quantitative Methods to Improve the Quality and Impact of Audit Findings
The veracity of the auditors’

work is based on quantitative information anchored in reliable data. This
quantitative approach to documenting
results will improve the impact of the
audit findings.
More qualitative elements can be

included as well, but they may not carry as much weight and could be subject to
auditee challenges. To
address this, internal auditors are encouraged to
collect objective information to support subjective matters. For example, if
motivation is a
concern and this is known either anecdotally by observing the
mood of workers or the diligence with which they perform their duties, internal
auditors may want to consider interviewing multiple workers, documenting the
results of those meetings, and using this information as the basis
for any
mention of employee morale of dissatisfaction. A survey, conducted by internal
audit, human resources or a third-party provider, can also
add quantitative
elements to this topic.
6. Persuasion and Diversion
As much as internal auditors

should know how to increase their ability to be persuasive, they should also
remember that sometimes audit clients
want to persuade the auditor as well.
This could be done to argue a point of view, educate the auditor, decrease the
severity of the rating on a
finding, to convince the auditor to review or not
review certain items, and so on. Auditors should know about some of the
techniques used to
persuade, distract, and divert their attention. For example:
Repetition. By
repeating an argument often enough, the perpetrator hopes that the frequent
repetition creates legitimacy.
Will of the
majority. Another approach is by representing one’s argument as if it were the
will of the majority. This gives the person’s argument
the aura of legitimacy.
Generalization.
Making unwarranted generalizations that represents one’s behavior as that of
the whole is another way to distort the truth.
Creating
information. Some individuals attempt to present a different version of the
truth.
The facts and figures that the

auditors will use when presenting their findings will likely constitute the
preeminent source of information to
persuade auditees. All of these items
constitute evidence that should be part of the finding and the related
communication with the client.
Internal auditors should remember that the
evidence should meet certain criteria:
Verifiable
Transparency
Sufficiency
Reliability
Relevancy
Usefulness
7. Developing Useful, Pragmatic, and Effective Recommendations for Corrective Action
The Standards state that

“Internal auditors must communicate the results of engagements” (Standard
2410). Reporting audit observations are a
key requirement for internal
auditors, and the board and management expect internal auditors to be their
“eyes and ears” about what is
happening in their organizations. They trust the
accuracy, completeness, and timeliness of the information.
Beyond identifying and providing

a laundry list of problems, however, audit clients expect internal auditors to
provide timely, useful, relevant, and
feasible recommendations. These
recommendations should help the organization restore the deficiency so it meets
the performance
expectations. It can, however, help the organization go beyond
the minimum performance requirements and propel it into the territory of
leading
practices. By going one step further, competitiveness is enhanced and
the organization perceives that internal audit is adding value beyond its
baseline expectations.
8. Internal Audit Resolution and Follow-Up
Internal audit follow-up of its recommendations is one of the most important stages of any audit that should not be neglected or incorrectly
implemented. If the internal audit fails to make sure that its recommendations are implemented, then all of the investment in doing the audit may
be wasted.
The timing of the follow-up should be determined in relation to the significance and impact of the recommendations and the criticality of the
system that has been audited. It should also take account of the implementation timeline given in the action plan. It is important that time for
follow-up audits is provided in the short-term (annual) plan and that any specific follow-up audits are scheduled upon completion of each audit.
There are three main ways of following-up an audit, namely,
By letter asking the auditee to confirm action has been taken
In many cases, and certainly for those audits containing minor audit findings, this will be the most appropriate approach. Checks should
then be made at the next scheduled audit to ensure that appropriate action had actually been taken and that the controls had been
implemented properly.
Scheduling a specific follow-up audit
This may involve either
An interim review of the systems and controls that have been introduced, discussions with management to determine how they are
operating, and a limited program of testing to ensure they are working as intended, or
A full system audit to establish that the correct action has been taken and controls are working effectively or, where no action has been
taken by management, to determine the impact of the lack of control
In deciding whether to do an interim review or a full systems audit, some things to consider are
The risk, importance, and materiality of the system

Known changes in organizational objectives or priorities since the audit was done
The stability of the system (systems that are subject to frequent change are less likely to be suitable for interim reviews)
The extent of the changes recommended in the audit report
Any indication that significant changes or new systems developments may have taken place
Follow-up as part of the next audit
It should be standard practice on any scheduled audit to carry out a follow-up to establish the extent of implementation of the
recommendations made at the last audit. This should be done at the start of the audit so that audit testing can be adjusted appropriately.
The audit report should highlight clearly any further action that needs to be taken in relation to the last audit.

Module 4 - Engagement Communication Phase

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module 4 - Engagement Communication Phase

Uploaded by

Copyright:

Available Formats

8/9/2021 Module 4: Engagement Communication Phase

Module 4: Engagement Communication Phase

Site: New Era University Printed by: Methly Joy B. Moreno

2. Engagement Communication Activities

3. Using the CCCER/5C Model to Document Findings

4. Making Findings and Recommendations Persuasive

6. Persuasion and Diversion

7. Developing Useful, Pragmatic, and Effective Recommendations for Corrective Action

8. Internal Audit Resolution and Follow-Up

Communications occur throughout

2. Engagement Communication Activities

3. Using the CCCER/5C Model to Document Findings

The vast majority of what

Internal auditors must document

In some organizations, the term

When preparing the finding, it is

The criteria are the performance

When performing financial

The condition refers to what the

Whereas the criteria are what

The cause is the reason the

Getting to the root cause of a

Another challenge with getting to

The effect constitutes the

If the auditor is unable to

The recommendation is the action,

Recommendations should be cost

4. Making Findings and Recommendations Persuasive

Findings and recommendations will

The veracity of the auditors’

More qualitative elements can be

6. Persuasion and Diversion

As much as internal auditors

The facts and figures that the

7. Developing Useful, Pragmatic, and Effective Recommendations for Corrective Action

The Standards state that

Beyond identifying and providing

8. Internal Audit Resolution and Follow-Up

There are three main ways of following-up an audit, namely,

By letter asking the auditee to confirm action has been taken

Scheduling a specific follow-up audit

This may involve either

The risk, importance, and materiality of the system

Follow-up as part of the next audit

You might also like