What to read first: Audit recommendation tracking
|Auditors||Version 1.0 Beta|
Check the vocabulary for audit recommendations
Target dates are not forecast dates
Reporting on the implementation of audit recommendations usually involves target dates and actual implementation dates. Actual dates are classified as ‘within time’ or overdue by varying degrees. Different degrees of ‘overdue’ might trigger a different level of audit committee attention, or different protocols for tracking.
There can be two types of target date, a completion date to which management committed at the time of the audit, and an estimated completion date, which may change whenever management provides a status report on implementation.
Extensions are problem
Some systems include the concept of an extension of time, granted under the authority of the audit committee. The concept of ‘extension’ implies that the original target was a completion commitment made to the audit committee, which can be re-negotiated.
An ‘extension’ will change the reporting on the recommendation, for instance reporting it as on ‘within time’ when it would otherwise have been reported as overdue. It is not clear what else changes. In most instances the very idea of an ‘extension’ overlooks the fact that there is a continuing problem in the real world. That problem does not go away through audit committee indulgence or more favourable numerical reports. My preference is that there be no such thing as an ‘extension’.
A workable solution
There is no single regime that will work best in all circumstances. My sometime audit committee, my Chief Audit Executive and I have been satisfied with these arrangements:
- For each agreed audit recommendation, there is a completion date to which management commits at the time of the audit. That ‘commitment date’ is subject to critical assessment by the auditor, Chief Audit Executive, and audit committee, before the audit is finalised.
- Implementation is within time if it is within the commitment date. If implementation is later, it is classified as overdue, even if management has given a later forecast date and provided reasons.
- No extensions to the commitment date are possible within the standard protocols. A retrospective alteration to that date may be considered if exceptional circumstances can be demonstrated to the audit committee. Exceptional circumstances might include a basic error made by both auditors and managers at the time of the audit. Exceptional circumstances do not include under-estimation of effort or inadequate planning by management, or even budget cuts. Those cases do not warrant a retrospective alteration of the date.
- At each management status report, management advises when the recommendation is now predicted to be fully implemented, which becomes the current ‘forecast date’. This forecast date can be updated at management’s discretion, and no approval is required. It has no effect on classification or reporting of the recommendation as within time or overdue.
- If there are multiple dependent stages to full implementation, such as an initial investigation or funding request, the initial commitment date is the date by which the known first stage will have been completed. As each stage is completed, and later stages are decided, the commitment date for the completed stage is replaced by the commitment date for the next stage.
- Timely implementation of audit recommendations is not used directly as a performance indicator for managers or for auditors. Exceptions and movements in timeliness metrics are taken as a trigger for investigation of what may be going on in the real world, be that good or bad. Events happening in the real world, and the audit committee view of those events, can be used for performance assessment. The Chief Audit Executive and audit committee can inquire into real-world actions on any recommendation, regardless of its timeliness metrics.
|It would be simpler to have no commitment dates at all, and to simply track the amount of time that each recommendation has been open. Such an approach also eliminates the idea of an ‘extension’ as there is nothing to extend. It helps to focus attention on the real world. However, not having a commitment date would leave management out of the negotiation of acceptable delay, which is generally a worse problem than the potential arguments about due dates.|
Main article on Audit recommendation tracking