News last week of improvement in the U.S. jobless situation brought a glimmer of hope that, perhaps, the very worst may be behind us. At least for now. But disruption continues to engulf our personal and professional lives, as the twin impacts of the coronavirus COVID-19 — health and economic — reach ever deeper into virtually every organization on the planet. Internal auditors are wrestling with risks that continue to emerge at warp speed and myriad challenges from working remotely, exasperated by a lack of crucial face-to-face communications.
However, by all accounts, the profession is demonstrating agility and proving its resilience.
Much has been said and written about how internal auditors are adapting: how we are using technology, how we are auditing remotely, and even how we are providing assurance and advice related to health and safety risks. But one topic has been conspicuously absent in conversations about how internal auditors are innovating: how we are reporting our audit results.
COVID-19 has taught us a lot about the impact on modern organizations when disruption is so swift and complete. The shelf life of critical information for timely decision-making has been reduced dramatically. Even in the best of times, our audit reports often take too long, diminishing their value. The average turnaround time for internal audits in many organizations is six weeks or longer. Just finalizing and publishing a report can consume as much as a third of an internal audit’s cycle time. Imagine how out-of-date an internal audit started six weeks ago would be today. There is likely no excuse, especially if supporting data was collected and analyzed more than two weeks ago!
I have been advocating for swifter audit reporting for more than 20 years. I even dedicated three chapters in my book, The Speed of Risk, to timelier auditing. But there has never been a time other than now when reporting audit results swiftly has been more critical. As I noted in my book:
Given the speed at which risks emerge and can wreak havoc, internal audit departments should have zero tolerance for slow reporting processes. Failure to deliver a final report after it’s too late for the results to avoid further impact is not an option. That’s not even protecting organizational value, much less enhancing it.
So, what advice would I offer for more timely report results? I offer four strategies.
I could write on about the timeliness of internal audits, but that wouldn’t be a good use of our time. I hope some of my ideas are helpful as you ponder the future of your audit processes.
As always, I look forward to your thoughts.