Written by Roberto Calderon
This article is one of a 7-part series on “Technology Auditing Strategies” co-authored by Eric Stewart and Dr. Paul Eder.
Government audits always have two major players who enter the project with wildly different perspectives: the auditor and the auditee. Auditors seek truth, period even if that truth reveals programmatic warts and blemishes. Auditees seek truth, too, but they want fairness in the treatment of the positive aspects of that truth. Generally, auditees believe any negative findings should be asterisked with everything their organizations have achieved that knocks people’s socks off. It can be a tug-of-war to unite these competing perspectives behind a joint understanding of results.
An auditor is charged with collecting information and data, examining operational and/or financial records, and presenting findings. Audits are a legal requirement for some organizations to show validity of actions and compliance with rules and regulations. Auditors must make evidence-supported recommendations to address inconsistencies or to modify a process that is not effective or efficient.
Auditees must play nice in the sandbox to ensure an audit yields accurate results. Auditees should present all relevant documentation and records to the auditor, collaborate through the process, and ensure that there is no misunderstanding in the data provided. Auditees should also be available to answer any questions auditors have by providing constant feedback.
This delineation of roles seems simple enough. However, the auditor or auditee often have vastly different points of view on a variety of audit-related topics including timeframes, understanding of data, findings, and process.
Timeframes
Auditors expect to collect the requested information as soon as possible to facilitate expeditious data review and analysis. Auditees understand the urgency but also have day jobs. They want to provide documents and information but prefer a timeframe that does not affect daily business operations.
Auditors work in deadlines, establishing hard start date and an end date for audit fieldwork. Auditees don’t always feel constrained by procedural deadlines. They prefer to send documentation continuously if the documentation helps clarify findings (as long as the report has not been delivered yet).
Auditors know that their findings reflect program status at a particular point-in-time. In contrast, auditees feel they should be credited for results accomplished after the completion of the audit fieldwork phase, as refinement of processes can be continuously in flux.
Understanding of data
Auditors aim to collect as much irrelevant information as possible from the auditee. Auditees want to provide as much as is legally required without providing documentation they view as out-of-scope. Auditees want to appear as responsive, while also protecting aspects of their programs from scrutiny if the auditors do not specifically ask about them.
Auditors must learn about the organization in a detailed manner within a limited time. Usually, strategic plans, mission, vision, core values, or any financial or operational reports within most recent Fiscal Years are examples of documentation requested. Regardless of this in-depth review, auditees often believe that an auditor will lack true understanding of nuances that everyday operational and strategic tasks involve. They believe that only those on the ground day-to-day can truly understand the actions that are performed and the measures that are tracked.
Findings
Auditors always present findings in their report, and findings tend to focus on areas of weakness. Positive aspects of a program can be noted, but the purpose of findings is to identify and eliminate program deficiencies. All findings are supported by evidence and documentation collected. Of course, auditees prefer that there are no major findings, especially if findings are not reported in the context of all the positive activities being performed. Negative findings make auditees feel like their leaders view their successes through a diminished lens.
However, auditee feelings are not a valid reason for auditors to remove or substantially edit a finding. Auditors have a heavy burden proof substantiate a finding. Nonetheless, auditees believe that if a finding is disputed with a good reason or (additional) evidence, it should be removed from the report (even if the finding was true based on the information available during the fieldwork phase).
Audit Process
Auditors must follow certain standards for quality and ethics (usually government auditing standards—GAGAS). The audit process focuses on factual information, without regard to feelings or emotions. Auditors want to discover the whole truth behind an audit through documentation gathering, research, and data analytics. They want their reports to present a balanced picture. Auditees want their positive achievements emphasized. Moreover, auditees want this emphasis to show in the executive summary, to give appropriate context for findings. Auditees aim to prevent publication of negative findings as much as possible.
Auditors believe the size of the team should be comparable to the size of the audit’s scope. In some cases, not all members of the auditing team are full time on a specific audit. In practice, this means that the number of people working on an audit can outnumber the number of staff regularly assigned to the functions. Auditees may resent being evaluated by a team with more resources available than the team they must rely on for day-to-day work.
Unifying the Perspectives
Is there a magic solution to addressing this difference in perspectives? Yes, and it can be found in one word: Empathy. Empathy refers to the understanding of others’ experiences and perceptions. Being empathic will help auditors and auditees prepare for the attitudes and behaviors. Much audit work relies on open communication and flexibility. By establishing empathic rapport and open channels of communication, both sides can ensure that the audit results will be reflective of the true state of the organization.
—
Roberto Calderon is an associate consultant at The Center for Organizational Excellence, Inc., a management consulting firm based out of Rockville, MD specializing in organizational effectiveness, human capital, data management and information technology solutions. He has authored numerous insights on topics such as data standards and technology audits.
