On the Frontlines: Beyond the Findings

But one thing we can all agree brings us joy is this: reporting significant audit findings with value-adding recommendations that are accepted by the audit client and applauded by the audit committee. A good audit finding says a lot about the auditor and their audit process. It demonstrates that the auditor is skilled, and the audit procedures and methods are sound, at least to some extent. While a major audit finding may make the audit client uncomfortable, it certainly gives the auditor pleasure in knowing that the audit work contributed in some way to the organization.

However, what happens when an auditor does not find any observations during the audit? Many auditors have experienced this situation at some point in their careers, where weeks or even months of auditing a process yield no audit observation. This can be frustrating for auditors and may raise questions in the auditor’s mind about whether the audit was conducted properly.

It is essential to remember that not producing an audit observation is not necessarily an indicator of the audit or auditor's quality. While finding observations can certainly benefit the organization, it is not the primary objective of an audit. According to the International Professional Practices Framework, internal audit is an activity designed to add value and improve an organization's operations. To achieve this, auditors must approach the audit in a “systematic and disciplined” manner, adhering to established standards and procedures. These include planning the audit carefully, based on a thorough understanding of the organization's business, risks, and internal controls, and performing audit testing based on the dynamic audit plan to assess the effectiveness of the organization's risk management, control, and governance processes.

Still, there is no guarantee that an audit will result in an audit observation or one that counts as particularly significant. An audit that produces no observations can happen for a few reasons. First, the organization may have a well-designed and sound internal control system that enables it to manage its risk management, control, and governance processes effectively and efficiently. Second, the auditor may have simply missed an observation during the audit process due to not following the recommended audit standards or procedures. In either case, it is important for the auditor to remain objective and remember that not finding any observations does not necessarily mean that the audit was not conducted correctly.

In such a situation, before processing the final audit report, auditors should consider performing the following rechecks to ensure the audit's comprehensiveness:

• Review the understanding of the business, the processes under audit review and any other relevant processes, associated risks, and controls to ensure that the audit was comprehensive. Understanding is important, as the entire audit work is planned and performed based on the auditor’s understanding, and any gaps may render the audit ineffective.
• Recheck the engagement plan to ensure that all areas of risks related to the process under review have been identified and sufficiently covered.
• Confirm that the testing methodology used was appropriate for the audit objectives and that the sample size was sufficient to reach a reasonable conclusion.
• Verify that all data sources were complete and accurate, and that the analysis was thorough.
• Confirm that the audit followed all applicable standards and procedures.
• Consider engaging in additional dialogue with the audit client, which may reveal new insights for the audit.
• Consider reviewing the audit approach and methodology to identify any areas where improvements could be made to increase the efficiency or effectiveness of future audits.
• Ensure that necessary audit evidence is preserved to ensure that the audit was comprehensive, accurate, and reliable.

Further, by looking for ways to add value beyond just identifying observations, auditors can help ensure that their work is seen as valuable and meaningful by the organization. For example, internal audit may recommend best practices, highlight untapped opportunities, or perform business analysis that gives management additional insights for business decisions, reporting improvements, and more.