Rebutting the rebuttals

Background

Generally speaking, no one likes being corrected or being told that they have made a mistake. All the more so, when such instances of being under scrutiny are perceived to carry an adverse effect on one’s professional image or career or the usual suspect i.e. the year-end bonus :-)

Consequently, it is no secret that auditors who are often mandated to spot vulnerabilities that could potentially be exploited to the detriment of a process / project / controls / financial statements etc. of an organization, are viewed as the ‘villains of the piece’ by many. Show me an auditee worth his salt who hasn’t put up a stiff opposition to the draft audit report and I shall be then willing to believe that audits can indeed be fun for all those involved!

In this lighthearted piece, I intend to distill my experience as an auditor in terms of some of the more common ways auditees tend to respond to audit issues. Kindly have a read through and let me know if you could identify yourself with any of the below scenarios (either as an auditor or an auditee). Furthermore, to balance out the other side of the equation, it would be great if you could suggest ways in which the auditors could give as good as they get :-)

(A) The ‘wiser-than-thou’ gambit

In such cases, the auditee lays claim to having manifold times worth of experience compared to the auditor in relation to the topic under audit. Stressing upon this fact several times during the course of the audit, the auditee indirectly (or sometimes even directly) questions the auditor’s competence, subject matter expertise and / or judgement to spot vulnerabilities in the work of the self proclaimed expert (i.e. the auditee). This approach helps the auditee even if a little bit of doubt is sowed in the minds of the auditors or even better, in the minds of the recipients of the audit report.

(B) The ‘your-audit-approach-is-all-wrong’ gambit

In these cases, the auditee insists on first knowing, then fully understanding and then finally pinpointing the deviations of the auditor vis-à-vis the audit techniques and approach as claimed to be followed by them. To illustrate, the auditee might insist on knowing the project management methodology (‘PRINCE 2’ or ‘Agile’ etc.) based on which the ongoing project audit is being conducted by the auditor. Thereafter, even a small deviation from this methodology by the auditor is held up as an example of how an incorrect approach to the audit may have resulted in incorrect audit issues.

Other variants of this technique include questioning the representativeness of the sample size used by the auditors or the last minute questioning of the suitability of the persons (on the auditee’s side) on whose representations the auditors may have based their audit issues.

(C) The ‘show-me-the-money’ gambit

In this technique, the auditee insists on the auditor coming out with ‘concrete’ examples of sustained monetary losses due to the audit issue in question. By attacking the phrases such as ‘…potential risk…’, ‘…likely to…’ etc. in the draft audit report, the auditee seeks to suggest that all the audit issues raised therein are zillions of miles away from ever translating into reality and thus really are non-issues.

(D) The ‘delaying’ gambit

Knowing fully well that the auditors are always racing against the clock to complete their work, auditees sometimes use this ploy to slow down the pace of the audit. It is an effective technique of delaying the inevitable till it becomes improbable. By repeatedly cancelling or rescheduling audit meetings or purposely bombarding the auditors with lots of redundant information, the auditor is forced into a situation where a choice has to be made on the breadth and / or depth of their audit work. This automatically increases the probability of the key shortcomings not getting noticed and thus preventing them from being translated into audit issues.

And if all the earlier gambits fail, then…

(E) The ‘oh-its-nothing-much’ gambit

As the last resort, the auditee seeks to downplay the risk(s) associated with the audit issue. A commonly deployed way of doing so is attributing the observations based on which the audit issue has been formulated to ‘mere lapses of documentation’. What is then implied is that compliance, with whatever that needs to be complied with, does take place in practice but only the evidence of the same has remained undocumented.

Another variant of this technique is when the auditee sets about demonstrating how trivial the audit issue is when compared to similar observations in other organizations, industries etc.

As it is, it is tough being an auditor out there while positioning oneself as a true business partner. The above mentioned battles that need to be fought certainly don't make it any easier!