The Clean Audit Report | Norman Marks on Governance, Risk Management, and Internal Audit

Be honest.

What’s your immediate reaction when you see a report like this?

Is it one of these?

• What a waste of time! Why was this audit performed?
• I don’t believe it! Maybe the controls are effective, but there are always findings!
• Where are the sections on Objectives and Scope?
• This is good news!
• This might be a missed opportunity.

Answering each:

• Presumably the audit was performed because the risks to customer satisfaction, accounting, and revenue objectives would be high if the controls were not effective. You don’t only audit areas where you know you have problems. You audit areas where there is value in confirming that the risks are being addressed. Maybe the last audit identified issues; maybe the audit was requested by the audit committee; and maybe the systems and/or management have changed.
• You can always find something, but why include it in the audit report if it’s trivial and can be handled by operating management?
• Why clutter up communications with unnecessary content? So what if ‘standards’ mandate them! What would you say if an ‘auditee’ did something because, they said, their “standards” required it even if there was no value in it?
• Yes, this is good news. The CAE is providing assurance that…