On receipt of communication from management that findings previously reported have been addressed, internal audit teams limit their follow-up procedures to test the first part of the overall solution required i.e. the remedial action plan’s output. Sadly, assessment of the impact that results from the remedial action plan’s output is in most cases never assessed by audit teams. To demonstrate my point, let’s look at the simplified scenario below.
In the 2018/19 financial year the internal audit team of ABC Limited reported that there was a rise in unproductive overtime, a situation which was caused by the absence of a framework that guides allocation and alignment of resources (finance, skilled personnel and man hours) to targeted output levels in the maintenance section of this component manufacturing company.
The internal audit team has accurately measured the impact of this finding as interruptions to production schedules, which led to a monthly loss of R20m in revenue and a cancellation of contracts by two customers who were negatively affected by late delivery of components by ABC Limited. During the audit team’s further discussions with management, the head of maintenance had acknowledged that they didn’t have personnel who possessed maintenance planning skills, and had committed to procure the services of consultants as a temporary measure, while recruiting full time personnel with the required skills.
A follow-up audit on the above finding was performed in the first quarter of the 2019/20 financial year. On completion of the review, internal auditors had reported that the finding was satisfactorily resolved as the engineering consulting firm appointed by ABC Limited had developed the maintenance management framework and the company had also appointed a suitably qualified maintenance planning and monitoring manager with extensive relevant experience. The finding was as such closed and taken off the audit finding tracking schedule.
When assessed superficially, the follow-up audit report by the internal audit team may appear like a sufficient source of assurance and comfort for senior management, the audit committee and the board of directors. However, there are two questions that still remain unanswered by internal auditors:
From a cursory assessment of the above scenario, it becomes clear that the follow-up audit only addressed the first part of the remedial action plan, which entails verifying whether internal control gaps reported in 2018/19 audit have been closed with new or improved controls. So, this first of the part follow-up audit only focused on responding to the question of whether the maintenance management framework was introduced, and whether the manager was appointed. Once these questions were answered positively, internal auditors did not probe further to assess whether introduction of the framework and appointment of the manager has led to less interruptions on the production floor and reductions in contract cancellations by disgruntled customers – the ultimate problems which were caused by absence of the framework and the manager. Thus, the internal audit team had only performed a control design or improvement assessment (thereby addressing the first part of the remedial action plan), and did not perform an output impact assessment (which addresses the second part of the remedial action plan).
Performance of the output impact assessment (i.e. the second follow-up audit which addresses the second part of the remedial action plan) would only produce reliable results if performed a few months after verifying (through first follow-up audit) that the maintenance planning framework has indeed been introduced and that the maintenance planning and monitoring manager has truly been appointed. This is because all control measures must be allowed sufficient time for implementation, embedment and maturity, prior to realisation of potential benefits expected to flow from such control measures.
In order to address the approach deficiency identified above, internal audit teams should consider splitting the follow-up audit into two phases. In our scenario, Phase 1 of the follow-up audit was properly planned and carried out. Its results showed that management had introduced the maintenance planning framework and had appointed the maintenance planning and monitoring manager.
Phase 2 of the follow-up audit, which must be scheduled either three, six or nine months after completion of the first phase, may either be scheduled as a separate follow-up audit or be made part of the next year’s full, main audit. However, care must be taken that the second phase should not be scheduled too close to the first one so as to allow the newly introduced or improved controls to reach full maturity prior to assessing the impact they have on the affected business process. While it’s important to leave sufficient breathing space between performance of the first and second phases of follow-up audits, internal audit teams should also ensure that Phase 2 doesn’t take place too long after completion of the first phase. All situations must be assessed based on their nuanced merits and peculiarity of conditions. That’s follow-up audits can leave up to the internal audit profession’s mission of creating and preserving value.
