During an audit, business management can feel they have little power over the process or the audit result. But once an audit has been completed by the internal audit department, the corporate auditors or the external auditors, business management takes over and is responsible for drafting a response to the report. Audit responses should be specific, timely and have the necessary budget available.
Writing a solid audit response is important, because the auditors and executive management will hold business management accountable for delivering any control improvements they commit to.
Confirm that you have the budget in place or will have it in place to make the control changes you commit to in your audit response. Identify all costs, including equipment and systems upgrades, procedure manual re-writes and additional headcount that will be required to resolve the control weakness. Escalate your budget needs to your manager and ensure that funds are reallocated from other areas or new funds are released to allow delivery of the improvements within your timeframes. Generally, executive management will understand the need for control improvements recommended by the auditors and will find funds for the changes. If you commit to control improvements in your audit response and are unable to deliver them due to budget shortfalls, the auditors will not accept this as an excuse.
Set realistic dates for implementing your control improvements, as recommended by the New York State Office of the State Comptroller, and be generous without being excessive. Control weaknesses, particularly those related to information technology systems, can take longer to resolve than originally planned. Most audit departments and executive business managers will expect you to deliver improvements to the schedule you have set. Modifications to the timeframe might be permitted, but will be frowned upon unless a drastic change has occurred in your business to necessitate the change.
Designate an individual or individuals who will be responsible for implementing the control changes. Multiple individuals may be responsible if the change involves more than one department, such as operations, technology and human resources. Ensure the named individuals have the authority to make the changes happen.
Commit to specific remedies to the control weakness identified by the auditors and do not allow room for interpretation of your intentions. The auditors will review your audit response and determine whether it will resolve the control weaknesses they have identified. If your relationship with the auditors allows, approach them as you are drafting each response and get their feedback. Be as clear as possible in your response because the auditors will return to verify that you have taken the actions you committed to.
评论