Getting value from the audit pre-sales and preparation stages
Imagine that you’re responsible for the performance and compliance of a function of your organisation. Between you and the powers that be, it’s decided that an audit is required (we’ll discuss the potential reasons for this shortly), and you set about finding an external auditor that fits the bill.
Unless you already have an auditor who knows your business well, and has added value in the past, this exercise involves more than a simple search on Google and asking for their daily rate. What are the attributes of an auditor that you should consider?
- Is the auditor local to your business, and is this important?
- Are you inclined to be swayed by the auditor’s daily rate?
- Does the auditor have the necessary competence and experience to deliver on your needs?
These are all good questions to ask, but does the auditor want to have a conversation with you to understand your needs before quoting you for the work?
As someone who has conducted internal and external audits for 20 years, I’d like to share my thoughts and experiences about what makes for a successful audit experience.
As it has often been said “Prior planning and preparation prevents p#ss poor performance’. This is absolutely the case when planning an audit.
There are undoubtedly other issues that I’ve not included here, though these thoughts provide what I consider to be essential elements of any discussion when planning an audit, especially with a new client.
Understanding the Context, Purpose and Scope of the Audit
The first question that should be asked for any audit is “What is its purpose, and what is it to achieve?”.
For the purpose of this article, I’ll use the example of a health and safety audit. Triggers for this exercise could include any combination of:
- Determining the degree to which there is a framework for managing health and safety risks to workers and other people.
- Evaluating the degree of the organisation’s compliance with relevant laws.
- Assessing the degree to which workplace hazards have been identified, risk assessed and controlled.
- Determining the degree of conformity with internal processes.
- Examining potential underlying factors to a recent incident or nonconformity (this may cross into the ‘investigation’ area).
These reasons may seem obvious to most, though it’s very common to discover that whilst there is often general agreement that an audit is required, this does not mean that all are agreed on its purpose, or what is to be accomplished from it.
You meet with a prospective auditor, pleasantries are exchanged, and you get down to brass tacks. Does the auditor start a conversation with questions that are aimed at:
- Creating a shared understanding of the audits purpose?
- Understanding the background or pain points that have been experienced by the organisation?
- Defining the policies, processes, standards or regulations that the audit is being conducted against?
With clarity over the audits context and purpose, next is to clarify its scope. In our example of a health and safety audit, does this include:
- The overarching health and safety management system, or parts of it?
- Specific organisational practices and processes?
- Specific facilities and functions within them (e.g. warehouse operations, plant and equipment)?
This is vitally important for the auditor to know in order to plan sufficient time to undertake the audit, as this forms part of the audit budget, which we’ll discuss next.
Also, as the audit sponsor you should share the experiences that you’ve had from previous audits. Specifically:
- What issues have been raised from previous audits that have added value?
- What problems have been experienced that you’d like to avoid?
- What have previous audits failed to achieve, such as any processes that are rarely reviewed or continue to prove to be problematic?
When these points are not discussed, it’s possible that the auditor will prepare for and conduct this exercise against a completely inaccurate set of assumptions. The auditor spends time within your organisation, meets with your people, shakes a lot of hands and proudly presents you with a report that provides you with no clarity over the issue or pain that you’re expecting to address.
The result is overall dissatisfaction with the whole exercise, wasted time and money, and no ability to achieve any improvement. As a result, the report is shelved, and nothing is achieved.
An experienced auditor implicitly understands these potential pitfalls and will make a point to ask questions that ensures that everyone is on the same page.
How to Budget for Your Outsourced Audit
Let’s face it, money matters when you’re running a business, and the audit budget should be carefully constructed and suitably transparent so that you get value for your money.
Whilst not always captured as line items within a proposal or quotation from a prospective auditor, an audit entails all the below to varying degrees:
- Understanding the context and purpose of the audit (we’ve already discussed this).
- Document review, including the organisation’s existing documentation and records, as well as other industry-relevant literature.
- Preparing audit materials, such as checklists and data collection tools.
- Conducting the actual audit, which may involve a combination of in-person and remote methods.
- Post-audit review of notes, observations, and data.
- Preparation of the audit report.
- Presentation of the audit to the auditee.
Depending on your expectations, be careful about auditors who quote simply for the time taken to undertake the on-site audit. Unless the audit scope and criteria is explicitly defined, audit materials are provided, and time for the provision and review of all necessary information is built into the audit time, you may well find the auditor claiming that not enough time was made available to complete the exercise as planned.
In this case, you’re going to face either:
- Additional expense for the auditor to complete the exercise.
- Delayed delivery of the audit report.
- An insufficiently detailed report based on insufficient planning or an incomplete audit.
With these thoughts in mind, carefully peruse any quotation from an external auditor, and ask yourself whether sufficient time has been provided to ensure that the audit has been given every chance to achieve its purpose.
Why should auditors undertake Document Reviews before an audit?
So you’ve met an auditor, agreed that the pre-sales meeting was a successful first date and you’re happy with their day rate. But hang on, they’re suggesting a few hours to conduct a document review!! Isn’t an audit simply a matter of filling in a checklist??
Though a document review won’t always be a time-consuming element for an audit, depending on the audit scope it will be necessary for the auditor to undertake a degree of familiarisation of your organisation. This serves a number of benefits:
- The auditor understands how things are done in your organisation before arriving to conduct the audit.
- The auditor is aware of the issues that have been faced in the organisation in the past that relate to the audits subject matter.
- The auditor can prepare appropriate tools for use during the audit (we’ll discuss this next).
- With all of this achieved, every hour that the auditor is present within your organisation they’re able to be fully focused on the task with optimal productivity.
An auditor who raises a document review as part of the pre-audit preparation process may ask to be provided with copies of relevant processes within the audit scope, operational records, results from previous audits, examples of audit tools that have been used in the past, and the status of actions taken to address these findings.
Expect that such an exchange of information is conducted under a nondisclosure agreement, or other words to this effect within the audit agreement.
Don’t you already have a Checklist for that?
I have lost count of the times that I’ve been told “It’s a simple audit, so am sure that you have a checklist for that”.
Yes, auditors do typically have a number of standard templates that can be of use in your audit, however these are best considered as starting points for what will be used for your organisation.
Every audit is unique, and though an audit previously conducted with similar context, purpose and scope may be of value to the auditor in the preparation phase, audit tools need to be fit-for-purpose. This involves understanding their limitation, and often refinement in order to meet your needs. It’s not unusual for auditors to spend a number of hours ensuring that their checklists and other audit tools will permit for the best outcome.
Picture an auditor arriving at your facility to inspect an item of plant (e.g. forklift), and they’ve brought with them a generic forklift inspection checklist. However, you’re using an electric-powered reach stacker within your warehouse. What’s more, you already have a checklist for this that was previously developed to meet your organisation’s needs, which is being used by your team.
Why not provide a copy of this to the auditor ahead of time. They may well give you feedback on its usefulness, or ideas for improvement. At the very least, you’re both working together to ensure that the exercise has the best ability to succeed.
Preparation of audit checklists and tools often goes hand-in-hand with the document review, so worth keeping in mind when reading your auditor’s proposal.
With all of that preparation, you’re now ready to go!
The time and effort to prepare for an audit is an often-overlooked aspect of the audit process, mostly given that this is rarely budgeted for by either the auditor or auditee.
In order to get the best value from an audit, permit the necessary time needed by the auditor to:
- Provide the background to needs, organisational context, and any pain points that have prompted the audit.
- Understand the scope of the audit (i.e. organisational levels, functions, facilities).
- Provide examples and details of how this activity has been performed in the past, what has worked well (what to replicate), and what hasn’t’ (what to avoid).
- Permit time for the auditor to conduct a document review and prepare the necessary audit tools
A better appreciation of the value of pre-audit activities leads to better outcomes for all parties, and adds value to organisational governance.
Speak with us to discuss your audit needs, whether you need a regulatory compliance review, ISO gap assessment, certification or surveillance audit support, or guidance with your entire internal audit plan.
