Bite Off Only What You Can Chew

January 2004

I once did training for an audit team that only had five auditors who each worked independently on projects. One of the auditors could really crank out the projects. She, single-handedly, completed half of the team's audit plan each year and created the resulting reports. Another of the auditors completed only two projects each year and the resulting reports were painful for the audit manager to edit. The other three members of the team were somewhere in the middle of these two extremes.

The audit manager's question to me was, "What do I do to get my slower auditors to crank out their projects faster?"

After working with the team for a few hours, it was very evident what was happening. The faster auditor was able to focus on very specific issues as a result of doing a risk assessment up front. Her audit objectives were very tight and limited. She did not look at everything in an area—she looked at one or two things. She sought approval for her audit plan from the audit manager before she began her work and kept the audit manager info rmed as the work progressed.

The slower auditor, although a more senior auditor, was very slow to wrap up projects. Once he would delve into an area, he seemed to get lost in the vastness of the topic and see a myriad of options for getting the work done. Because he was a senior auditor and a little introverted, he did not like to check in with the audit manager for feedback. He worked completely independently and was hesitant to show the working papers and the report to the audit manager until he was sure both were perfect.

This usually meant that the audit manager didn't have a clue what was going on with the project until the very end of the project, when it was much too late to redirect the auditor. At the end of the year, this auditor was super stressed out because the audit manager was pressuring him to get the projects done so that she could report a completed project to the audit committee.

This auditor bit off much more than he could chew on each and every project. I believe the fear of missing something drove this auditor to spend too much time looking at everything. Many of the avenues pursued by the auditor ended up yielding nothing.

Another person at fault here was the audit manager, who gave this senior auditor enough rope to hang himself. By not forcing the auditor to communicate with her, she was enabling the auditor's failure.

Remember my definition of failure from the last AuditSkills newsletter? The definition of audit failure is spending too much time examining areas that no one cares about.

This senior auditor was failing because he did not define a specific audit objective, did not perform a risk assessment, and bit off much more than he could chew. We have talked about objectives and risk assessments in the previous newsletters, so let's talk about biting off only what you can chew this time.

Break the universe down into manageable chunks

In order to approach an audit effectively, you must break the audit universe down into manageable chunks. Instead of saying that you will examine the whole earth that is this topic, you are going to look just at the continent of Africa . And even more specifically, you are going to examine just Kenya. More specifically, just the northwest corner of Kenya—and just one village in northwest Kenya . Maybe just one family, in just one village in the northwest corner of Kenya . (Is this reminding you of a children's story?)

Let's pretend we are auditing a retirement fund and you have been assigned to "audit investments." Whoa! Too broad. Which specific aspect of investments are you going to examine?

You could divide the investments system into the functions of the investment department: Choosing investments, actually making the investments, evaluating and liquidating the investments, reporting on the investments, etc.

You could divide the investments into types of investments: stocks, mutual funds, real estate, or bonds.

You may end up deciding that the highest risk lies with the reporting of results of mutual fund investments. This would be a very specific, digestible chunk of audit for you to examine.

If you left the scope of your examination as "audit investments" you would be swimming in the mire forever. And another bad thing would happen. Those who are reviewing your work or using your work may have a different idea of what you should have covered in that area. If you are not clear about what you have actually done, they may infer that you have done something you haven't.

So that is the first step of biting off only what you can chew—dividing the universe into logical chunks and only looking at one or two discrete chunks. The next step is to adopt a control model to guide your examination. You may choose the Yellow Book management control model or the COSO model or the Red Book model. This is such an extensive topic, I'm going to put it in our next newsletter—maybe even the next few newsletters!