Programs: Fresh vs. Canned

December 2004

As a new auditor, I was assigned something benign to work on—so benign it was absolutely meaningless.

I did an inventory audit—an inventory of office chairs, desks, and calculators. I took the inventory records and traced it to tags on those big, blonde, government-issued, wooden desks with laminate tops. I criticized the client for not having the desks in the right office. This was my job.

A year into my tenure, our office underwent a change in leadership. The leaders called a meeting and all of the staff attended. The leaders announced that things would be different from now on.

We were going to do things that mattered. We were going to think about risk in planning our audits. We were going to abandon those old, canned audit programs we had been using for years and actually think about what we were doing. We were going to rely less on last year’s working papers and more on our brains to guide us in what to do. And to help jolt us into thinking for ourselves, they were going to cut our budgets by 20%.

A rumble went up in the meeting. Some folks were shocked and dismayed. I thought the new plan sounded pretty good. I didn’t want to do silly, meaningless stuff any more.

In the hallway on the next break, I observed the clusters of our more experienced auditors. Some of those guys and gals had been there for 15 years. They were not happy. I overheard one of them say “I was hired to audit; I was not hired to think!” HA! He didn’t stick around long.

Many of those folks ended up moving on in the next few months. I am sure they found somewhere that they would be comfortable doing the same old thing all the time. But who ever said auditing was supposed to be comfortable?

I See It All the Time

Many auditors rely on last year’s working papers or canned audit programs. This is comforting but not necessarily smart or effective.

I teach Yellow Book/Governmental Auditing Standards on a regular basis. My audience is often independent CPAs who conduct Yellow Book audits of school districts, or cities, or HUD projects.

My first question to the group is, “How long have you guys been doing governmental audits?” I hear a range of answers, but it is not unusual to hear a few reply that they have been doing audits that must follow Yellow Book standards for 20 years.

Then I ask, “How many of you have read the entire Yellow Book, cover to cover?” It is roughly a 200-page document and pretty easy to digest. Usually no one raises their hand. “OK,” I say, “how about 50%?” Here I may get one or two hands in a crowd of 40. “OK, how about 25%?” Still just a few hands.

So these same guys that just told me they have been conducting Yellow Book audits for decades have not even read it. How can this be?

Well, what they rely on is a canned audit approach that they purchase from a company called PPC. PPC is a company out of Dallas that creates audit guides and sells them to auditors—sometimes on a subscription basis.

So the auditor doesn’t have to worry about reading the Yellow Book because the PPC does it for them and plugs the requirements into a handy, dandy audit program. Convenient. And to me, a little bit scary.

I also know that these same auditors have never read the COSO control model on which our entire assessment of controls is based. Again, relying on PPC.

Nothing at all against PPC. They provide a very valuable service and it is worth every dime the auditors pay to buy the manuals and subscribe to their service. BUT the danger is that the auditors are not thinking for themselves. PPC is not out there in the field with the auditor! The PPC’s programs are intended to be used as a tool, not to be followed without any idea of what the roots of the concepts are!

Following Up After Randy

After auditing a large state retirement fund for a few years, I was told that I would be in charge of auditing investments the next year. At the time, the state retirement fund had $24 billion in investments. Traditionally, this task took one auditor 3 months to tackle. I was intimidated.

I was even more freaked out by watching Randy, the seasoned auditor who was currently auditing investments. Randy worked weekends. Randy had to have an extra room and extra shelves to store all the investment files he had pulled. Randy sampled 200 files for dozens of attributes. His spreadsheets were multi-columned, multi-colored, and multi-paged. He did a heck of a lot of work.

True to form, upper management stuck with their motivation to help us all be smarter, more efficient, and more effective in what we were doing; I was told I would get 20% less time than Randy had to conduct my work. Oh, no!

What did I do? I created a new audit program from scratch. I was able to cut out many of Randy’s audit procedures and managed to come in under budget.

In future years, when the task was passed on to another auditor, my program was rewritten and more waste was cut out. And so on, and so on, and so on. (Now they probably conduct the audit in a day… just kidding!)

Now how do you create an audit program? That and more about audit programs in next month’s newsletter. (Hey, I have to create some kind of suspense! This stuff isn’t that entertaining.)