On the first day of your audit, you’re confident you’ll deliver your report on time. You have visions of a happy client and happy firm partners. But, somewhere along the way, things break down. Your best auditor transfers to another job. You learn–as the audit progresses–that your junior staff member lacks sufficient training. Your client is not providing information as requested. And, additionally, your audit team has unearthed a fraud.
How can you lessen or respond to these problems? Project management. In this post, I’ll tell you what it is and how you can start using project management in audits, including software selection and practical implementation steps.
Auditors need to be effective (by complying with professional standards), but we also need to be efficient (if we want to make money). And project management creates efficiency.
Managing resources, identifying impediments to audit processes, responding to scope creep–these are just a few of the issues that we encounter. And these challenges can increase engagement time and decrease profits. Worse yet, that promise regarding timely completion can go unmet.
Either we will manage our audits, or they will manage us.
So, what are the keys to using project management in audits?
The number one ingredient to a successful audit is your team members. Even more important is the person managing the engagement.
Have you noticed that some people–regardless of the obstacles–just get things done? If possible, get and keep people like this on your audit teams. You may be thinking–at this moment–“but our firm has a difficult time hiring and retaining great employees.” Then revisit your hiring and retention practices.
Having great team members is essential, but they need to work together. So, how do we get them to play their roles at the right time? A project management plan defined in project management software.
There are plenty of useful project management software packages. They include:
Pricing varies. Some are free while others are expensive. So, you’ll need to do your research to determine which solution is best for you. Personally, I use Basecamp. If you want to start with a free application, try Trello or Asana. Another option is Smartsheet (an Excel-spreadsheet-based product). Larger firms may desire to take a look at XCMWorkflow.
I was recently exposed to SuraLink in an engagement where I assisted a city government with its preparation for an audit. The external auditors used SuraLink to request and receive information from the client. I was very impressed with this product. Though I have used Basecamp historically (as you’ll see in a moment), I plan to give SuraLink a hard look. Basecamp is wonderful in terms of use-of-use, but I’m not confident in the security. So I’ve used Basecamp in conjunction with other products such as ShareFile and Box. SuraLink appears to provide you with one product to manage and house documents.
Regardless of the project management software you use, always think about security since you are uploading and downloading client files.
Regardless of the product you use, get your feet wet. If you’ve never used a project management package, it’s hard to understand the beauty of doing so.
Here’s how I got my own feet wet.
Four years ago I started using Basecamp. And why did I pick this software? Mainly, because of ease of use. I can create cloud-based to-do lists for my audit teams and my clients. Also, Basecamp allows me to hide my audit team’s to-do list from my client. So, my audit team can see the client’s to-do list, but the client can’t see my audit team’s list.
Additionally, I can assign each to-do item to an audit team member or client personnel. And even better, I can assign a due date. When the to-do item is due, the designated person receives a reminder email. (As you can see, I no longer need to send a client assistance checklist to my clients. Those tasks that once resided in a Word doc now live in Basecamp.)
Basecamp provides iPad and iPhone apps so that I can see my projects on those devices. Additionally, I access my projects on my Windows desktop using the Internet. So, Basecamp is accessible from anywhere.
Here’s a video overview of Basecamp:
Once you’ve picked your project management software, you need to create a project management plan.
What is a project management plan? It’s deciding what, when, and who. These three factors are dependent upon the deliverables, and in our case, the deliverable is the audit report.
First, let’s start with who will perform the actions.
A partner, an in-charge, and one or two staff members often comprise an audit team. Regardless of the team size, your first decision is “who is going to work on the engagement?” and as we said above, this is the most crucial element in getting your audit done. But notice that an audit involves not only your team members but client personnel; these include critical audit stakeholders. You can’t audit unless they provide information, answer questions, and allow you to inspect documents. You might also work with specialists or attorneys.
Add all persons to your project management software, including audit team members, client staff, and others. (In Basecamp, I add persons to the project by sending an invitation email from within the software.) But how do we know who we will work with? That depends on what we plan to do.
Second, determine what needs to be done. But how do we do this? The development of our audit plan.
The audit plan is our response to risk assessment which is performed early in the engagement. Once we perform walkthroughs, make inquiries, inspect documents, and make observations, we become aware of risks. And in response, we create an audit plan to address those risks. Now we know what needs to be done. The audit plan feeds the project management plan.
Notice the risk assessment process and audit plan informs the project management plan. Notice also that the project management plan is not the same as the audit plan; they are distinctly different. One addresses risk and the other addresses the how, when, and who of getting things done. For me, my audit plan lives in the audit programs (inside my audit software), and my project management plan lives in Basecamp in the cloud.
Here’s an example of how the risk assessment process feeds my project management plan. As I perform my risk assessment procedures, I see that one person makes disbursements, records the payment, and reconciles the bank statement. Now I know the client lacks segregation of duties in the payables area and has a fraud risk. I will respond to those risks by performing procedures such testing disbursements. Now I know what I am to do. In my project management plan, I need to marry this audit procedure (the testing of disbursements) to a team member. So, I add the task to my project management plan and assign it to one of my people. I also specify a performance date.
Some audit tasks are performed in every audit, regardless of the audit risks, such as obtaining a signed representation letter. These tasks can be set up in a project management template which can be used to create your initial project management plan. Then you can add the client-specific tasks as needed.
Thirdly, we need to specify a date for each action.
Project management software allows you to specify when an action is to occur. Once I know who is on the audit team and what is to be done, my remaining duty is to specify a date for the action. You may wonder, “how do I know when each action will occur?” You may not know precisely, but you have an idea. So, go ahead and specify a date. If later you need to change that date, you can. There is no sin in amending the plan.
Now that I have a project management plan, I need to be aware and vigilant to keep the plan on track.
The purpose of project management is to enable you to control your audit. But many times the original scope and particulars of our audits change. And if our project management plan doesn’t change concurrently, we lose control.
For example, if your audit team discovers a fictitious vendor fraud, then your time budget may need to expand. Let’s say we believe the audit will now take an additional 80 hours, and that we need to bring in a fraud specialist. At this point, if we don’t amend the engagement letter, we’ll eat this additional cost. So, it’s time to ask the client for an additional fee. The fraud was not anticipated in the original contract. Now, you need to amend the contract to cover the additional work. (Construction contractors do this all the time with change orders. But auditors are often hesitant to do so.)
As you perform your audit, be aware of scope creep. If your client asks you to perform additional services, then amend your contract. Otherwise, your profit realization will diminish quickly. This is especially true for bid audits such as governmental engagements.
More times than not, changes will occur during the engagement. And regardless of the cause, we must amend our plan. For me, I’m going back into Basecamp and adding additional steps.
In addition to being aware of potential changes, we need to be vigilant.
We know from experience that it is natural for the audit process to fall apart. It’s like most things in our universe. Entropy happens.
When it does, you must fight to restore order. Why is this so hard to do? Because you have so much going on. You aren’t working on one audit. You’re working on two–or three. You have office meetings, client meetings, tax deadlines. You are busy! Therefore, if you don’t have a way to maintain control, you will feel desperate.
But that’s the beauty of project management. With it, you can maintain control.
Think of your project management plans as dashboards that flash green or red lights. And those indicators allow you to see how things are progressing–or not. Moreover, this knowledge allows you to react in real time–and to stay vigilant. As you monitor your audits, you can take corrective actions to keep your projects on track.
Project management is simple in concept. You plan tasks, you assign them, and you specify due dates. Then you need project management software to track the actions, assignments and due dates. Once the system is in place, you can monitor your projects and manage change.
So why do most auditors not use project management? Because many think they can do so in their heads–and I know many who feel this way. Sorry, but I have to disagree. If you’re like me (and I bet you are), you have a million things going on. So without project management, you’ll do your work by the seat of your pants. The result? Missed deadlines. Frustrated clients and disappointed partners. Not what you desire.
So, give it try. You will find yourself delivering audits on time and on budget.
This post is a part of my auditing series. In it, I take you from the start to the end of the audit process. Click here if you’ve missed my prior posts.
Charles Hall is a practicing CPA and Certified Fraud Examiner. For the last thirty-five years, he has primarily audited governments, nonprofits, and small businesses. He is the author of The Little Book of Local Government Fraud Prevention, The Why and How of Auditing, Audit Risk Assessment Made Easy, and Preparation of Financial Statements & Compilation Engagements. He frequently speaks at continuing education events. Charles consults with other CPA firms, assisting them with auditing and accounting issues.
Session expired
Please log in again. The login page will open in a new tab. After logging in you can close it and return to this page.
Sean, sorry, I did not see this when you posted it. Each year and each client is a project. You can create a template to populate each new audit. There will be differences in each audit, but the basic steps can be built into the template.
After reading this excellent post we’re considering implementing basecamp. After looking at the website and signing up for a trial I can’t stop wondering how you set up projects in basecamp.
Is each annual engagement for the same client a separate project in basecamp or is each client a project and then items and tasks are just updated/archived as the years progress?