“I think it makes more sense to have a narrative. When you have templates or checklists, there’s no consistency to the file. You’ll do the top of file work, then the procedures. And then there will be this huge disconnect between the two. One won’t lead into the other.”
A few weeks ago CPAB came to my old firm to do some file inspections. Luckily, one of mine got pulled. I found out a week after the fact as I was talking with one of my old coworkers over gmail chat. I was a little nervous. I hadn’t used a single PEM checklist. The deadline was too soon and the checklists were so thorough that I wouldn’t have been able to fill in every one and complete my file on time. I decided to do something bold. I wrote down all the documentation requirements for the relevant handbook sections I needed and made up my own audit templates. The templates were based on a narrative approach – I wanted my audit to be a story.
My understanding of the business acted as the context of my story and served to introduce its main characters. My risk approach identified the conflicts. And my procedures addressed them. It felt a lot like this (so awesome) choose your own adventure I read when I was 10. Since it was a narrative the audit file had flow. It was even a good read. You could see the tension between the CEO and CFO over certain financing issues. There was a sense of excitement when new issues came up that weren’t anticipated in the introduction to my file. The unforeseen resolution of which, only adding further suspense. And cast in the light of all this was a looming deadline, a double-partner review and an audit committee meeting where I’d be expected to play the, “where is this number from” game.
My file made sense and it was lean. I came in way under budget and I knew the company inside and out. However, this is exactly what raises red flags on a CPAB inspection. And that’s why I was so nervous when I learned it was under review. This was a real test. Fortunately, they liked it. They more than liked it. I guess when CPAB is constantly telling auditors to document everything, a file based on a narrative approach manages to exceed their expectations.
Naturally I got pretty pumped and went to the gym after work to bang out a set of max dead lifts (new pr of 335 booyah!). But it reaffirmed something I often think about. Checklists don’t work. Especially when you copy the ones from the prior year. I honestly don’t care if it saves time. That’s not the point of an audit. These are poor business decisions that step on the toes of quality work. Understanding drives risk assessment and risk assessment drives procedures. How you can say you’re performing a risk based audit when you’re copying the procedures from the prior year? That doesn’t make sense. It also creates the ill opportunity to do the audit procedures first and the planning second. Where the latter is done in such a way to legitimize the work that’s been done; akin to having perfect hindsight.
I was talking with my old coworker about this – checklists versus narratives – after I got the news that CPAB liked my file. He was right, when you use checklists – especially the same ones from the prior year – there will be a huge disconnect in your file. Your audit opinion will likely be justified since you’ve performed enough work. But, it highlights a redundancy in the planning section. It shows that you know the business but didn’t feel like spending the time to design specific audit procedures for that business. It’s lazy work.
I always put in as many narratives as possible.