Blog

Check out my new website intro video at leitahart.com. This graphic I found today summarizes what I was trying to say:
The Difference between Traditional and Modern Learning

 

The Internal Auditing Act in Texas requires that all internal audit shops in state agencies and universities follow both the Yellow Book and the Red Book. Yellow and red make orange. Get it?

Want to know how to implement GAO and IIA standards on an audit project? Attend Essential Audit Skills in Austin in early May. This is the last offering of this course in Austin until Fall/Winter 2013.

Last month, for the Institute of Internal Auditors chapter in Albuquerque, I compared the GAO’s 2011 version of Government Auditing Standards (the Yellow Book) to the IIA’s 2013 edition of the International Professional Practices Framework (the Red Book). It took two days to journey through both standards, and even at that, we only hit the highlights. The GAO’s 2011 version of the Yellow Book is 215 pages including the ridiculous independence flowchart in the back, while the IIA’s 2013 Red Book is 222 pages.

Before all of the knowledge I gleaned from studying and teaching the seminar went to the secret place where the second sock and esoteric knowledge abide, I jotted down a summary of what we discovered as we contrasted the two sets of standards.

Please excuse a few generalities so that I can keep this list as succinct as possible.

1. The GAO and the IIA start from different definitions of who auditors are and what auditors do. The GAO believes that auditors are better described as ‘accountability professionals’ who keep the greater good of the citizenry at heart as they perform their work. The GAO, then, naturally values transparency and holding government officials accountable for their decisions.  And, the GAO’s standards have a decidedly project-by-project focus. On the other hand, the IIA seeks to assess governance, risk, and controls to add value to the entities for and in which auditors work. The IIA does not encourage transparency and takes a wider, holistic, organization-wide view of auditors’ work and role.

2. The IIA’s Red Book asks audit shops to develop an internal audit charter that sets forth their agreement regarding the purpose and power of the internal audit shop. The GAO has no such requirement.

3. The GAO puts up many barriers to auditors being helpful to their audit clients. The GAO feels that performing non-audit (consulting) services compromises the auditor’s ability to objectively and independently provide assurance against their audit objectives. You cannot help make the baby (consult) and then later call that same baby (audit) ugly. In other words, the GAO does not allow you to help create the internal controls that you will later audit because you will lack the objectivity toward the controls you helped establish. But, the IIA actually encourages internal auditors to consult and be helpful and establishes ‘consulting’ standards to assist in that effort.

4. The GAO wants you to document your consideration of auditor and audit team independence using the ‘conceptual framework’ borrowed from the AICPA’s literature. The IIA is nowhere near as formal when it comes to assessing auditor independence and does not require project-by-project documentation.

5. The GAO requires that every three years the auditor’s quality control system, which includes six components, undergo an external peer review. The GAO’s description of the quality control system includes six components.  The IIA requires an external peer review every five years and leaves the structure of the quality control system largely up to the auditor’s judgment.

6. The IIA is much tougher than the GAO when it comes to bragging rights.   Under GAO standards, following every ‘must’ requirement allows you to claim your adherence to the standards once you kick off your first audit.  In contrast, the IIA requires an audit shop to undergo a peer review before claiming in their audit report that they are following Red Book standards. Under both standards, you must disclose when you do not follow a ‘should’ requirement. The GAO requires that you disclose the noncompliance in your audit report, but the IIA is not clear on how or to whom the noncompliance is disclosed.

7. The GAO talks about three types of assurance engagements: financial audits, attestation engagements, and performance audits. For financial audits and attestation engagements, the GAO incorporates AICPA guidance. The IIA simply discusses “assurance services” and does not group them into types or levels of assurance. The IIA also does not formally acknowledge or encourage the use of any other standard. Instead, the IIA talks about the nature of the auditor’s work: internal auditors are expected to focus their efforts on their entity’s governance, risk assessment, and controls.

8. The GAO asks that auditors use the results of prior audits that are relevant to their audit objective in planning the audit. Under Yellow Books standards, a formal follow-up process or statement is not required. Yet, the IIA requires you to follow up on prior audits.

9. The GAO focuses on one single engagement at a time and requires no development of an audit universe or an annual plan. But, the IIA asks chief audit executives to document all of their potential audit subjects and select the riskiest subjects for their annual audit plan.

10. The GAO wants you to design your audit to detect fraud and non-compliance. The IIA asks that you simply be aware of fraud and does not require auditors to perform procedures to uncover it.

11. The GAO asks that auditors write findings when they find fraud, internal control weaknesses, noncompliance, and abuse. The IIA calls reportable conditions ‘observations’ and does not formally recognize noncompliance or abuse as triggers of an observation.

12. When you answer the audit objective on a financial audit or an examination under Yellow Book standards, you opine. When you answer the objective on a performance audit under Yellow Book standards, you conclude. The IIA will let you use either word – you can opine or conclude when answering the objective.

13. The GAO requires auditors to get 80 hours of CPE every two years. The IIA encourages auditors to get CPE, but does not require a specific number of hours.

Is that everything? No. But isn’t that enough for anyone?

I suggest that you also look at the IIA’s guidance regarding the comparison of the GAO vs. IIA standards.

Good luck, my orange fellows. You have plenty to live up to!

If you have any comments, please write to me at Leita@yellowbook-cpe.com I’d love to hear from you regarding whether you agree or disagree with my summary.  I’d also like to know if you found it helpful.

Are you a journalist, monitor, or auditor? Or do you embody qualities of all three?

Journalists

Essential Audit Skills – 16 hours of Governmental CPE in Austin on October 29 & 30. REGISTER TODAY.

The Elements of Journalism: What Newspeople Should Know and the Public Should Expect by Bill Kovach and Tom Rosensteil [1] lays out some inspirational principles for journalists:

Journalism’s first obligation is to the truth.

• Its first loyalty is to citizens.
• Its essence is a discipline of verification.
• Its practitioners must maintain independence from those they cover.
• It must serve as an independent monitor of power.
• It must provide a forum for public criticism and compromise.
• It must strive to make the significant interesting and relevant.
• It must keep the news comprehensive and in proportion.
• Its practitioners have an obligation to exercise their personal conscience.
• Citizens, too, have rights and responsibilities when it comes to the news.

Do you see your higher self in that list, working for the good of the public, striving to be interesting? I did. And then I started thinking about how auditors do not, and cannot, follow those principles.

In September 2012, a newscaster excited his audience with the news that an anti-American activist had died by breathing the smoke generated when he burned our flag. The newsman’s viewing public cheered and hurrahed. There was a slight problem with his story though. Upon investigation, another journalist discovered that the story wasn’t true. It had been completely fabricated.

I can’t imagine an auditor getting in hot water for a similar incident because we are so evidence focused. Our standards demand evidence before we publish.

Journalists also are supposed to get evidence, but they do not follow professional codified standards that demand it. That is one of the reasons, say Kovach and Rosensteil,that we end up with so many opinionated screamers on TV news programs. Some journalists simply take the day’s stories, which hopefully another newscaster supports with evidence, and weave the pieces together to create drama and tension. In other words, journalists don’t have the money or will to do a thorough investigation, so they go for drama and entertainment instead.

Monitors

Monitors might also bypass standards. Monitors in my audiences say things like, “We are following the Yellow Book in spirit.” When I first heard that, I thought monitors were lazy: complying with the easy standards and conveniently blowing off the more complex ones.

But later I realized that is an appropriate stance for monitors to take, as the Yellow Book is written for auditors, not monitors. Monitors have a hard time following the planning standards in the Yellow Book because they often don’t conduct project-specific risk assessments.

Also, monitors work on behalf of management to check nearly every compliance item. They don’t get to pick and choose their audit subjects and objectives, as auditors do.

Auditors

So what defines an auditor? An auditor is someone who is willing to take a subject matter, filter it for what is interesting to his/her users (which may or may not be defined as the public), create finite objectives, and conclude or opine against those objectives using solid evidence.

Check out this matrix:

Journalist	Monitor	Auditor
Loose standards	No standards	Follow professional standards
Work on behalf of the public	Work on behalf of management	Work for those in charge of governance, public
Go to where the story is	Check every compliance item and control	Perform formal risk assessment to choose subject matter
Interest driven	Interest driven	Objective driven
Expose and inform	Assess and help	Assess and report
Independent	Not independent	Independent
Report conditions & compelling effects	Report conditions, seldom effects	Report conditions, cause, and effects

 

Auditors are somewhere between monitors and journalists. Unlike journalists, we are concerned with more than just finding interesting stories. But, we don’t verify that every t is crossed, as monitors do.

And among the three groups, auditors are the only ones following a solid set of standards that guide our work. These standards might slow us down, but they keep us from reporting lies.

Information sharing is more immediate

I wonder whether we will need to take on some more of the qualities of journalism in order to survive. With transparency of information and the constant sharing of facts (or lies) over the internet, will our intense, lengthy process be our downfall? Will decision makers be willing to wait six or more months for us to conclude on an audit project?

Journalists used to spend months on their stories, too. Investigative journalism is expensive and the corporations that own the news outlets are no longer willing to pay. The public seems satisfied with bits and pieces of stories, and bits and pieces aren’t expensive to generate.

Like journalists, auditors are evaluated through the lens of profitability. Some auditors spend agood chunk of their time justifying their existence by calculating cost savings when the risk is a financial one. But, what complicates the issue more is that not every risk is about money.

I see the pressure building as I visit various audit shops. They struggle to be relevant as well as standard based. Auditors have to fight to get additional resources and are often hamstrung and unable to fulfill their mission because management doesn’t support their efforts.

Would we be more interesting and useful to our audience if we moved from jumbo projects to short bursts of information in shorter formats? Could we still satisfy our standards, but strictly limit the scope and report more quickly?

They don’t understand

I hear auditors say, “They just don’t understand what we do!” Since we all know that the only person you can change in a situation is yourself, this might mean we need to deliver something these folks want and need.

It might also mean that we need do a better job by communicating our worth and our methods. If “they” still mistake you for a monitor who checks under every rock and stops to be helpful and improve their processes, or if “they” expect your reports to be sensational and opinionated, then you won’t ever make them happy. Either you must help them adjust their expectations or suffer the resulting lack of support and resources.

---

[1] Kovach, Bill and Rosensteil, Tom. Elements of Journalism: What Newspeople Should Know and the Public Should Expect. New York: Three Rivers Press, 2007.