Surviving an Internal Audit - Part 2

Facility Managers and Construction Managers


The auditors will form perceptions of you and your operation very early in your relationship. If they perceive that you are doing things right or wrong – the outcome of the audit will most likely follow that early perception. So how do you cause your internal auditors to form a good perception of you right from the get go? Here are 3 best practices:

Best Practice 1 – Tell the truth

Even the most gifted liars get caught. Google Bernie Madoff if you want more on this topic. For most normal people, lying does not come naturally. If you start to lie, it will catch up with you. Keep in mind the audit team is trained to spot people that aren’t telling the truth. If you lie once, you brand yourself as a liar and it’s hard to recover.

So Best Practice 1 is the same thing your mother told you as a kid. Tell the truth. Even if it’s bad news. Honest mistakes, problems, issues, things that went wrong – those are all better than lies.

Best Practice 2 – Make information readily available

The auditors will ask for documentation. Lots of it. The more direct access you can give the auditors to that information, the better their perception will be. They will think that you have nothing to hide. They will think that you are well organized.

If you require auditors to go through a step or series of steps in order to get documentation – they will surely wonder why. If you have to go back into some room and pull documents – they will wonder, “what else is in that room.” If you just give them direct access, they won’t wonder at all.

I participated in audits where we would show up, and all of the information would be neatly organized in boxes on the conference room table with a directory listing where to find everything. We immediately think, “this is going to go well.” The other extreme is when we would ask for information and we had to wait hours or days – We would think that the information did not exist, or that it was bad and we would scrutinize that information.

Even if you provide access, it’s also important that the information be neat and well organized. If you cannot easily explain to the auditors how to find information, they will assume that you yourself can’t find information if you need it.

Best Practice 3 – Demonstrate your systems and controls

To an auditor the documentation is the output of a good process. They review documents, but they are more interested in validating that you have a good process in place to comply with the policies, procedures and regulations. To demonstrate that you have a good process, you should be able to:

• Produce process documentation. Do you have flow charts or other documents that explain your processes? Can you pull these documents out and speak intelligently about them?

• Articulate the process very clearly. Can you tell stories about the process and when it worked well or even when it didn’t work so well? If you can’t, you probably don’t follow one.

• Demonstrate your training process. Do you have documentation in each employee file that demonstrates that they were trained? Do you have training materials?

• Demonstrate controls. Do you have controls in place to enforce your process? It’s one thing to say that you require something to occur – but how do you enforce it?

FYI – “Hope” is not a control strategy.