Auditors
Provide validation, verification and assurance of systems, processes, financial statements, reports and analytical evaluations. Undertake investigative work and provide advice to management on trends, risks and performance.
An audit of the purchasing team
You are an internal auditor at a regional water authority, three weeks into a review of how the organisation buys equipment and services. It is Tuesday morning. You have a pile of purchase records, a meeting with the procurement manager at ten and a draft report due to the audit committee at the end of the month.
Choose what you would do. Then see what happens. There are often good reasons for each choice.
I hear you have been looking at our contracts. We have been very careful and I have a lot on. Can you just tell me what you are looking for, so I can help you find it quickly?
Explain the scope, ask for the records, and say she will see findings first
Sandra relaxes because she knows how the process works and when she will hear about it. A clear process makes people more helpful, not less.
Say you cannot discuss the audit at all until it is finished
Sandra becomes guarded and the records arrive slowly. People who feel in the dark often assume the worst. You can be professional and still be open about the process.
Tell her everything you have found so far, so she can fix it before the report
Sandra is grateful, but you have shared half-formed findings that may change, and she begins to correct records. Openness is good, and so is protecting the independence of the review.
Mate, I heard you are going through the contracts. Nothing to worry about, I'm sure. Can you give me a heads up on what you've found so I'm not caught off guard in the meeting?
Give him a quick hint, since he's a friend and you trust him
Dale mentions it to a colleague, and the story reaches the people involved before you have finished. An audit relies on being fair to everyone, including those not yet interviewed.
Say you value the friendship, explain you cannot discuss it, and suggest he asks you about something else over lunch
Dale takes it well. You have kept the friendship and the independence of the audit. Part of the job is to be trusted by people who do not know what you know.
Avoid him for the next few weeks so it does not come up again
It protects the audit, but Dale feels snubbed and does not understand why. A friendly, honest boundary is kinder than silence.
I have read your draft summary. The finding about the single approver seems minor to me, since nothing is missing. Could we leave it out of the main report and put it in an appendix?
Refuse to change anything and say that it is your report
The finding stays, but the chair feels dismissed and the relationship cools. You were right, and you could have listened to her concern before holding firm.
Agree to move it to the appendix, since the chair has seen the whole picture and nothing is missing
The finding is buried, nobody acts on it and three years later the same gap allows a real problem. A risk is worth reporting before something goes missing, not after.
Explain why it matters, offer to describe it in proportion and keep it in the main report
Margaret agrees once she sees that the report says plainly that nothing was missing. The finding stays visible and appropriately weighted. An auditor's job is to inform the people who decide.
How it went
The final report goes to the committee on time, and the team begins working on the fixes. Auditing is careful reading, honest questions and the courage to say what you found, even when it is uncomfortable. Would you be comfortable being the person who tells people what they might not want to hear?
This is a simplified, fictional situation to help you explore. It is not professional instruction or a test of your ability.
Case study: The approval nobody was checking
A fictional case set in the internal audit team of a fictional regional water authority, reviewing how the organisation spends and buys.
The situation
Chidi Nwosu was an internal auditor at the Clearwater Regional Water Authority. While reviewing purchases, he noticed that a depot manager, Phil, regularly approved orders from one supplier and also signed to confirm the goods had arrived. No one else checked. Phil was well liked and had been at the authority for twenty years. Nothing was missing, and nothing suggested he had done anything wrong, but it was a gap.
What they did
Chidi did not assume the worst. He gathered more records, checked deliveries against the orders for several months and found everything matched. He then spoke to Phil first, explaining that it was a weakness in the system and not a criticism of him. In his report he described the gap plainly, said nothing had been found missing and recommended that a second person confirm deliveries. He sent Phil the draft before it went to the committee.
How it turned out
Phil was uncomfortable but agreed, and said he had never liked being the only check. A second person was added within a month. Chidi said the best audits are the ones where nobody feels ambushed.
What would you do?
- Why did Chidi talk to Phil before writing his final report?
- How would you report a risk when you found no actual wrongdoing?
- What makes a system safer than relying on one trusted person?