Training Auditors

Tuesday, 17 April 2018 00:00 Nick Sanders
Print

As busy season winds down and financial statements are signed-off, efforts to prepare the annual proposal to establish final billing rates get going in earnest. For many of us, we have to finish the final cost scrubs and get our ICE Schedule information together while at the same time supporting audits of prior years’ costs.

While supporting financial statement audits.

While supporting other audits and taskers from management.

We don’t complain about the multi-layered workload; it’s just business as usual, right? Do the work while supporting audits of the work that was previously done. That’s our world—especially in Q1 of any fiscal year. We deal with auditors—who are often performing multiple concurrent audits—while working to meet submission deadlines so that our submissions can become the focus of future audits. It’s what we do.

Now seems an appropriate time to reflect on the training of auditors.

We all train auditors, don’t we? We train our external financial statement auditors and we train our government contract auditors, and some of us train the internal auditors. Most people know how to audit but fewer people know what they’re auditing. We have to help them along.

It’s part of the deal.

Let’s take DCAA, for example. The auditor(s) show up and they need to understand how you do business. They can’t assume they already know your company’s practices, because every contractor is a bit different: every ERP system implementation is a bit different; decisions regarding what costs are direct and what costs are indirect are different. Pools and allocation bases differ. Practices and procedures and guidance differ. So the auditors ask for your policies and your procedures, and you give them the documents (assuming you have them). Then they ask for a “walk-through” which, to be honest, is of minimal value, but it’s a required step. Then (in theory) the auditors pick some transactions and test those transactions against what you’ve told them you do.

But sometimes that’s not enough, is it?

Sometimes you get a junior auditor who needs a bit more help. Sometimes you get a senior auditor who has made certain assumptions that turn out to be invalid for your company. Sometimes your company’s system is wildly complex and it simply would not be reasonable to expect an outsider to gain an understanding of how it all works in just a few days. (Sometimes your company’s system is so complex that most of the employees don’t understand more than the basics.) You need to do more than walk-them through your system and/or your implementing practices; you need to actually give them training in how the system works. You need to make an investment in your auditors, an investment in terms of time and resources, so that they can understand your system enough to make the right findings.

This situation is not limited to DCAA auditors. It applies to your Big 4 auditors and your next-tier auditors and your internal auditors. It applies to any set of auditors who walk into your company and then have to opine on what they see. If they don’t understand what they see, they can’t reach good opinions; at least, they can’t do so easily.

Sometimes you need to train your auditors in the nuances of your system(s), just so they can pick the right universe from which to pick representative transaction samples. You need to take them beyond Introduction to Our System and into more advanced topics. Which takes more time and resources.

But it’s an investment, right? It’s an investment in your auditors, so as to prepare them to efficiently perform their audits and reach the right conclusions. If they do that, the audit support effort is (generally) lower. Silly disputes are avoided. They get to the right conclusions and they get there faster. And if all that happens, then you have time to work on all the other stuff that's getting moldy in your in-box. That’s the return on the investment of time and resources.

If you train your auditors, you get an ROI.

At least, that’s what we tell ourselves. But is it really true?

The problem with training your auditors is that too often they don’t stick around to use that training.

Let’s take the outside auditors, for example. It’s true that you can get a Staff Associate this year who becomes a Senior Associate in a couple of years, who then (perhaps) eventually becomes an Audit Manager. You meet them in Year 1 and by Year 5 you’re LinkedIn buddies. That is a real possibility: you can get long-term continuity on your audit team. But it won’t last. Sooner or later the audit team is going to turn-over. The Manager is going to get assigned to another audit client. The Partner is going to rotate off. Over time, you will have 100% (or more!) turnover. You will have new auditors. And the new auditors are going to need the same training you gave the old auditors. Further, even if you are lucky enough to get long-term continuity in some of your audit team, the rest of the team will need training. The Manager isn’t going to train the new Staff Associate in the nuances of your system; they don’t have time for that. So it’s going to be your job to train that young person who just graduated from college last year in the intricacies of your system and your implementing procedures and practices.

In other words, it is almost certain that you will be continuously training your auditors. You need to know that when you calculate the ROI. The investment in auditor training is unending. You will never stop training your auditors and therefore the investment is higher than you would like it to be; and the return on that investment is lower than you would like it to be (because a robust proportion of the auditors you trained won’t be there to use that training next year).

The situation is not limited to your financial statement auditors. It applies to any auditors you interact with. Let’s go back to DCAA. You’ve done your walk-throughs and you’ve given the auditors your command media (policies, procedures, practices, instructions). You’ve done the Introduction to Our System thing and perhaps you’ve also done the Advanced System Stuff course and the System Nuances, Exceptions, and Weird Stuff course. You’ve invested considerable time and effort in training your DCAA auditors to understand what they need to know about your system—taking time away from other pressing matters (such as preparing that proposal to establish final billing rates) in order to help them understand what they need to know. The DCAA audit team is as prepared as you can make them.

And then everybody you trained gets reassigned.

The Audit Supervisor gets promoted and transferred to a new FAO. The Audit Lead is pulled-off to work demand assignments. The auditors are reassigned to work different audits that have no overlap with what you just trained them in.

And the new audit team that shows up next year knows zero about your system(s). You get a new Assignment Letter from a new team—and the first thing they want is a walk-through, followed by submission of applicable command media. You have come full circle and are starting fresh with people who want to understand your system(s).

This is the auditor training conundrum.

The more you train, the more you have to train. You will never be done training.

If you are looking for an ROI on that investment in auditor training, it may not be there. By the time you’re done training, it’s time to start training again.

That doesn’t mean you shouldn’t train your auditors. You need to train them. But what it does mean is that you shouldn't train them too much. You shouldn't train them any more than you absolutely need to. Minimal training only. They need to understand the system(s). And that’s about it. Forget the Advanced System Stuff and the nuances and the weird stuff. If that stuff comes up during the audit, then deal with it. But don’t try to prevent it from coming up through deep training. Deep training is a wasted investment without a return.

Again, this situation is not about DCAA or about your Big 4 auditors. We think this situation applies to every auditor with whom you interact. Be careful about giving them too much training because, chances are, they won’t use that training ever again.