Fifteen Tools for Efficient Performance Auditing

Fifteen Tools for Efficient Performance Auditing Drummond Kahn Director of Audit Services City of Portland, Oregon Webinar Presented to NASACT September 2010

Web Conferences Are Tough • You can’t see who’s talking • But you can imagine what people might look like!

The City of Roses -- Portland

Portland’s Audit Services Division • www.portlandoregon.gov/auditor/auditservices • City has over 5,000 employees and $2 Billion budget • ALGA member office, follows Yellow Book standards

Greetings! • Thanks for participating in today’s conference! • We’ll have time for questions at the end of the session. • My contact information is on the final slide of today’s presentation.

What’s a Performance Audit? • An objective, systematic examination of evidence. • Makes recommendations to decision-makers and to enhance public accountability. • Distinct from financial audits, which express opinions on financial statements. • Conducted in accordance with standards. • Has significant “barriers to entry”. Not everyone can call themselves a performance auditor!

Barriers to Entry • Economists talk about “barriers to entry” as the rules, logistics, or processes that keep new companies from entering a marketplace easily. • Think about how tough it would be to start up a hospital, an insurance company, or an airline! • Audit “barriers” involve: • External quality control review (peer review) • Continuing education requirement for staff • Independence in fact and appearance • Operational structures like supervision • Reporting structure to those charged with governance

Special and Unique • Performance audits are expensive, since: • Staff are highly-trained (CPE requirements), • Staff are well-supervised (which increases hourly costs compared to less supervision), and • Audits take more time than similar analysis done outside of an audit environment due to our internal and external quality control processes • Not every organization can field a performance audit function. • Government and the public should understand and appreciate the performance audit function.

Importance of Performance Auditing • Auditing has barriers to entry, may cost more than other analytical efforts, and has an important audience of the public and decision-makers! • We need tools to keep this important field timely and as efficient as possible.

Our Overture – Tools for Efficiency • Like baseball, how more “at-bats” can help auditors effect organizational change • From Star Wars to Lord of the Rings, how movie trilogy production can inform auditing • Why the audit process should work more like Southwest than Northwest • Why audits should read more like Hemingway than Michener • Why audit concerns about reporting and timeliness date back to Shakespeare

Today’s Sponsor • 15 Tools for Efficiency in performance auditing • Today’s presentation is brought to you by the number 15 and the letter “E”

Conducting Performance Audits Efficiently • “Efficiency” is the ratio of inputs per output: • Hours spent per audit report • Years spent per audit report (??!?!) • Highly efficient auditors and offices have “traction” to create audit yield with each hour of audit time invested • Core idea: Make each time investment count in your audit office • This work needs to lead to reports! • Public reports help us fulfill the promise of auditing by leading to change and by placing management “on the record” through written, published responses.

Initial Tool Kit • Develop clear objectives near beginning of audit. For unclear or new areas, slate a specific amount of time for survey and don’t exceed it without a “scoping meeting”

Initial Tool Kit • Develop clear objectives near beginning of audit. For unclear or new areas, slate a specific amount of time for survey and don’t exceed it without a “scoping meeting” • Set and stick to a clear scope for the audit

Initial Tool Kit • Develop clear objectives near beginning of audit. For unclear or new areas, slate a specific amount of time for survey and don’t exceed it without a “scoping meeting” • Set and stick to a clear scope for the audit • When scope is fulfilled and objectives are met, write the report!

Initial Tool Kit • Develop clear objectives near beginning of audit. For unclear or new areas, slate a specific amount of time for survey and don’t exceed it without a “scoping meeting” • Set and stick to a clear scope for the audit • When scope is fulfilled and objectives are met, write the report! • Objectives can met and the report can be written, even when literal fulfillment of the objectives is impossible!

Unmet Objectives Can Be Findings! If audit objective can’t be met, that’s a reportable condition. • “Determine which laws govern the State’s practices” – no laws mean that we’ve determined that “no laws govern practices”, NOT that additional audit work is needed right then. • “Determine whether policies are properly reported” – if not, that’s the finding. • “Determine whether agency expenses are properly supported” – if not, that’s the finding.

Determining When You’re Done • In each of these examples, the objective was answered by a lack of data, not by additional audit work. • This time-saving tool simply has us answer the objective and write the report, rather than performing more work to prove a negative.

Whose Fault, Anyway? • “We were unable to determine. . .” can also be worded as “Management may lack the information it needs. . .” – and not just from the report, but from their own mechanisms!!! • Remember that data limitations aren’t the same as scope limitations! (Data not answering your objective is very different from someone restricting your access to that data)

Substitute “Superauditor” for “Auditor” • You’d never see this phrase --“Superauditor™ was unable to determine whether travel claims were supported”! • Try placing responsibility on management, rather than on the auditor.

Managers Manage, Auditors Audit • It’s in Auditing 101: Managers are responsible for managing, while auditors are responsible for auditing. • Shortcomings in the organization are NOT due to lack of data or a shortage of audit information. They are due to management choices. • Keep this in mind while framing findings. • Reports shouldn’t be about the audit process and its difficulties, they should be about the performance of management.

Whose Problem is Missing Data? Consider these examples: 1. “Data on the audit objective was lacking. Therefore, we were unable to conduct our audit or determine the condition that we sought to review” (No Finding) 2. “Data on the audit objective was lacking. Therefore, neither auditors nor management have the information they need to make good decisions.” (Finding!)

Victory from the Jaws of Defeat • In one case, missing data means no finding. • In the same case through another lens, missing data becomes a finding and can guide management to improvement.

Don’t “Limit”! -- “Focus”! • Instead of scope choices reading like limitations, consider wording scope choices as a focus – • “We limited our audit to XYZ” versus “We focused our audit on XYZ”.

Audits Shouldn’t Have Birthdays! • Birthday parties are great for little kids. • Not so great for audit reports. • Audits taking longer than a year to complete put a longer distance between the problem and the report.

Birthday Conundrum • As audit work ages, you might need to repeat work to collect newer data, since the report will now be issued in a new year! • So a report set for 2010 but issued in 2011 would need to “refresh” its 2009 fieldwork. • This is bad.

Really. No Birthdays. • I’m OK if I never have to take another audit report out for a pizza party. • Let’s celebrate concise, focused, early reports. • And let’s only have pizza when reports are released, not just when they turn one or two.

Audit Birthday Avoidance Protocol • Consider the Audit Birthday Avoidance Protocol (ABAP): • Audits should be scoped tightly to take less time (remember that one full-time equivalent auditor spends about 1,500 billable hours per year). • Basic and regular team communication, including update meetings on scope and progress. • Adopt tools to quickly and cleanly decide on message/focus. • Positive organizational change is our goal, rather than only focusing on the report itself.

Blueprints for Improvement • Assign both the responsibility and the positive results of being responsible to management! • Findings are not negative or “gotcha” results – they are blueprints for positive improvement.

Not Bad – 80 to 90 Percent • Many audit offices have 80 to 90 percent implementation of audit recommendations! • An excellent process – auditors suggest improvement, and then management improves! • Audit reporting and results are uniquely bi-partisan!

Missing Data Finding Structure “1” • Condition: Management data lacking or missing • Criteria: To do an audit, we need data as auditors • Cause: We can’t find the data • Effect: Audit on hold or cancelled • Recommendation: None – no published report

Missing Data Finding Structure “2” • Condition: Management data lacking or missing • Criteria: Data was needed to make good decisions (decisionmaking, accountability) • Cause: Too expensive, not available, etc. • Effect: Audit ended early, management proceeding without complete information • Recommendation: Improve data!

Use Everything! • Just like a barbecue can use all parts of an animal, an audit should make the best use of its fieldwork. • Bolster OSM section • Use findings to propel the report • Use “absence of evidence” to show concerns

Boosting “Yield” • Use and bolster an “Objectives, Scope, and Methodology” (OSM) section • Tell the reader about all the work you did • Interviewed officials, reviewed data, analyzed information, compared/evaluated, reached conclusions – using your work to boost yield in the audit report. • This builds credibility and confidence in the report by users because they can “see inside” your work!

Where to Put the OSM Section? • For most audits with straightforward scope and methodology, putting the OSM section near the end of the report is OK, since readers won’t be slowed by it as they review the findings and recommendations. • For audits with extra controversy or anticipated reader concerns, OSM can be closer to the beginning. • Putting OSM earlier in the report is like taking an antacid before you eat a bowl of chili.

Findings and Results Propel Reports • Readers like to see results (which we structure as audit findings) and the conclusion to work completed. • Tips later will discuss writing, but remember that results are most interesting.

Absence of Evidence • As discussed on The X-Files, “absence of evidence is not evidence of absence”. • Lack of data does not mean that a condition doesn’t exist, just that there is no data.

Match Amount of Evidence to Risk • Unusual claims require unusual evidence – the higher the risk of the audit statement, the higher the level of evidence needed. • But reviewers and QC should not require a huge amount of evidence for an ordinary finding.

Lower Risk = Lower Evidence • “Management processes could be improved” requires less evidence than “Management could be improved 73% and save $1,630,022.10.” • More detail and more risk increase the demand on the audit evidence supporting the report.

Use the Information You Find • If management data is missing, report it! • If management can’t use its own information, report it! • If data and analysis could be improved, report it! • If data, processes, and analysis are accurate, report what they show!

Increase “Plate Appearances” • Specific audits on specific subjects are easier to scope, plan, conduct, write, and review! • More specificity = more reports better tailored to each audience

Increase “Plate Appearances” Part 2 • More reports allows your office to show a series of efforts on a topic, rather than bunching different findings into one report. • Each topic can create momentum for change.

More “Contacts” = More Results • Business is big on the notion of “touches” and “contacts” with clients. • Extended to auditing, it’s a good goal to have more contacts with decision-makers, the public, and the media. • Audit reports are the perfect vehicle to do this, but we need more reports to have more contacts!

Which Works Better? • High costs • Had declared bankruptcy • Charged for snacks • Charged for checked bags • Flew fewer, longer flights per day

Which Works Better? • Lower costs • Profitable • Free snacks • Free checked bags • Flies more short flights per day

Which Works Better for Auditing? • Producing just a few large reports and contacts per year? OR • Producing more short reports, leading to many more contacts per year? • “Contacts” include public, decision-makers, media, and other audit report users • More reports may enhance meeting our goal of informing the public and enhancing decision-making

“Quick Response” and Efficiency • Briefly, “quick response” audits limit scope and fieldwork to focus only on the objectives of the audit. • So should all audits!!! • Consider your scope early on – it will dictate fieldwork, writing, and review!

Setting a Clear Scope • The clearer the focus of the planned audit, the easier fieldwork will be and the better you’ll know when you’re finished. • Discuss scope regularly, and whether current fieldwork is still within the planned scope. • Avoid “scope creep”!

Focused Scope, Focused Fieldwork • Summarizing the tools so far, a specific, focused scope can lead to specific, focused fieldwork. • With a clear scope, you can tell when you are finished. • Clear scope makes the report easier to write, helping with everything from the title to the summary to the recommendations.

Focused Fieldwork, Focused Report • Clear fieldwork leads to an easier-to-write report, and a better focus in the report on the important issues. • Deadlines, fieldwork plans, and sticking to them actually helps complete an audit report. • Does focus squelch creativity?

Fifteen Tools for Efficient Performance Auditing