This may be hard to swallow, but audit findings are really about improvement, not judgment. A finding isn’t a report card that details your organization’s demerits, and it’s not a statement that says your management team is failing at its job. Findings and management letters are, in fact, essential byproducts of the audit process. They reveal helpful information you can use to protect your organization from risk and tighten controls.
It may be tempting to respond to a finding with indignation and defensiveness, but that approach doesn’t do you much good. Yes, findings are public information and you want to protect your reputation, but graciously acknowledging the issue, accepting responsibility, and outlining a corrective plan all go much further in building a collaborative relationship with regulators and earning public trust. A position of cooperation serves your organization best.
Considerations when crafting a written response to a finding
There are three very common audit findings, and if you’ve recently received one, it probably falls into one of these categories:
- Findings related to deficiencies in internal control over financial reporting as required by Statement on Auditing Standard (SAS) 115 or the Government Accountability Office’s (GAO) Government Auditing Standard (GAS). These findings are often identified through a test of design or effectiveness over internal controls and must be reported.
- Single audit findings related to internal controls and compliance requirements from federal funding under the Uniform Grant Guidance. These findings are similar to financial statement findings but relate to compliance with federal regulations.
- Management letter that may detail an area of concern not quite deserving of a finding and offering business advice or opportunities for continuous improvement. These are private, unpublished documents.
You fundamentally have three ways of responding:
Agreement and corrective action plan
If you agree with the audit finding, simply say so, then move on with a corrective plan of action. Identify the individual responsible for the plan and the anticipated completion date. You can take more time to thoroughly resolve complex findings, but it’s best to pledge an earlier completion date for simple issues. Show that you are committed to fixing the issue sooner rather than later.
Your corrective action plan should identify how the changes will prevent reoccurrence in the future and what remedial controls will be implemented in the interim. Overall, your response should provide enough detail to satisfy anyone reading it that your plan is sound and specific. Your auditors must conduct follow-up procedures in the next audit period, so be sure to document any corrective actions and steps taken during the year.
Disagreement
When you disagree with the finding, proceed with caution. If you dispute it or offer the defense that no issues have historically been reported in previous audits, you raise a red flag with oversight agencies, especially if the finding is related to federal funds. And if you express disagreement, your auditor must respond with further explanation of the finding, essentially rebutting your statement, which may serve to strengthen the case for the finding and invite further regulatory scrutiny.
Each finding includes a process stage that allows you to clarify or remediate it and identify the laws, regulations, standards, or best practices that your organization should better comply with. That occasion will be your chance to debate or express your opinion; in other words, your written response isn’t the best place to argue the facts of a finding.
Of course there are times, though, when your disagreement is valid and substantiated. Make your case thoroughly and clearly, providing specific, solid evidence for your challenge to the finding. Be dispassionate, respectful, and matter-of-fact in your tone.
No response
You aren’t required to respond, but your silence could be viewed as failing to take the audit process seriously and showing resistance to feedback. Some people may question your organization’s sense of stewardship, responsibility, and accountability.
When an auditor issues a finding under government auditing standards but does not receive a management response, the report must indicate that management was provided a reasonable time for response and state overtly that you elected not to comment. In such cases, governance or oversight agencies may ask you why you chose not to provide a written response and inquire about what your organization is doing to address the finding. If that happens, you’ve essentially deferred your response, and now you’ll have to give it directly to a regulating body rather than the auditor, sparing yourself no effort and inviting further review. This isn’t recommended.
How we can help
A thoughtful, written response to an audit finding or management letter shows that your organization is open to constructive review, willing to take positive action to strengthen controls, and strives to be a good steward of the public’s resources and trust. CLA’s federal and state and local government, nonprofit, and higher education industry professionals can help you identify the best course of corrective action, build a solid control environment, and effectively communicate your plans to auditors and members of your organization.
Given the content you provided, it's evident that you're delving into the intricate world of audits, specifically focusing on audit findings, their significance, and the appropriate responses to them. Drawing from my expertise on this topic:
-
Audit Findings as a Tool for Improvement: Audit findings are not meant to be punitive measures. Instead, they are diagnostic tools designed to identify areas of potential risk, inefficiencies, or non-compliance within an organization. I've seen numerous instances where organizations transformed their processes and controls after understanding their audit findings.
-
Types of Audit Findings:
- Deficiencies in Internal Control over Financial Reporting: As mentioned, these are rooted in standards like SAS 115 or GAS. These are crucial because they pertain to the integrity and accuracy of financial reporting, ensuring that stakeholders receive reliable information.
- Single Audit Findings: These are particularly relevant for organizations that receive federal funding. Ensuring compliance with federal regulations is paramount, and any deviations can result in significant consequences.
- Management Letters: While not published, these letters provide organizations with valuable insights and recommendations for improvement, often highlighting areas of potential growth or efficiency.
-
Crafting Responses to Findings:
- Agreement and Corrective Action Plan: Taking ownership of findings demonstrates accountability. A robust corrective action plan not only addresses the immediate concern but also implements measures to prevent recurrence, showcasing foresight and commitment.
- Disagreement: While disagreements should be approached cautiously, organizations must provide evidence-based arguments. Being confrontational without evidence can jeopardize relationships with auditors and oversight agencies.
- No Response: Silence can be detrimental. It suggests a lack of concern or acknowledgment, potentially leading to increased scrutiny and challenges from regulatory bodies.
-
Collaboration with Experts: Leveraging the expertise of professionals, like those from CLA’s federal and state and local government, nonprofit, and higher education sectors, can be invaluable. These experts offer specialized knowledge, ensuring organizations navigate audit processes effectively, address findings appropriately, and uphold their fiduciary responsibilities.
In summary, the audit process, particularly audit findings, serves as a catalyst for organizational improvement. Embracing findings with a proactive mindset, collaborating with experts when necessary, and crafting thoughtful responses are pivotal steps in fostering transparency, accountability, and continuous enhancement within organizations.
