Coordination with External Auditor

Although the external auditor is not part of Management’s core team, close coordination with the auditor is critical to the success and the cost-effectiveness of the Sox program.  The External Auditor should be involved in every phase, starting with planning, to maintain a mutual understanding of Management’s approach and the auditor’s expectations.  If left to work independently, external auditors will also spend significant time performing Risk Analysis and scoping evaluations, often with different conclusions than Management, thus resulting in more time by all parties to reconcile those differences.

Close coordination will reduce the number of hours the auditors will need to incur to perform their audit.  Auditors are permitted, even encouraged, to rely on the work performed by Management to perform its assessment.  However, in order to do so, the external auditor will have to understand and agree with Management’s approach.  That means agreeing with the Risk Assessment, scoping decisions, control design and audit procedures.  Keeping the auditors involved throughout that process will avoid having them independently develop their own positions which might be difficult to modify later.  If auditors are “on board” with Management through each phase, their level of direct effort can be significantly reduced.  One place this is most evident is the test of operating effectiveness.  If the auditors agree with the control design, Test Plan and Audit Program, they can rely heavily on the work performed by Management Testers.  If they do not, however, they will likely incur significantly more time developing and performing their own testing procedures; this could also result in Management and the Auditors reaching different conclusions on the effectiveness of Key Controls.

The Precipio Group has extensive experience in the coordination of Sox efforts between Management and external auditors.  We can help establish positions to be presented to auditors to promote conformity and to help soften the sometimes aggressive positions auditors may take in the absence of a well reasoned and documented case from Management.