How to Kill an Auditor

You can kill an auditor in 10 easy steps. If you’re a manager, it’s even easier. Here’s how:

1. Insist that all periods are followed by 2 spaces. Those days are long gone and so are typewriters. But some managers who review workpapers still insist on this. No kidding!

A little help for non-auditors: a workpaper describes 1) the control being tested, 2) the steps used to select samples and perform the test, 3) the evidence gathered and how it was analyzed, 4) the conclusion, and if the test failed, usually 5) a broad recommendation of what might be done to resolve it.

2. When reviewing workpapers electronically, question an obvious mistake instead of correcting it. For example, I numbered my test steps 1, 2, 3, 5. Just fix it and move on. Don’t waste your time and mine writing things like “is this number correct?” and then sending it back to me to fix it, especially when it’s the only correction in the workpaper. Just fix it! If multiple errors exist, say something to me or send it back and ask me to review all numbers and references.  By pointing out a single error, you are wasting shareholder dollars. I sure hope you feel better now!

3. Demand a workpaper be reorganized because that’s not how YOU would do it. Doing something WRONG is not the same as doing something differently.  Discern the difference and accept other approaches. If you can’t explain to me why my way is incorrect, misleading, or impossible to understand, AND how your method ADDS VALUE, then give it up already.

4. For the same EXACT control, request additional testing be done for system A when you requested less testing for system B. Especially when the only difference is that one systems serves Asia and the other serves Europe; same software version, same hardware, same administrator, same controls, same number of users, same everything… I think you’re forgetting that this “leadership”  frustrates my auditees also, especially when I cannot give them a good reason why I’m bothering them again.

5. Constantly criticize workpapers in general terms, but never give any details or examples as to how to do it differently.

6. Discourage using ACL or other data analytic techniques because you don’t understand them. For more details, see Why not more data analytics?

7. Constantly remind me to do things that I’ve never forgotten to do in the past. I have years of experience. Just because you’re nervous that I won’t CC the CAE and Legal on the final report doesn’t mean I have a problem. Uh, I think YOU have a problem.

8. Insist on a specific testing method, then don’t take the heat when it explodes. Remember the last time you tried to convince your manager he was sniffing up the wrong trail? You feared it would lead to trouble, but he insisted, and then he stayed silent while the fire raged. I sure hope you call him on it, I always do, but in private–embarrassing HIM in public will only bring more problems.

9. Stop by to chat when a critical deadline is looming. And don’t take any hints, especially this one: “I have a critical deadline. Can I catch up with you later?”

10. (My personal favorite) Insist the audit report be created in 3 different formats AND each format be updated each time it’s reviewed/revised. While I understand that some audiences needs more information than others, and some need only summaries, while others need even greater details. But why create and update all 3 versions throughout the project, long before they’re needed? Wouldn’t it make more sense to prepare and update just the most detailed one, the one that has ALL the information the others contain? Then when the detailed report is final,  create and review the other 2?

What other methods do you see managers and others use to menace professionals? Here’s your chance to rant! You don’t have to be an auditor to chime in–managers torment people of all professions :)

Please help me save the world by tweeting this post or printing it and leaving it anonymously on your manager’s desk. When you do that, don’t forget to report back what happened.

Leave a Comment



Filed under Audit, How to..., Written by Skyyler

10 responses to “How to Kill an Auditor

  1. I find myself *removing* the double-spaces after periods when reviewing workpapers. I don’t understand what strange torture people underwent to make them think this is necessary.


    • Krupo,
      They were no doubt taught to type by an “old school” teacher. As irritating as I find this “requirement”, the other items bother me a lot more. But this one bothers me because it is so out-of-date and technology auditors of all people ought to know better.

      One other thing: your gravatar — is auditing like pulling teeth?


  2. coffeeking

    Funny, but some of it is so true.


    • SOME of it is true? Can I come and work with you, where only SOME of it is true? Uh, this isn’t a humor piece, they all really happened.

      I know managers are trying to be helpful and don’t realize they are instead causing issues. But that’s why you gently tell them. The best managers listen and adjust, at least a little bit, whether they think you’re right or not. The other kind of managers you don’t bother telling…

      Good to hear from you, coffeeking. It’s been a while. Thanks for commenting.

      Liked by 1 person

  3. I believe that your manager may be too stupid to review your reports or workpapers.

    Liked by 1 person

  4. Mr. Cow,
    Believe it hard or not at all, but the manager is actually fairly intelligent. He just focuses on the minors a bit. However, he’s good in a pinch. I’ve mentioned a few of these things to him, and he has let up a bit. Yes, he still irritates me, but what boss have you ever had that wasn’t irritating somewhere? Even the BIG S has his faults. Besides, it’s still a good situation.


  5. Pingback: New IT Auditors Should Start Here | ITauditSecurity

  6. Leeann D'Souza

    I like your blog and was hoping since you share tips on how to blog and audit, why not make a post on how to blog about internal audit?

    That would be great.


    • Leeann,
      I do have some blogging posts — under Quick Links in the upper right corner of the blog, click Blogging Tips.

      As to how to blog for internal audit, I just write about:
      -The cool projects I’ve worked on
      -New things I’ve discovered or learned
      -Stupid things auditors, mgmt, and other say and do as I live my auditor life at work
      -Mistakes that I make :(
      -What I do at work that helps (or hinders)
      -Interesting events or cases I’ve been involved in
      -Things I find funny or tend to look at from a different angle that most

      One other thing you need to think about is whether you are going to blog anonymously or as yourself. I blog anonymously, so that means I have to change names, genders, situations, etc., so it’s not too obvious what company or auditor I’m describing.

      If I think of any other tips, I’ll consider putting a post together….
      If there’s some specific questions or situations you’d like me to address, let me know.
      Thanks for commenting.

      Liked by 2 people

  7. Pingback: Blogging about Internal Audit (10 tips) | ITauditSecurity

Leave a Comment

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.