I pop into a popular industry forum from time to time to see what’s on people’s minds and recently saw a pretty typical post in which someone was asking for recommendations for an auditor. The gentleman got several responses but some cautioned about auditors who cross into consulting while conducting an audit. Another poster jumped in with a comment about how unethical it is to consult while auditing. That’s true. Just like you shouldn’t provide instruction while conducting a checkride, you shouldn’t consult while auditing. It’s basically cheating. Either the operator is prepared and meets the audit standard when the auditor arrives or they don’t, right? Further, one fundamental of auditing is that an auditor shouldn’t evaluate their own work. If the auditor gives the operator “the answer”, that’s exactly what happens.
It’s so easy on paper isn’t it? Audit – don’t consult. In reality, it’s a difficult line to walk. I don’t love auditing because I truly enjoy helping people and when I’m auditing I feel like the “bad cop”. Obviously an audit can be conducted in a respectful, friendly manner. There’s no need to be rude or unkind. But it can be hard to tell an operator – especially a company with friendly staff who are eager to do well – that their hard work isn’t quite enough to meet the standard. And they often ask, “What do you recommend?” As an auditor I really can’t answer that except to suggest they re-read the audit standard and any applicable guidance or other references. I can’t “fix it” for them.
The other point noted in the forum was the practice of jacking up a bill by consulting during an audit. That’s a very unethical practice. An audit is a fixed service – typically preparation time, on-site time, report drafting time – and those should all be included in a fixed fee. The time needed to audit an organization can vary based on the size and complexity of the operation but an auditor should obtain those details before they present a proposal. An experienced auditor will have an idea of how long a particular audit will take and should be able to identify a fixed, fair fee. Any auditor that adds on to the bill because they provided additional services during the audit is doing the operator a real disservice.
What if an operator really likes the auditor’s perspective, personality, and skill set and would like the auditor to help with improvements? Certainly some of my clients are former “auditees” of mine, but there’s a professional way to approach this. I thank the operator for their interest but tell them we need to finish the audit process before we discuss additional work. If they need help closing their audit findings, I refer them to a trusted colleague. I stay out of the process until the operator is able to present acceptable corrective actions (or otherwise finish the audit in accordance with the particular audit standard) and I am able to write the report and recommend the operator for the audit registration. Only after the audit process is completely finished am I willing to discuss an opportunity to help the operator on additional projects.
I try to keep the line very clear between auditing and consulting for a number of reasons. Aside from the fact most audit standards (and the very intent of auditing) prohibit consulting while auditing, I despise when unscrupulous consultants create their own work by bringing up issues that aren’t really there. “Your manual isn’t worded exactly as I would word it, but if you hire me, I can fix it.” What is that about? As an auditor, I don’t care if you exercise operational control through iPhone apps and fancy software systems with giant NASA Houston-type screens or with smoke signals so long as your operational control system complies with requirements and is effective.
So here are a few tips from an auditor/consultant to help avoid a good cop, bad cop conflict.
1. Don’t accept a proposal for an audit that includes a variable fee for services outside of the audit itself. Fixed rate + travel expenses = fair proposal. Maybe there’s a situation where a variable rate is appropriate for an audit but seriously – I can’t think of one.
2. It’s cool if you like your auditor and want their expertise after the audit process is done. Save that little nugget until after the audit is completely finished – report accepted by all necessary parties, certification or registration completed, whatever the “finish line” is for the particular audit standard. Then call the auditor and say, “Hey – I like how you think. Would you be interested in helping us with X?” That way no one can question that the outcome of the audit was dependent upon hiring the auditor later as a consultant.
3. Be careful about the types of questions you ask your auditor. Asking “How do you interpret that standard and what guidance materials are available to support your interpretation?” might give you some insight as to what the auditor is looking for if you aren’t sure how to address a finding. It might also reveal the auditor has gone off on their own tangent and isn’t sticking to the audit standard and that’s another issue altogether. But don’t ask, “How would you fix that?” Then your auditor feels like a jerk because they can’t “help.”
How do you ensure a happy audit for your organization?