Written documentation of accounting procedures is often given a low priority in the accounting department. Many companies have seasoned employees, who may not need step-by-step directions to complete the monthly close process, prepare account analysis, or complete account reconciliations. In the interest of completing other business-critical tasks, they push updating written procedures to the back burner.

And they drastically increase their risk should a key employee abruptly leave.

Many CFOs have Controllers or VPs of Finance who manage the day-to-day operations of the accounting department. If that Controller were to abruptly depart:

• Would the CFO be able to step in and lead the accounting department without business interruption?
• Are there written procedures to help guide the CFO and accounting team until they can hire a replacement?
• Does the accounting department have a strong enough understanding of the accounting regulations to move forward without their current leader?

Those types of questions point at real financial planning & analysis concerns and business risks that should be moving accounting process documentation from the back burner to front-and-center on the stovetop.

When Employees Leave Suddenly and Unexpectedly

Life is unpredictable! I’ve worked on quite a few client engagements after a key managerial employee was terminated or abruptly left the company. In fact, recently, I worked with a client whose Controller suddenly died in the middle of an audit at the young age of 42! Tragically, this client faced the manifestation of the figurative hit-by-a-bus jokes they’d told each other. To make matters worse, they had no written documentation to support critical accounting procedures managed by the employee nor any written documentation for key business decisions or support for specific recorded journal entries. They also failed to establish cross-training plans.

Facing these limitations, we had to retrieve data from the employee’s computer and conduct interviews with staff and other internal business partners to figure out exactly what was completed by the former employee prior to his untimely passing.

In my consulting experience spanning over a decade, I have observed on multiple occasions accounting teams accustomed to complying to the Controller’s requests, without deep understanding of the accounting regulations or the rationale for the journal entries they recorded. Commonly, when asked why certain journal entries were booked, their answers include “The Controller told me to book it,” or “The Controller handled the details.”

The Hidden Risks of Poor Accounting Process Documentation to CFOs

A CFO facing an abrupt departure from a Controller faces three business risks they might not have considered are related to documentation:

1. The CFO could be taken away from driving the business.

A CFO’s time should be spent identifying new business opportunities, improving financial performance, and maintaining good customer relations. When a key managerial employee departs without leaving adequate written documentation, the CFO typically is forced into guiding the accounting team. This scenario can have a significant impact on smaller companies.

It can also lead to human resources issues down the road. After a CFO is pulled into the day-to-day operations for a few months, the pressure to hire a replacement rises, so the CFO can return to their normal responsibilities. I’ve experienced a few instances where that hiring decision was rushed, and the replacement wasn’t the right fit for the organization. The CFO found himself back in the same high-pressure position in 90 days!

2. Audits could be delayed.

Auditors always request support for account analysis or even journal entries. When the support is not attached or rationale not documented, the audit can extend and create additional audit fees. Without process documentation, auditor questions often cannot be addressed. Creating that missing documentation can take the accounting team away from their other business-critical responsibilities.

3. Regulatory reporting could be delayed.

Companies may have SEC reporting or reporting due to other organizations like lenders. If the recently departed employee was focusing on reporting but not the reporting process documentation, the remaining team members will have to spend time to figure out the complete process. This can lead to delayed reporting and may even force the CFO to obtain late waivers as they research the process.

In instances of delay, the CFO must take on the responsibility of explaining those delays to the President and Audit Committee.

Best Practices for Accounting Process Documentation Projects

Depending on the span and complexity, it can take companies 2 – 12 months to fully document key accounting processes and ensure work completed is adequately supported. This type of expenditure and effort can be avoided when a company invests in allocating time to develop written procedures in advance of an untimely departure.

Below are a few tips for tackling documentation projects:

Create written desktop procedures for all key areas.

Develop a plan to ensure you have written desktop procedures for all key areas. Schedule meetings with the applicable staff and internal partners to review drafts of the procedures to confirm accuracy. Store non-confidential procedures in a centralized location for the accounting team. Set up a secure drive for confidential procedures and provide senior management access to the drives.

Discuss new accounting pronouncements with the accounting team.

Management typically takes the lead on reviewing new accounting regulations and understanding the impact to the company. Once the impact has been determined, review it with the applicable accounting team members so they understand how it impacts the business. Consider incorporating key topics into monthly staff meetings. Spend additional time with the staff person that handles the area to confirm they understand accounting theory and would be able to carry on in the event of an emergency.

Attach support to all journal entries.

During the close process, a company is often up against tight deadlines. It is important to be diligent and ensure that all entries are supported. If adjustments are made after management review, don’t forget to go back and adjust the supporting documentation. Consider establishing a post-close audit process to ensure adequate support is attached to each journal entries.

Cross-train employees.

Identify critical functions within the department and develop a cross-training plan. This is a great way to develop your team and expose them to different areas in the organization while training a back-up for key areas.

A Note About Bandwidth

All the above tips help ensure that if a key employee abruptly leaves, you’ll have adequate documentation for the individuals that will manage the area. This can empower the accounting department to manage any untimely departures, and it can keep the CFO from having to neglect his or her normal responsibilities of driving the business.

If your Company does not have adequate time or bandwidth to spend on written documentation, 8020 Consulting can help. In fact, having a new set of eyes to review and document the process will provide a lot of additional benefit. The consultant will also can help highlight opportunities to streamline current processes, making it well worth the investment. You can click here to contact us for more information.

About the Author

Kim is a CPA and PMP with more than 20+ years of diverse financial reporting and accounting leadership experience. She is an Arthur Andersen alumnus with extensive experience in accounting operations, inventory accounting, supply chain operations, project management, process reengineering, systems implementation, policy and procedure development, training development, internal controls and audit. She has also served as Interim Controller and led accounting teams through the monthly close and external audits. Kim has industry experience in pharmaceutical, retail, manufacturing, distribution, technology, banking, family investment and telecommunications at companies including The Disney Stores, Countrywide Bank, Data Direct Network, Silgan Containers, Fandango, THQ, The Rockefellers and Bristol-Myers Squibb with global assignments in the USA, Europe and Asia. Kim holds a Bachelor of Science in Accounting from Syracuse University.

Preparing for your first financial statement audit can be a daunting and nerve-wrecking task. What is a most recent financial audit time line? Some companies often don’t know where to begin, so they spend countless hours preparing things that are not applicable for the audit and put unnecessary strain on their time and resources. If your company is not properly prepared, your first financial audit can be a very arduous and expensive task.

In this blog, we’ll cover what to expect as well as best practices for your first financial audit, so you’re ready if you need to be.

What does a financial audit look like?

The most common reasons why companies engage in financial audits are when:

• The company is positioning itself to go public in the future
• The company is marketing itself to a potential buyer
• The company is required to provide it for debt requirements
• The company is required to provide it to the Board of Directors.

The length of an audit can vary depending on the size of the company and whether there are necessary preparations made, but on average, an audit takes about 1-3 months to complete.

The first thing you should do when engaging in the audit is to do a thorough evaluation of your company’s current financial and business situation. If you consider your books to be well organized and compliant, you can start looking for CPA audit firms. If your books are not ready, it may not be good timing to engage in an audit.

You can breakdown what is a most recent financial audit time line into three major phases:

1. Planning & Preparation

In this phase, you’ll set objectives and a timeline for the audit by meeting with auditors. You’ll subsequently define the audit deliverables. The result of this phase is the Prepared/Provided by Client (PBC) list, which is a list of items the auditors will expect prior to the start of the fieldwork phase.

The planning and preparation phase typically starts one to two months before fieldwork. Up until the fieldwork phase, your company’s accounting and reporting teams would compile the information that the auditors request. (For planning advice, review our financial audit checklist.)

2. Fieldwork

After the planning phase, the auditors are at the company’s site conducting substantive testing over the financial statements and internal controls. They may review and perform testing on important records, accounting and other information systems. The auditors will likely need back-end access to your financial systems, so you should be ready to get your IT group on board—or even conduct an IT audit—as well.

This phase requires a lot of face-to-face interaction with the auditors. They will ask questions about the business, conduct walkthroughs of your internal control processes, and ask for supporting documentation. The process can take anywhere from a few weeks to a couple of months.

3. Final Reporting

After the auditors’ testing is complete, they provide a report or opinion on their findings of the audit. This would be their conclusion on how the company adheres to accounting standards.

Please note that the auditors’ opinion may positively or negatively impact the organization, so it’s important to obtain the best opinion possible. The range of opinions varies depending on the auditors’ assessment of the company’s financial statements, but an unqualified opinion is the best outcome. If your company receives an unqualified or “clean” opinion, pat yourselves on the back for a job well done! If your company receives anything else, then you’ll need to make many improvements and changes after the audit to adhere to standards.

How do you practically prepare for a financial audit?

Now that we’ve covered the general flow of a financial audit, let’s dig into how you can prepare for one, and what you can expect throughout the course of one. We’ll cover these in terms of the three phases we outlined above.

Planning & Preparation: Preparing PBC List Items

After the planning meeting with the auditors, make sure to ask for the PBC list as soon as possible. You’ll also need to get a clear understanding of the substance of requests and the format that the auditors would like to see. If you’re unsure, you can always ask them for an example, and they generally would be happy to send it to you.

To the extent you can, prepare all the items before the auditors arrive for fieldwork. Ensure that all general ledger supporting schedules and details ultimately tie out to the financial statements presented.

Items that are typically included in the PBC Listing are:

• Variance Analyses: Comparisons of significant activity between the comparative year ends presented on the financial statements
• Lead Sheets: Reconciliations of trial balances accounts to the financial statements
• Asset/Liability/Equity Rollforward Templates: Schedules showing the movement within an account

Planning & Preparation, Fieldwork: Allocate Appropriate Resources

You should appoint an appropriate main contact to manage the PBCs and the overall timeline. This person would be the liaison between the accounting staff and the auditors, so this person will need to be comfortable operating at a technical level.

The practice of assigning one point of contact helps maintain a consistent message to the auditors. The last thing you want is confusion and wasted time because of miscommunication or misunderstanding. Furthermore, it helps take some of the pressure off the team’s normal day-to-day activities, which can help you maintain a more cost-effective audit process.

Fieldwork: Communicate Continuously and Ask Questions

We recommend keeping an open line of communication with the auditors and your internal team. An audit cannot only bring up technical accounting issues, but also business operation issues, as they are interrelated. Continuous communication will help you assess the audit’s status and get ahead of any major issues. It also allows you to bring valuable insight and aid the auditors in completing their audit.

This will also be a time for the company to improve processes from lessons learned. By communicating throughout the process, you can turn what’s typically a stressful experience into a constructive one. You can learn what they’re seeing and start considering how to improve, even before the final reporting phase.

You can always ask questions to the auditor in advance about the proper accounting treatments for new or unusual transactions. This could prevent material adjustments and save time and effort to correct them as you move forward out of the audit.

Final Reporting: Debriefing and Learning for the Next Audit

After final issue of the audit report, it is good to have a post-audit meeting with your team to communicate results and solicit feedback. Discuss what went well and where there may be opportunities for improvement in the next year’s audit.

In practice, it is uncommon to see any other opinion than unqualified for the final report. However, if your firm receives a negative final report, then there may be indications of inherent infrastructure problems within the company, such as fraud or weak internal controls, that you may have to deal with. Also, a negative audit report could indicate to potential investors or creditors to stay away from doing business with your company, which would be difficult to explain to your Board of Directors.

What can you do now to stay ready for an audit?

With new regulations and complex accounting standards that are emerging every day, audits have become a more complex and cumbersome undertaking. However, an audit won’t be such a nuisance if you have the appropriate resources in place. Once there is a determination made to have an audit performed, assess the financial condition of your company and the appropriate resources that you can spare.

If the things discussed in this blog feel new, unfamiliar, intimidating, or overwhelming, we recommend that you receive help getting set up for it. 8020 Consulting has dedicated subject matter experts in various industries who can help you through the audit process from beginning to end. You can contact us to learn more about our audit services. You can also subscribe to our blog and keep up to date on how financial reporting and accounting best practices can improve your enterprise.

Want More Insight?

If you’re interested in financial reporting and analysis solutions, then consider downloading our new whitepaper. It offers insight into keeping up the reporting pace while waiting on longer-term systems implementations:

About the Author

Laurie Lee is a finance and accounting leader with over 12 years of experience in roles requiring expertise in controllership, financial reporting, treasury operations, system implementation, and audit. Her expertise centers around GL and month-end close management, financial analysis, financial modeling, SEC reporting, process improvements, and financial and compliance audits. She is a PricewaterhouseCoopers alumnus who has held managerial and leadership roles at Fortune 500 companies. These companies included Toyota Financial Services, CBRE, and Paramount Pictures. Laurie is an active CPA and holds a BA in Business Economics with Accounting minor from the University of California-Los Angeles.

What is an IT audit? It’s a commonly misunderstood, all-too-often under-appreciated part of doing business in an increasingly high-tech, data-driven economy. As financial functions rely more and more on technology, public and private enterprises of all sizes will need to shore up the weak points and faulty logic in their accounting and reporting systems.

What are the usual reasons behind financial and IT audits, and how do those reasons differ?

Financial audits are usually regulatory in nature. Most public companies are familiar with the Sarbanes Oxley Act (SOX) and its requirements for Internal Controls over Financial Reporting (ICFR), since they put out information that heavily affects investors’ decisions. Likewise, most private firms recognize the need for financial audits. They’re not always required by law, but contractual obligations and best practices mandate that you ensure the accuracy and completeness of your financial statements.

Back to what is an IT audit. An IT audit ultimately assesses the accuracy and validity of the input (i.e., raw financial data) that is used to create an output (i.e., financial statements). For that reason, internal auditors will typically conduct their IT audits alongside their financial audits to make sure the information that’s feeding into their financial reports is correct.

Publically traded companies almost always conduct both types in tandem, but the same process makes sense for non-public firms. It’s just good practice because IT is the business, and the more you use technology, the more you rely on IT in your financial function. Overall, I wouldn’t really say the reasons behind the different types of audits differ, so much as they go hand-in-hand.

What do companies stand to gain by conducting thorough, well-planned IT audits? What do they stand to lose by neglecting or avoiding the process?

One of the main things they stand to gain is continuous improvement to their financial processes and procedures, and that’s relevant for any business. They’ll also improve their ability to proactively identify where their systems are vulnerable, so they can prevent mistakes or malicious actions from happening in the first place.

If a firm neglects or fails to optimize their IT processes, they leave themselves open to all manner of breaches, incorrect calculations and unauthorized actions. I’ll use a few use cases to illustrate.

Consider user access reviews – a critical part of IT audits. These reviews ensure that whoever can edit a given part of a system actually has the clearance to do so. User access is a big deal for employees who have left a company, and their permissions should be entirely removed from their employers’ computer systems. However, I’ve seen cases where they could still access financial data and use their company email addresses, which exposes a firm to all sorts of unauthorized requests and permissions, both internally and externally.

I’ve also seen a case where an employee had undue access to customer billing information. She changed rates for a big group of customers, and while her actions weren’t malicious, it took a great deal of time and labor to correct her mistake. All of that downstream work could have been avoided if a thorough audit had revealed her inappropriate access.

Finally, some IT errors do lead to fraud and theft. I’ve seen a $10,000 case where an employee had too much access to credit card information. She was putting customers’ refunds on her and her family’s credit cards, and they were caught when their company conducted a thorough review of transaction flows.

What are some of the important characteristics of an IT audit, and in what ways do IT and financial audits differ?

Most of the time, financial audits are heavily focused on your policies and procedures, and they’re very manual. For instance, a company might have a policy around issuing credit to customers. If a statement included a credit, the audit would uncover who made the request for the credit, who issued it, who authorized it and whether or not those employees had the proper clearance to make those decisions. Ultimately, the process heavily relies upon certain employees going back and reviewing other employees’ work.

IT audits differ in three important ways. First, there’s the critical concept that just because someone won’t do something doesn’t mean they can’t. IT systems are supposed to remove the risk that users will take unauthorized actions, but in many cases, the wrong people are given the wrong access and permissions. It’s not sufficient to believe that a certain user won’t make a certain mistake; the fact that he or she can make that mistake is the problem. As we illustrated before with the user access cases, IT audits are critical for uncovering these oversights.

Second, you have a different concept of materiality with IT audits. A financial auditor might not investigate every two-figure abnormality on a financial report – or any of them – but the IT problems that create those small errors tend to be cumulative. Whatever coding or logic error leads to a $50 loss in revenue can snowball into a six-figure mistake if it’s not fixed fast enough. For instance, a problem with the payment logic for a subscription product might automatically renew customers without billing them. If that faulty process continues for days, weeks and months, those losses become significant, to say the least.

Third, you have to make sure you uncover all of the points in your system where data can be changed. Using a bank as an example, the official channels for altering customer data might be an online banking portal and an administrator panel – just two points. But in reality, there are probably many more backend routes that the banks’ employees use to make things easier when helping customers. Whether or not any abuses have occurred, these are the kinds of unofficial access points you need to either patch up or incorporate into standardized workflows.

Overall, what are the most important points for firms to consider as they plan and implement IT audits in conjunction with their financial audits?

First, stay on top of user access. Cybersecurity has become more and more a topic of discussion for the American Institute of Certified Public Accountants (AICPA) and internal auditing boards. The more risk we have with cybersecurity, the more you have to stay on top of user access.

Next, don’t just look at an IT audit as a public company problem or initiative. Regardless of whether or not you go through a complete, mandatory financial audit, you’re still basing your company’s livelihood on your financial IT system. It’s in your best interest to do the audit!

Finally, understand that IT audits don’t need to be extremely costly, time-consuming or scary. With the right upfront planning, you can efficiently identify the weak spots in your systems’ logic and code. Focus on finding out where data can be changed, who can change it and how the system treats that data once it’s been entered.

If you’re considering implementing IT audits at your firm, or if you need to optimize your current auditing process, contact us. You can also learn more about process improvement in our free guide: