An audit goes badly when the evidence has to be assembled during it.
A compliance audit checks whether you meet legal, industry and internal policy requirements. In an asset-heavy business, the auditor looks at whether items exist, what they are worth, who holds them, and how they were disposed of. Preparation is what keeps findings and penalties down.
The kinds you will meet
An external financial audit examines statement accuracy and the internal controls behind financial reporting. Industry audits such as ISO, HIPAA and PCI each cover their own ground.
Internal audits are the ones that help most. They find the gaps while there is still time to fix them.
What auditors ask for
They sample transactions and ask for the paperwork behind them: purchase orders, receipts, tag assignments, disposal approvals, reconciliation sign-offs.
For assets they will also go and look. A sample gets physically verified against the register. Missing tags and undocumented transfers are the two findings that come up most.
- An asset register with every field filled in
- Approval chains for purchases and disposals
- Physical count results, including the variances
- Access logs and evidence that duties are separated
Before they arrive
Run the assessment on yourself first, against the same control framework. Close what you can, and write down the compensating control anywhere a gap remains.
Give one person the job of handling auditor requests. Otherwise three departments answer the same question three different ways.
Closing the findings
Rate each finding by severity and give it an owner and a date. Then find the root cause, because a finding that gets patched comes back next year.
Track everything to closure in one register that leadership and the audit committee can see.
Written by the team at Ambivo, a business platform that keeps CRM, accounting and ERP on one customer record. This article is general guidance on the topic rather than a description of Ambivo features.