Reports in Ten Days

When I tell people that at RSA we produced audit reports within 10 days, the reaction is usually disbelief.

Why and how?

The "why" is pretty simple. Audit work is perishable. The longer it takes to deliver a report, the less valuable that report becomes. In an environment experiencing a high degree of change, even 10 days can be too long. Staff or management may turnover, serious control break-downs may occur, and leadership will lose interest if reports take a long time.

The question of "how" is probably more interesting. Some of the key points are:

1. Reports have to be short. We set a standard of no more than 10 pages.
2. Reports have to be easy to write. If the report is a creative writing exercise, it will take too long to write and too long to quality control (QC).
3. Audit work should be front-loaded as much as possible. For example, we'd get insurance claim files sent to us in advance. That way when we hit the ground on-site, we spent our time talking to people and tracking errors back to their source.
4. Workpapers should back up the findings and no more.
5. Brief the management as soon as you have your findings, if they challenge your findings you'd rather have that happen before you write the report.

We used other techniques as well, and I welcome comments on others that will help increase speed of delivery.

Prescott Coleman, CIA, CISA