Surviving a Project Audit
In the January 2007 issue of PM Network there's an article about project audits. I've never been through an audit probably because I haven't run one of the mega-projects with scopes a mile wide and budgets large enough to buy an island that are the mainstay of auditors. Regardless, I found the article interesting.
Dealing with a Project Audit
According to the folks at PM Network, here's how to react when your project attracts the scrutiny of auditors.
- Document decisions and action items from meetings with auditors as well as how items are resolved to provide evidence of effective internal control.
- Secure a copy of the specific audit work program that defines the scope and objectives as well as steps the auditors will follow.
- Determine the lines of communication between your team and the auditors and how you will delegate tasks, such as responding to documentation requests.
- Encourage periodic meetings with the auditors to discuss their observations and present your viewpoint.
- Make sure auditors know the full story. For example, if company procedures weren't followed, written documentation showing approval for the variance can go a long way in making your case.
- Delegate action plan tasks. Be ready when the auditors follow up -- and they will. Depending on the quantity and severity of the findings, corrective action plans can be time-consuming.
An Audit by Another Name
Even though this high-level list hides a lot of the turmoil that is involved, an audit is likely going to involve these steps.
- Notification through an announcement letter that outlines the audit.
- Review and requests for documentation, such as a project organization chart, a project plan, status reports, and a risk management plan.
- Opening conference with the audit team, project manager and possibly the project sponsor.
- Self-assessment forms about controls, risks, and processes may be given to selected stakeholders.
- Field work, including interviews with stakeholders, observations, and documentation review.
- Closing conference attended by the audit team and the project manager.
- Draft report includes findings, recommendations, and an opinion section.
- Final report that includes management's response to the findings.
- Action plan and follow-up by the auditor on actions taken by management and the project manager.