Discover how to streamline internal and external audits in NetSuite, transforming chaos into confidence. Simplify your audit process today.
Audit is one of the few business processes where the amount of work involved is almost entirely determined by preparation rather than by the audit itself. Two businesses of similar size and complexity can have audits that differ by weeks, and the difference is not the auditor.
It is whether the evidence exists, whether it can be found, and whether the numbers were prepared in a way somebody else can follow. All three are decided during the year rather than during the audit.
This article covers what actually makes audits difficult and what to change during the year so they are not.
Auditors do not spend most of their time forming opinions. They spend it obtaining and testing evidence, and the obtaining is the part you control.
Where evidence is organised and traceable, testing is fast. A sample is selected, the supporting documents are retrieved, the calculation is checked, and it moves on.
Where evidence has to be assembled from folders, inboxes and people's memories, each item becomes a request, a wait, a partial response and a follow up. The auditor's time increases and so does yours.
The most expensive pattern is where the evidence exists and cannot be located, because that consumes your team's time as well as the auditor's and produces the impression that the controls are weaker than they are.
Some categories recur across audits and are worth preparing specifically.
Reconciliations for every balance sheet account, with the supporting detail and evidence that somebody reviewed them.
Supporting documents for sampled transactions, meaning the invoice, the approval, the receipt and the payment for each item selected.
Schedules for anything calculated. Fixed assets and depreciation, leases, accruals and provisions, prepayments, revenue recognition where it applies.
Evidence of controls operating, meaning that approvals actually happened, that reviews were performed, and that segregation exists.
And explanations for anything unusual, which is where the auditor's judgement concentrates and where a prepared answer saves considerable back and forth.
The single largest structural improvement, and the same one that shortens a month end close.
Where accounts are reconciled continuously, the audit is looking at reconciliations that already exist, prepared close to the transactions they cover, with differences that were investigated when somebody still remembered them.
Where they are prepared for the audit, somebody is reconstructing a year of activity under time pressure, and the reconstruction itself becomes something the auditor questions.
The specific accounts that matter most are bank, receivables and payables control, inventory, clearing and suspense accounts, and anything with a calculated balance.
A suspense account with a balance at year end is a reliable way to generate audit attention, since it means something was not resolved and nobody knows what.
A distinction that separates businesses whose controls are relied upon from those whose are not.
A reconciliation prepared by somebody is a procedure. A reconciliation prepared by one person and reviewed by another is a control, and only the second can be relied upon in the way that reduces testing.
The problem in most businesses is not that review does not happen. It is that it happens without leaving evidence, so the auditor cannot distinguish it from review that did not happen.
The fix is small. A recorded reviewer and date, whether that is a signature, a system status or a note. Where the reconciliation lives in a system with a review step, the evidence is produced automatically.
The same applies to approvals. An approval given by email is real and difficult to evidence at scale. An approval recorded in a system with the approver and timestamp is evidence.
A practical problem that consumes more audit time than any conceptual one.
Where supporting documents are attached to the transaction they support, retrieving them is instantaneous. The auditor selects a sample, opens each transaction, and the invoice is there.
Where they sit in a folder structure, or in somebody's email, or in a filing cabinet, each item is a search.
Attaching documents at the point of processing is a small habit that transforms the audit experience, and it is available in most modern finance systems without any additional software.
It also has a benefit during the year, since supplier queries and internal questions are answered from the transaction rather than from a search.
Calculated balances are where audits most often expand, because the auditor is testing a model as well as a number.
Where a fixed asset register, a lease schedule or a debt amortisation lives in a system, it reconciles to the ledger because they are the same records, and the testing is about the inputs rather than about the arithmetic.
Where it lives in a spreadsheet, the auditor tests the spreadsheet. Any hardcoded value, broken formula or unexplained adjustment found during that testing expands the scope, and spreadsheets maintained over years by several people usually contain at least one.
That is the practical case for moving these calculations into the system, beyond the ongoing time saving. Our pieces on fixed asset management and lease accounting cover the two areas where this most often applies.
Every audit has a small number of areas where the auditor is forming a judgement rather than checking a fact, and preparing for those specifically saves considerable time.
Revenue recognition, particularly where contracts have multiple elements, variable consideration or performance obligations satisfied over time.
Provisions and estimates, meaning doubtful debts, obsolete stock, warranty, and anything where management has judged an amount.
Lease judgements, meaning the term including options and the discount rate applied.
Going concern, where the business has any characteristic that raises it.
And related party transactions, which are frequently informal and therefore poorly documented.
For each of these, having the reasoning documented at the time the judgement was made is worth considerably more than reconstructing it during the audit, and it is what distinguishes a defensible position from an assertion.
Where an auditor performs interim work, using it properly changes the year end experience substantially.
Interim work is an opportunity to have controls tested and evidence requirements clarified while there is time to respond.
The most valuable output is knowing precisely what will be requested at year end, in what format, so it can be prepared in advance rather than in response.
It is also the moment to raise anything you know is awkward, since an issue disclosed by management is handled differently from one discovered during testing.
Businesses that treat the interim as an interruption get less from it than those that treat it as planning.
Agreeing this properly, in advance, prevents most of the friction.
When the auditor will be on site or working, and what they need available on each of those days.
When your figures will be ready, which needs to be a genuine commitment rather than an aspiration, since an auditor arriving to find the accounts unfinished is expensive for everybody.
Who from your side is available and when, since the audit stalls whenever the person who knows something is unavailable.
And a defined process for requests, meaning one channel with one owner rather than auditors asking whoever is nearest.
That last point is worth emphasising, since uncoordinated requests produce duplicated effort, inconsistent answers and the impression that nobody has an overview.
A practical mechanism that reduces the effort on both sides.
Maintain a single shared list of outstanding requests, with what was asked, who owns it, and when it was provided.
That prevents the same item being requested twice, makes the outstanding position visible, and gives you a record of what was supplied.
It also surfaces bottlenecks. Where one person holds most of the outstanding items, that is visible early enough to redistribute.
And it makes the end of the audit clean, since there is an agreed record of what remains rather than a difference of recollection.
For businesses that have an internal audit function, or that could perform a self review, this is where external audit effort is reduced most.
Reviewing your own controls before the auditor does means findings are yours to fix rather than theirs to report.
The most productive areas are the ones auditors focus on. Access rights and segregation of duties, approval thresholds and whether they are followed, reconciliation completeness, and evidence of review.
Access rights deserve particular attention, since they drift continuously as people change roles and permissions accumulate. An access review comparing who has what against what their role requires is quick and regularly surprising.
Fixing what you find before the audit converts a finding into an improvement.
A well configured finance system removes a substantial proportion of audit effort, and it is worth being specific about how.
Documents attached to transactions rather than filed separately.
Approvals recorded with the approver and timestamp rather than existing in email.
Calculated schedules that reconcile to the ledger by construction rather than by adjustment.
An audit trail showing who changed what and when, which answers a category of question directly.
Period locking, so the auditor can be confident that the figures they tested have not subsequently moved.
And reporting that can produce the analysis the auditor requests without an export and a manipulation.
Each of those is configuration rather than a purchase in most cases, and together they change the audit from an assembly exercise into a retrieval one.
The control that small businesses find hardest and that auditors examine most closely.
Perfect segregation requires more people than many businesses have. The person who raises the invoice, approves the payment and reconciles the account is frequently the same person.
The response is not to pretend otherwise. It is to identify where segregation is absent, implement a compensating control, and document both.
Compensating controls are ordinary. An owner or manager reviewing the bank statement independently. A monthly review of new suppliers by somebody who cannot create them. Payment batches approved by a second person even where the preparation was done by one.
An auditor presented with a documented assessment and a compensating control responds differently from one who discovers the gap themselves.
How a business responds to findings affects both the current audit and the next one.
Take them seriously rather than defensively. A finding is information about a control that did not work as intended, and the auditor is generally right about the fact even where you disagree about the significance.
Fix the cause rather than the instance, since a correction that does not address why it happened means it recurs and appears again next year.
Document what you did, because a finding with a documented remediation is closed and one without is an open question at every subsequent audit.
And where you genuinely disagree, say so with reasoning rather than resisting, since the discussion is legitimate and the record of it matters.
Worth addressing, because it materially affects how audits go and is frequently adversarial for no good reason.
Auditors are not looking for problems in the sense of hoping to find them. They are obtaining evidence to support an opinion, and anything that makes that harder extends the process.
Raising known issues early is almost always better than waiting to see whether they are found. An issue disclosed by management is handled as a discussion. The same issue discovered during testing expands the scope.
Being available matters more than being organised, since a question answered immediately is faster than one that waits three days for the right person.
And asking what would make their work easier is a question few clients ask and most auditors answer usefully.
Audit difficulty is decided during the year, and the practices that reduce it are the same ones that improve the finance function generally. Reconcile continuously, evidence review, attach documents to transactions, move calculated schedules into the system, and document judgements when they are made.
The useful first step is asking your auditor what took the longest last year and what they would have wanted differently. Most will answer specifically and few clients ask.
Our piece on mastering the financial period close covers the practices that shorten both the close and the audit, and managed services covers the ongoing capability to configure the system so evidence is produced rather than assembled.
If your audit is taking longer than it should, get in touch.
