Reviews provide senior management with insight into their current problems and a view of where they are in terms of risk. The most important element following this is the recommendations, of how to improve the control environment to an acceptable level.
However, we find that this is the area where organisations struggle the most to obtain good value. You’ve paid for a review, but how can you get the most out of it to drive real improvement? We find that recommendations often don’t address the core issues or root causes, are too high level, have impractical timelines, and are regularly generic best practice recommendations that are not applicable to your environment.
In our experience of delivering high impact specialist audit reviews, these are the best ways to ensure you are getting the most out of your recommendations:
1. Conduct a de-brief internally on the recommendations before finalising with the review team. This ensures there is a shared understanding of the action plan, including who is delivering the recommendations, whether they are the right people and there is agreement that the actions are correct and deliverable. Auditors may not have the full understanding of the organisation so their recommendations could be flawed – make sure they work for your organisation first before agreeing them.
2. Debate the right timeline to implement recommendations with stakeholders. If action owners have no view on timeline, it is an indication that they either do not understand the recommendation or are only passively accepting them; this is unlikely to lead to your desired outcomes.
3. A good recommendation is being brave about what you think can or cannot be done. For example, while a recommendation is based on best practice, in reality you do not have the capacity to build the recommended solution. Some risk may be unavoidable – but to minimise this risk, the best thing to do is accept reality so that recommendations have a realistic chance to make an impact.
4. Reviews can identify different methods of delivery that may be better suited for you. Instead of being generic, they use their insight into your organisation to identify latent capability of methods more aligned with your own objectives. Push for practical discussions with the auditors on how recommendations can be delivered.
5. Recommendations should articulate facts in an undeniable way, using tangible, quantifiable evidence. This gives credibility to the nature and size of the risk the recommendation is addressing, which will help on-board wider stakeholders and better communicate the need for action. This will greatly improve the likelihood that recommendations are implemented successfully and you obtain the outcomes you desire.