Every auditor and audit firm has different processes in place for communications. There are more formal communication stages, such as preliminary meetings and meetings at the end of the audit regarding results. The rest of the communications are more ad hoc. Depending on the size of your audit, you may have an audit team at your offices from a day to several weeks. Hopefully, your point of contact at the firm will introduce you to the day-to-day contact for your audit. There are 4 major levels of seniority at audit firms:
- Managers (and senior managers)
- Partners, Shareholders, Principals, etc
The senior is usually your day-to-day contact. They are the day-to-day project managers of your engagement. You will likely communicate with them the most.
The staff are entry level employees that are just learning the ropes. Staff will do most of the detail testing work, and may have the most transaction level questions while performing testing.
The managers are usually seen the most at the beginning and the end of the audits. They are there to make sure the planning phases go correctly and the audit is completed. The managers will also review all of the work prepared by the staff and seniors, so once they start reviewing, expect more questions. Typically, you won’t see the managers during the engagement as often. If you do, it may not necessarily be a problem on your end. Managers could arrive during the middle of the engagement for all kinds of reasons such as: just stopping in to see if staff or you have any questions, get a jump start on reviewing work, the senior had a technical question in an area that (s)he is unfamiliar with, there was a testing exception that can be easily mitigated, your site was close to another meeting for them and they needed a place to work for a couple of hours between meetings, the senior is sick and (s)he is filling in as the senior for a period of time, etc.
The partner is usually the person that convinced you to have your audit done with the firm you selected. You will see them during the sales process, the initial audit, and at your board meeting (or audit committee meeting) where (s)he will present the audit. Many times partners will come during field work, but like managers, it may not be a bad thing.
Each firm will have a different process for how you should send them documents. Many firms now maintain electronic only workpapers, so they may request electronic documents when possible. Some firms have portals or secured email so that you can send requests securely ahead of time. You may also be able to email non-secure files directly to the auditor, provide a USB drive, CD, DVD of data, or set aside paper records for the site visit.
Be careful when sending your employee census. Many times these include all of your employees’ birthdays and full social security numbers. One test that auditors need to do is make sure that the employee is a real person (and not a fake one); however, they can see that from the employee file once they sample. You should delete the SSNs out of the file prior to sending the file, and send that file only in a secure manner (portals, encrypted email, only transfer on site, etc.)
Many auditors will travel with scanners, so that any paper records they need copies of they can just scan and image on the spot.