Your Organization Needs an Auditor

Auditors uncover fraud, flawed processes and poor outcomes in the private and public sectors. They’re happy to recommend improvements too.

In April, the Honolulu City auditor’s office won a Knighton Exemplary Award from the Association of Local Government Auditors – the highest local government auditing Award in North America – for its deep dive into the city’s system to hire and sustain its workforce. For example, the Auditor’s office found the city took an average of 139 days to fill a position, falling short of the mayor’s 90-day benchmark.

This audit was especially useful, says City Auditor Arushi Kumar, because it was published in June 2023, during the City Council’s budget hearings.

“It was a great conversation starter for the budget hearings, as vacancies dominated the conversation,” recalls Kumar. “Every department director was asked about their vacancies and what their plans were to fill them before June 30. So, while it was nice to get recognition at a national level, the ultimate goal is to have an impact at the local level.”

City Council adopted five pieces of legislation related to the audit’s findings and recommendations that affected both city and state agencies.

The city’s auditor is one of many people working behind the scenes in Hawai‘i and across the nation to ensure companies, nonprofits and government agencies follow standards and best practices in finances, operations, IT, HR and other important areas. Auditors aim to provide independent, objective evaluations of operational business activities, and report to senior management.

The judges for the Association of Local Government Auditors awards cited the Honolulu audit’s focus on an issue that was both timely and full of significant risk – risk in terms of dollars at stake and breadth of services affected.

The audit was even more impressive considering the absence of reliable data. The city’s Department of Human Resources couldn’t even provide a timely record of actual vacancies that passed the auditor’s reliability test. While most audit shops would understandably conserve resources and terminate the audit due to unreliable data, the city’s office forged ahead, justifying the decision by pointing out that stakeholders were making critical staffing and budgetary decisions based on faulty data. This helped convince city officials to take action to improve data reliability.

The report also dove into process bottlenecks. For example, it found the city’s HR Department was using four separate unlinked databases for hiring, onboarding and terminating personnel. The department also had no formal process for abolishing old positions that would likely never be filled. This meant that, for an unknown number of vacancies, their related funding could not be released for other priorities.

Beyond Scathing

While “scathing” audits may grab headlines, Kumar says, the perceived friction is necessary to define a problem, unearth its root cause and help fix it: “We are part of government checks and balances. The City Council uses us to hold executive departments accountable for how they’re spending taxpayer money.” But tracking agency spending, according to City Audit Manager Christine Ross, is “just step one.

In order to add value, auditors have to be able to answer, ‘So what?’ ” Ross says this requires persistence, curiosity, critical thinking and creativity.

Government performance auditing has been embedded in Hawai‘i’s Constitution since 1950, even before Hawai‘i became a state. But the first state auditor, Clinton Tanimura, was not appointed until 1965. This activation coincided with a nationwide trend reflecting public concerns about increased government spending on welfare and regulatory programs in the 1960s and 1970s. The public demanded information on how governments planned to ferret out waste, fraud and abuse, and whether public programs were meeting their stated objectives.

In Honolulu, the Office of the City Auditor was created within the city’s charter in 2002, after similar voter calls for accountability following scandals involving government officials and lack of transparency over public funds. That mission continues, says Kumar:

“ ‘Government performance auditing’ has less to do with spreadsheets and checking every dollar than trying to assess the outcome of programs and processes. The term ‘performance’ is right there in the title.”

While that may sound like a check-the-box exercise, Kumar says, audits help the public understand the role that government agencies play in their communities: “We’re trying to increase trust in government.”

A similar crisis of confidence spurred the evolution of private sector audits. Former auditor Gina Woo Anonuevo, now Chief Human Resources Officer at First Hawaiian Bank, recalls the transition came in 2006, when large accounting firms began to fail. That was the era of corporate financial scandals featuring Enron, WorldCom, Adelphia and other prominent companies. Stakeholders demanded more accountability from leaders of publicly traded companies. “That’s when audit became a true career profession where you needed specific skills, knowledge and experience to do the job, not just follow a checklist,” says Anonuevo.

Cops or Partners?

Because the audit industry has grown during periods of public scandal, the common perception is that auditors are like IRS agents or police officers who uphold hard-coded laws, shining the spotlight on violators. To be fair, there are similarities: auditors rely on structured frameworks and standards to scope their work, and note any discrepancies based on collected evidence. One difference: auditors recommend improvements but don’t enforce policies – that’s management’s job. And they try to have collaborative relationships with the people they audit.

Former auditor Addie Lui, now Director of Information Security at Aloha Pacific Credit Union, says leaders are not required to follow an auditor’s recommendations to the letter. “It’s up to management to accept or manage the risk, whether or not to implement the recommended control,” he says.

The auditor’s job is to clarify risks and make recommendations based on a thorough understanding of business processes and objectives: “When you write the recommendation, you let them know that if this isn’t being done, their business objectives may not be met,” he says.

As Anonuevo puts it, the auditor’s job is “to proactively identify potential issues so that we can self-correct.”

According to First Hawaiian Bank Chief Audit Executive Kristi Lefforge, “Historically, the audit practice has been more compliance focused. But it has really morphed into more of a consulting arm. It’s not necessarily that we’re punitive. In all cases, we are there to make sure that we’re safe and following rules and practices.” This is known as the assurance side of audit – examining systems and processes and reporting whether they are on track.

“But there’s another side to us: we’re trying to make sure we’re adding value,” notes Lefforge. Because auditors have a high-level view of all the risks and potential obstacles faced by an organization, they also see the other side of the coin: opportunities for improvement. This is where the consulting side comes in.

Adding Value

One example of a consulting engagement is a management review, when managers ask the audit department to lend their analytical skills and tools for an emerging need, or a specific project outside of the prescribed audit calendar. “Management could ask us to come in and do an assessment, without it being an audit,” says Anonuevo.

She and Lui worked together as First Hawaiian auditors in 2008, when Aloha Airlines filed for bankruptcy. Banks were faced with an onslaught of millions of dollars in related credit card chargebacks. Because employees had to manually type in long transaction codes to process refunds, being off by one digit could mistakenly flag a transaction as invalid. In that case, the manager of the business unit asked internal audit if they could help automate data entry and process these massive claims.

Fortunately, Anonuevo had just purchased audit software that could ingest all the transactions at once and deploy an automated filter to weed out duplicate or invalid claims. “Remember, this was 16 years ago when systems were not as advanced as they are today. It really did make the work easier; it reduced the mistakes from manual inputting and processing. Luckily our IT audit team knew how to program it, so they went in and helped them with that.”

Another example of assistance provided outside of the traditional audit is to examine incidents for potential fraud exposure, says Anonuevo. “I remember one incident where a manager called me and said, ‘I just opened up my employee’s desk and there’s tons of general ledger tickets in there that haven’t been processed.’ ” Damage control measures were clearly called for, but how much? “We sent an auditor down to look at what the scope and potential exposure were and advised management on the next steps based on the assessment. A lot of managers appreciated that.”

Overcoming Resistance

Of course, not every agency or department head welcomes an audit. In these instances, support from the top executives helps. The auditing term “tone at the top” means a body of evidence that demonstrates leaders’ commitment to ethics and internal controls throughout their organization. For auditors, this translates to responsive and collaborative auditees.

Kumar shares that, within weeks of starting her term at the city, the mayor and his management team visited her Kapolei office. “I really appreciated their show of faith and willingness to work together. They’ve set such a good tone in their dealings with my office, and a lot of that has trickled down.”

Similarly, Lefforge says she appreciates how First Hawaiian Bank’s senior leadership has a strong governance and control mindset. “I have worked historically with clients who didn’t have that tone at the top, and it’s challenging to get your work done when it’s not there.”

While leaders may support the idea, individual auditees may view auditors as non-experts intruding on processes that are working just fine – breaking what doesn’t need fixing to justify their existence. Kumar acknowledges that having virtual workplaces has hampered their efforts to build relationships: “When we are able to visit in person, we seem more human.” But not everyone wants to have auditors in the next cubicle, if they can avoid it.

Lefforge suggests the key is finding opportunities to educate potential auditees on what internal auditors do and connecting with them outside of the audit process. This shows that auditors are invested in supporting their success. “Sometimes it’s checking in with them periodically throughout the year to see what they’re doing, being aware of any new processes or systems they’ve launched, and building relationships.”

Like her private sector counterparts, Kumar tries to find common ground with resistant auditees. “We each have a lot of pride in our work because we know we’re serving the public. Sometimes it takes a bit longer for some people to realize that I mean it, but we’re all working toward the same end.” However, she acknowledges, “Some of these relationships can take a long time to change. It’s kind of a long game, right?”

Sometimes, she says, it means being hyper-vigilant for any opportunity to connect on a personal level with someone who was unhappy with their audit reports. “There was one director I didn’t have the best relationship with, but we were able to have an informal conversation – I think it was about K-dramas or something.” While it might have seemed frivolous, Kumar felt a slight thaw in the relationship. “We just kind of had a moment of understanding: we’re both just people doing our jobs.”