Preparing for your first audit

A first audit arrives for a predictable set of reasons: a size threshold crossed, a lender covenant, an investor on the register, a group parent, or a customer procurement process that requires audited accounts. Whatever the trigger, the experience is much the same. The business is asked not whether something is true, but how it can be demonstrated to be true to someone who was not there.

That distinction is the whole of it. Finance teams who have never been audited are usually right about their numbers and unprepared to evidence them.

Start six months out

The work that makes an audit smooth is done long before the auditors arrive, and most of it is work you should be doing anyway. Balance sheet reconciliations for every account, prepared monthly and reviewed by someone other than the preparer. A fixed asset register that agrees to the ledger and to physical reality. Stock or work in progress counted and valued on a written basis. Accruals and provisions supported by a calculation rather than a judgement someone remembers making.

The pattern to aim for is that every balance sheet line has a file behind it which a competent stranger could pick up and follow. If that exists at each month end, the year end is an ordinary month with more visitors.

What auditors will ask for that businesses rarely have

• Evidence of review, not just of preparation. A reconciliation nobody signed is a working paper, not a control.
• Signed contracts for material revenue, matched to how that revenue was recognised.
• A documented basis for every estimate: bad debt provision, accrued income, useful lives, provisions for claims or dilapidations.
• Board minutes and evidence of the decisions behind significant transactions.
• A related party listing, which in owner-managed businesses is almost always longer than first drawn.
• System access logs and evidence of segregation of duties, particularly over the payment run.

Expect the control observations, and use them

In a first audit of a business of this size, the management letter will raise segregation of duties, because the team is small and the same person often prepares and posts. It will raise journal controls, because manual journals are usually unrestricted and unreviewed. It will raise access rights, because people who changed roles kept their old permissions.

None of these are failures. They are the normal state of a finance function that grew alongside a business. The mistake is to treat the letter as a compliance document to be filed. It is a free, independent assessment of where your function is weakest, written by people who spent weeks looking. Work the points, and the second audit is materially easier than the first.

Practical things that shorten the process

Agree the request list and the timetable before fieldwork begins, and put a named owner and a date against every item. Give the auditors read access to the ledger rather than exporting reports on request. Nominate one person as the single channel for queries, so that answers are consistent and the team is not interrupted continuously. And answer the awkward questions early and completely, because the single most reliable way to extend an audit is to make the auditor feel they are being managed.