“Audit” is a word that usually brings anxiety and fear into the minds of many directors, officers and staff. In the last few years, the word had been used increasingly in both the business world and the charitable/nonprofit sector, often in negative terms.

There are several types of audits, a few of which have been the subject of earlier columns. The word “audit” usually causes most people to think of financial audits conducted by accountants. The typical audit is intended to determine whether or not the financial statements set out accurately the financial position and financial activity of an organization during a period of time. A forensic audit, on the other hand, attempts to find out what happened and why, and is more time-consuming and expensive.

Another form of audit is a compliance audit where the organization’s activities are assessed against a standard. Compliance audits are becoming more common due to several factors. Standardization has become an important part of the global economy and is entrenched in many trade deals.

Different types of standards

“Professionalization” has also had an impact, with standards being set to distinguish suppliers from each other. The standards may be (i) regulatory in nature, such as compliance with requirements set out in regulations, (ii) contractual where the contracting party must comply with standards set out in the contract, or (iii) accreditation-related where in order for the organization to receive accreditation, it must demonstrate that it meets the requisite standards.

Compliance audits are a useful tool in accountability. A compliance audit often provides access to an independent or arm’s length person to determine whether or not an organization is complying with the regulations prescribed by a regulatory body or with industry standards that have led to accreditation. The accreditation process is intended to allow third parties to know if the organization meets the standards for the industry. This form of accreditation is becoming important both in general terms but also in fundraising in Canada.

Compliance audits are also an important tool for boards of directors and senior management in an organization. They allow the board and senior management to identify where problems exist and assist in determining how to correct the problems and to assign priorities.

No one is perfect

Every organization needs improvement. While some organizations do a better job than others, it is doubtful than any organization has achieved perfection. And if it has, it is a transitory perfection, as times and context change.

Boards and senior management ought to explore opportunities for independent audits of their activities even where the compliance audit is not required for regulatory, contractual or accreditation purposes. Such audits, when properly done, will assist the board and the organization’s employees and volunteers to do a better job. The audits can be a positive first step towards improvement.

Some will take the position that having a compliance audit done is risky. It may identify problems that, once known, pose liability for the directors. While this factor ought not to be ignored, blissful ignorance or negligently avoiding problems is not a strong defence. Furthermore, a failure on the part of the directors to take reasonable action to identify problems and risks may lead to personal liability on the part of the directors.

Plan, set objectives

A voluntary compliance audit needs to be planned and its objectives should be clear. An instruction to “tell us what’s wrong” is too broad. Rather, the board and senior management should review on their own the operations and activities and attempt to identify areas in which an independent, arm’s length audit would be helpful. Typically, a compliance audit would be useful where the activities involve a higher level of risk due to the nature of the activity (e.g., a safety audit) or the importance of the activity (e.g., audit of whether or not the organization is achieving performance measurements).

Some audits will be more open-ended than others. Another factor that a board should take into account is the level of expertise and its availability. If the independent auditor has no standards against which to measure performance, query how useful any audit would be. Also, the cost of the audit is another important factor. The audit will usually be an administrative expense, one that is not often supported by government funders and other donors.

Periodically, opportunities arise for free or inexpensive audits to be done by experts. The Ontario Trillium Foundation funded Theatre Ontario to carry out safety audits in smaller community theatres in Ontario.

This service was free to the community organizations that operate the theatres. The person conducting the audit knew both the standards and the context in which community theatres operate. This knowledge permitted the audit to get to the heart of the safety issues and allowed for clear advice to be given on how to meet the existing and developing standards.

Was the audit useful? Certainly the experience of at least one community theatre operator in Ontario is a resounding “yes”. The board had already identified safety as an issue but did not have the expertise to carry out the audit. It had set out its objective, i.e., to operate a safe and affordable community theatre, one that was used by smaller professional organizations as well as seniors’ groups, schools, amateur theatre organizations and so forth.

Within this context, the auditor was able to identify safety issues in general and ones that were peculiar to the users of this community theatre, the physical condition of the building, and the financial limits of the operator. The recommendations made by the auditor were specific and affordable. Importantly, the audit also noted where things were being done correctly and within or better than the standards.

The board, in this case, saw a need for expertise and the usefulness of an independent audit. Luckily, this expertise was available without cost to the organization. In any event, the board was able to find out what was right and what needed correction. The board dealt with the relatively minor problems that could create safety concerns. Rather than remain blissfully or deliberately (and negligently) ignorant, it took appropriate action to reduce risks and prevent potential liability and injury to others. The board did its job.