Since we launched the concept of Audit Ready Output early in 2013 there have been a number of organisations who claim to offer the same thing but as far as we know, no-one else has had this claim backed up by an independent assurance exercise of their own, which makes the claim ironic at best and meaningless otherwise. How can you claim that you have an audit ready system if you haven’t had a team of independent auditors check that this is the case?
Audit Ready means that an entire system is ready to be audited by an audit firm and it doesn’t just mean that you are able to allow auditors to log in to a system and see where the data has been put in. It goes much deeper than that, a fact that anyone who has actually been through an audit process themselves will appreciate. Here is an excerpt from our PwC assurance report explaining what we mean by “Audit Ready”:
“Audit Ready Output” is a concept that ensures that all outputs from a GHG accounting system are fit for purpose and can be subject to independent audit without the need for reporting organisations to carry out any further calculations, clarification, data manipulation or other “pre-audit” work. Features of an audit ready system must therefore include:
- A database of up to date and accurate emission factors;
- A database of up to date and accurate conversion factors;
- A credible system for ensuring that emission and conversion factors are maintained;
- A system of quality assurance checks embedded into the GHG assessment work flow;
- The ability to present all of the information an auditor would need to carry out an independent assurance exercise on the GHG results, including PDF reports, excel sheets, and supporting evidence for submitted data; and
- Controls that ensure the data and results cannot be changed by clients after publication without authorisation from Ecometrica.
I’d therefore encourage anyone interested in Audit Ready to read our independent assurance report from PwC and take note of the reasonable, rather than limited, assurance we have over the controls in the entire Our Impacts and Our Impacts: Integrated systems. These controls cover the front end data entry and quality assurance processes, our “back end” database maintenance and update processes and our entire system development processes from design, through testing and deployment on our production environment. Having a controls-based process, with clear segregation of duties, is critical to audit ready output and is what allows auditors to have trust and confidence in a system. Without this assurance in place an audit firm must get themselves in a position where they have confidence in a system and its controls so a lot of time and expense will be incurred while the auditors give themselves this comfort. With independently assured audit ready output we’ve already done this and this will save time and expense in every engagement.
So when the term “audit ready” is thrown around willy nilly, ask to see the independent audit report that backs up this bold claim and please beware of cheap imitations.