What 2 Years of File Review Has Taught Me

I’m not quite sure how it has happened, but I’ve just had my two-year Apex-versary, celebrating two years in the world of audit compliance and file review.

The time has flown, and I’m now officially no longer the “new girl”, with Lizzie joining our team earlier this summer!

Reflecting on the past two years, I’ve had an amazing time meeting some fab clients, getting to know their firms and supporting them on their audit quality journeys. No two firms — or audit files — are exactly the same, and that is one of the things I enjoy most about the role.

But reaching the two-year mark also got me thinking about something else: how little has actually changed in the findings I see during audit file reviews.

At first glance, that might sound disappointing. After two years of reviewing files, I might have expected to see a very different set of findings. But the more I’ve thought about it, the more I’ve realised that consistency in the results is a finding in itself — and an important one.

The same themes keep appearing

Across files and firms, I continue to see many of the same themes and areas for improvement. The individual circumstances differ, of course, but when you take a step back and look at the findings collectively, some very familiar patterns start to emerge.

Often, the issue isn't necessarily that the right work hasn't been done. It's that the file doesn't clearly demonstrate what was done, why it was done and how the auditor reached their conclusion.

And in audit, if the thinking, challenge and judgement aren't evidenced on the file, it can be very difficult for someone reviewing that file later to understand the story.

Seeing the same themes repeatedly gives us greater confidence that these aren't simply isolated issues or anomalies. Instead, they suggest there are recurring challenges in the way audit work is carried out, recorded or evidenced.

And after two years of seeing those themes, I've become increasingly convinced that the most useful conversations with firms need to move beyond simply identifying the issue.

From identification to action

File review has an important role to play in providing assurance and highlighting opportunities for improvement. But its value is limited if each review cycle simply tells us what we already know.

If the same finding appears year after year, the interesting question is no longer just: “What went wrong on this file?”

It becomes: “Why does this keep happening?”

That's a much more useful conversation.

Perhaps teams are relying on methodology checklists too heavily. Perhaps teams understand what they need to do but aren't documenting it effectively. Perhaps time pressures mean certain areas receive less attention than they should. Or perhaps an action taken following a previous review addressed the individual file finding without tackling the underlying cause.

Whatever the reason, recurring findings are an opportunity to look beyond the symptom. Correcting an individual file might fix that particular example. Understanding why the issue arose in the first place has the potential to improve every file that follows.

Knowing isn't the same as changing

One of the biggest things file review has taught me is that knowing where the weaknesses are doesn't automatically result in improvement.

A review finding might lead to a training session, a reminder to the audit team or an update to a checklist. Those things can absolutely help, but if the same issue continues to appear, it's worth asking whether the action has really addressed the root cause.

That might mean firms need to think differently about how findings are followed up.

Completing an action is relatively easy to measure. Demonstrating that it has resulted in a sustained improvement in audit quality is much harder — but ultimately much more valuable.

Sometimes, it's about telling the story

Another thing I've learned is just how important documentation is.

There can sometimes be a disconnect between what the audit team tells me they did and what I can actually see on the file. The team may have had a really good discussion. They may have challenged management. They may have considered contradictory evidence or exercised significant professional judgement.

But if that isn't captured clearly, the file doesn't tell me that.

A good audit file shouldn't leave the reviewer trying to piece together what happened. It should tell the story: what the risk was, what the auditor did about it, what evidence they obtained, what they thought about that evidence and why they ultimately reached their conclusion.

That sounds simple, but it's one of the most consistent lessons I've taken from reviewing files.

File review should start a conversation

Perhaps the biggest change in my thinking over the past two years is how I view the purpose of file review.

A review report is useful, but the report itself isn't the end product. The real value comes from the conversations and improvements it creates afterwards.

For me, the most productive discussions aren't about defending why something happened on a particular file. They're the ones where firms are curious about the finding: Why did this happen? Do we see it elsewhere? What could we change? How will we know whether that change has worked?

That's where file review stops being an exercise in identifying deficiencies and becomes a tool for improving audit quality.

So, what have two years taught me?

Probably that audit quality improvement is much more about consistency than perfection.

There will always be findings. Audit involves judgement, complex circumstances and, importantly, people. The goal can't realistically be to produce a review report with nothing on it. Instead, the opportunity is to learn from the patterns.

If the same findings continue to appear, we have increasingly strong evidence about where attention is needed. And that gives firms the opportunity to move from correcting individual findings to making changes that improve quality across their audits.

Two years of file review have also taught me that the best firms don't necessarily get everything right first time. They're the ones willing to have open conversations about where things could be better, understand why issues are arising and genuinely engage with the process of improving.

And, on a personal level, I've learned a huge amount along the way. Two years, lots of files, plenty of findings and more conversations about audit documentation than I ever imagined I'd have!

Here's to year three — and perhaps seeing a few less of those familiar findings.