5 Key Considerations When Selecting an Audit Firm

The relationship with your audit firm is one of the most important strategic partnerships that your organization has. But aside from the decision-makers and the internal team that ultimately works with the auditors, very few stakeholders understand just how important making the right decision is. Even more so, it can be difficult to know which factors matter most when it’s time to make the final call on who to trust with your audit. 

You rely on your auditors to not only provide credible assurance to your customers and stakeholders about your governance processes and frameworks, but also to help strengthen your overall security posture. Couple that with the fact that during the audit process you grant assessors access to sensitive systems and confidential information, and the choice of which audit partner to work with becomes a critical decision that shouldn’t be taken lightly. 

In this article we’ll attempt to make the decision process simpler by highlighting five factors you should review regarding every service auditor. Some will be more obvious, and this list is not meant to be all-inclusive, but we’ll offer our perspective on each of the key considerations to think about throughout the process. 

What to Look for in the Right Audit Partner

Below are five essential considerations that can help ensure you choose a partner who aligns with your organization’s needs and values:

1. Reputation

When you’re selecting a practitioner for compliance services, reputation is often the first consideration. You not only want to have confidence that you are receiving a quality return on investment, but that your clients have the same confidence in the compliance reports or certifications being issued. 

You’ll have plenty of options, but among other factors, make sure to thoroughly consider how each firm’s established footprint in the industry might affect you: 

• If you partner with a new firm or one that’s rapidly growing: 
  • Pros: They’ll be eager to establish a solid reputation for themselves through their work with you.
  • Cons: There may be less of a guarantee your auditing process will run smoothly. As such, you may risk your final deliverable being viewed by your customers with a degree of skepticism. 

• If you choose a firm with a well-recognized name and demonstrated expertise: 
  • Pros: You’ll be partnering with someone that will likely have helped establish the standards for auditing and assessment practices. 
  • Cons: Having been in the industry for so long, their audit methodology might’ve slipped into an outdated or perfunctory approach—a simple checking of boxes.  

In any case, an audit firm’s value proposition should be clear and readily apparent to you.  

2. Experience and Expertise

This goes hand-in-hand with a firm’s reputation, but when it comes to experience and expertise, you need to drill down further. 

An audit firm may provide a service, but they’re actually providing the personnel to perform it. The team you partner with must have the appropriate knowledge and skill set for the type of examination your clients are requesting or the regulatory requirements you are seeking to achieve. Depending on your priorities and needs, experience and expertise could mean different things to you: 

• Years in the industry 
• Audits completed, per assessor (these should be relevant to your type of project) 
• Certifications 
• The future of their service lines (as most assessments do recur) 

For what it’s worth, here at Schellman, our professionals average 9 years of experience, and teams hold an average of 4 professional certifications per professional. 

Whichever of these factor(s) you choose to prioritize, make sure you request proof of their training and qualifications that certify them to perform the assessments your organization requires. To further prepare for the future, you might want to also ask about their expertise with other compliance standards, especially as consolidating audits under a single provider comes with several benefits. 

Your ideal partnership should be with an auditing firm that has expertise in your particular area of business, for a couple of big reasons: 

• Your entire audit process will be more straightforward if your assessor is already familiar with your industry’s goals and pain points, making it less of an ordeal for you. 
• You’ll also save time, money, and effort otherwise spent onboarding and creating a knowledge base with the new external team you bring in.

3. Technology

Technology helps expedite the processes and outcomes in every aspect of our lives and your audit firm should also be taking advantage of it during your audits to streamline your process, time to value, and delivery 

Audits have always required large amounts of employee time and effort through meaningful process walk-throughs, evidence gathering, and clearing up additional questions, and there’s likely never getting around that. But there are still modern ways to accelerate and organize evidence gathering and data analytics, among other things. 

Many audit firms out there have built or obtained these kinds of tools, and all of them will look shiny and helpful on paper. But to make sure the one you choose will work for you, ask for a demonstration to get a real look at the user experience. That way, you’ll have a better shot at contracting with the firm whose technology will make for the easiest time during your audit.

4. Ongoing Support

You should not hear from your chosen practitioner only once a year. In an ideal scenario, your audit firm is not just your assessor, but rather your business advisor, and as such, consistent contact should occur year-round, and their presence should be felt beyond just when they contract and deliver on your audit.  

A good audit firm will establish an open channel for communication available between you and your auditor. That’s important because you’ll need to include them in discussions about: 

• Changes to your environment 
• Adding additional business lines 
• Additional regulatory or compliance requirements that could lead to additional scope or a completely separate assessment 
• New processes, technologies, trends, or themes in the company and industry 

Ask your potential firms about their planning methodology and what their service and guidance look like beyond just project delivery. Understanding the cadence and expected interactions between your company and auditor is table stakes and a key part of growing a meaningful partnership. Having these discussions proactively can help you establish a trust level early on with the external team that will be critical to your relationship moving forward. If an auditor does not prioritize open dialogue between you, that raises questions regarding how you two will handle emerging risks and technologies, protect your data, and mature your operating processes.

5. Fees

 It is true that remaining compliant is costly. Not just financially but also in the aforementioned time and effort. But compliance is a necessary piece of all companies’ go-to-market and revenue generating strategy, not just security. Price is something you must consider, and several factors play into audit fees: 

• Time requirements 
• Scope complexity 
• Scope size
• Location travel requirements 
• Risk, just to name a few 

In the audit space, like most investments with meaningful outcomes, it’s important to remember that “sometimes you get what you pay for.” 

Selecting the cheapest option may mean you run the risk in the short term of not obtaining satisfactory services demanded by your clients, which can impact your revenue goals and market outcomes. Not only that, but your fees could become even more costly in the long run if you must bring in another, more qualified team to get a last-minute assessment completed. 

Those possibilities don’t erase your budget constraints, however, so it is understandable to pursue a nice mix of competitive pricing and value. When vetting firms, find the one with the most transparency into their total price, and of course, find out if there are any cost efficiencies to be gained for multiple assessments. 

Additional Consideration: Early Impressions 

The previous five items will play major parts in your eventual decision, but you also shouldn’t discount the importance of picking a firm whose people will fit in with yours. 

During negotiations, ask to speak with senior partners and get to know the firm from top to bottom. Note whether firm representatives are responsive, friendly, and helpful when it comes to your questions or even allowing you this insight. 

You should also be introduced to the team members who will handle your account regularly. If possible, let your team meet with them too. These are people you’ll be comfortable working with long-term through an arduous process, so a positive connection is important to read early. 

Moving Forward in Finding Your Audit Firm 

Audits and certifications don’t have to be burdensome. Effectively choosing a reputable firm that has established good standing and understands your industry can make all the difference in not only assurances gained but also your experience throughout the process. 

Now that we have you thinking about these few but necessary considerations to make when choosing our audit firm, it’s time to take it a step further. Read our other content that will help you get that much closer to a decision and prepare you for the start of your assessment: 

• The Benefits of Consolidating Compliance Services with a Single Provider
• Preparing for Your Audit: 3 Mindsets to Have
• Schellman vs. Other Single-Provider Cybersecurity Services Firms

Please also feel free to reach out to us if you’d like to learn more about Schellman. We’re happy to have a conversation to satisfy your curiosity about both our capabilities and which assessment is best for your organization.