Governance Theory for Condominium Management Associations as Seen by an Internal Auditor, Episode 8: Auditing Does Not End with 'Pointing Out Issues'

Governance Theory for Condominium Management Associations as Seen by an Internal Auditor, Episode 8: Auditing Does Not End with 'Pointing Out Issues'
― Governance includes executing improvements, tracking them, and handing them over to the next team ―

When people think of auditing, they sometimes think it is a job that ends with:

Finding problems.

Pointing them out.

Writing a report.

However, as a Certified Internal Auditor, I do not think so.

What is more important is what happens after pointing them out.

Even if you find a problem, nothing changes if it is not improved.

Even if you decide to improve it, it is the same if you stop halfway.

If it is forgotten the moment the person in charge leaves, the organization has not improved.

That is why auditing requires the concept of

follow-up.

⸻

Pointing out issues is not the purpose of an audit

Auditors do not audit to increase the number of issues pointed out.

When I served as an auditor, I did not consider 'how many problems I found' to be my achievement.

What was important was that problems were recognized, the board of directors made decisions, necessary improvements were made, and that state was maintained.

In my audit reports, I emphasized not only compliance with laws and bylaws but also the improvement of transparency, efficiency, and effectiveness, making the establishment of systems to support the board's decision-making and the clarification of judgment criteria the basic philosophy of my audits.

In other words, auditing is not just a job of evaluating the past, but also a job of improving future operations.

⸻

It is not the auditor who decides whether to improve

This is very important.

Even if an auditor thinks, 'This should be improved,' the auditor does not decide on the execution of operations.

The subject of the audit is the board of directors.

And it is the board of directors that decides whether to adopt improvement measures.

Therefore, when I issued audit findings, I did not simply say, 'Please improve this.'

I structured it to ask the board of directors to make a judgment.

When notifying them of audit findings, I provided options such as 'implement as proposed,' 'implement with changes,' 'consider other methods,' 'make it a future agenda item,' 'maintain the status quo,' or 'other,' and had the board decide on the response policy themselves.

There is one philosophy behind this.

The auditor does not decide the correct answer.

The auditor points out problems and risks.

The auditor suggests improvements.

And the board of directors makes the judgment.

This is the division of roles.

⸻

A decision of 'not to improve' is also possible

When improvement items are presented in an audit, people might think, 'We must improve this.'

However, that is not necessarily the case.

Improvements cost money.

They take time and effort.

They may create other risks.

Condominium management associations also have constraints on human resources.

Therefore, it is not always optimal to implement all audit findings immediately.

What is important is to distinguish between doing nothing and deciding not to implement something as a result of consideration.

The auditor pointed it out.

The board of directors considered it.

They understood the risks.

Based on that, they decided to maintain the status quo.

If so, they just need to leave a record of the reason for that decision.

The problem is that the decision itself is not made.

⸻

'Pending' is the most dangerous

In practice, the conclusion 'we will consider it in the future' is common.

That in itself is not bad.

There are problems that cannot be decided immediately.

There are cases where additional materials are needed.

There are cases where budgetary measures are needed.

However, the phrase 'we will consider it in the future' carries a great risk.

When will you consider it?

Who will consider it?

What will you check?

Will it be handled at the next board meeting?

Will it be carried over to the next fiscal year?

If this is not decided, 'considering it' can become a de facto abandonment.

That is why I believe that pending items require more progress management than anything else.

⸻

Audit findings and progress management are connected

In Episode 7, I wrote that progress management is necessary so that 'even if board members change, issues are not reset.'

Audit findings are the same.

Improvement items were identified in the audit.

The board of directors decided to respond.

Then, it must be clear who is in charge, what the deadline is, how far it has progressed, what the obstacles are, and whether it has been completed.

For issues of continuity, I believe that a structure of visualizing operations, systematizing records, accumulating know-how, and facilitating handovers through institutional documentation, ledger creation, and the maintenance of progress management tables is effective.

In other words, put audit findings into progress management.

This connection is important.

⸻

Follow-up is not just 'auditing again'

When people hear 'follow-up,' they might imagine the auditor checking again in six months.

Of course, that is one method.

However, in a management association, the auditor themselves also changes due to term limits.

Therefore, follow-up should not be dependent on the individual auditor.

What is needed is a mechanism that allows the organization to follow up.

For example, if audit findings, the board's response policy, the person in charge, the deadline, the progress status, completion confirmation, and handover to the next term in case of non-completion are all left in a list, then even if the auditor changes or the board of directors changes, the next person can check the continuation.

In other words, you incorporate follow-up into the organization's memory.

⸻

Should audit findings disappear when the auditor leaves?

I was strongly aware of this point while I was an auditor.

Improvement activities only progress while the auditor is there.

They stop when the auditor leaves.

That is not an improvement as an organization.

Audit findings are not the individual auditor's homework.

Once the board of directors decides to respond, it becomes an issue for the management association.

Therefore, if it is incomplete, it is handed over to the next term.

The next board of directors should not treat it as 'what the previous auditor said,' but as a management issue handed over from the previous board.

Only when it can be converted to this extent do audit findings remain in the organization.

⸻

Improvement items and recommendations are not the same

Prioritization is also necessary here.

Things discovered in an audit include serious problems, medium-level risks, and improvement proposals to make operations better.

I organized audit findings by classifying them into: serious legal/bylaw violations or high-risk items, medium-risk items such as institutional inconsistency or lack of documentation, and improvement/recommendation items regarding operational efficiency or transparency.

This classification has meaning.

If you track everything with the same urgency, the board of directors will be exhausted.

On the other hand, it does not mean that 'because it is a recommendation, it can be ignored.'

Prioritize them, but keep unresolved items visible.

This is important.

⸻

Recommendations should not be 'erased' either

For example, improving document management, organizing seal records, visualizing accounting flows, or introducing progress management tables.

These may not be items that immediately prevent serious accidents.

Therefore, they may have a lower priority than other important tasks.

However, having a low priority is different from being unnecessary.

If you do not implement them, leave the reason.

If you are going to consider them later, leave them as an issue.

If you are sending them to the next fiscal year, hand them over clearly.

By doing this, you prevent 'we will do it eventually' from becoming 'it disappeared without anyone noticing.'

⸻

Accountability is not just about 'whether it was improved'

It is also important for the board of directors to be able to explain how they responded to audit findings.

Improved. Did not improve. Put on hold. Adopted an alternative plan.

Any decision is fine.

However, they need to be able to explain why they made that decision.

Auditing is not an activity that takes away the board's judgment.

Rather, it is an activity that provides materials for the board to make explainable decisions.

Therefore, the results of responses to audit findings also become part of the board's accountability.

⸻

From 'discovery' to a 'closed loop of improvement'

The flow I idealize is as follows:

Discover a problem

↓

Evaluate the risk

↓

Present as an audit finding

↓

Board of directors decides on a response policy

↓

Decide on the person in charge and the deadline

↓

Visualize progress

↓

Confirm implementation results

↓

If incomplete, hand over to the next term

↓

Follow up again

Only when this cycle is completed does auditing lead to improvement.

If it ends when the audit report is submitted, it is an open loop.

It only becomes a closed loop when you track the results of the response.

I believe this closed loop is also necessary for the auditing of management associations.

⸻

Conclusion

Auditing is not a job that ends with finding problems.

It is not a job that forces improvements.

What an auditor does is clarify problems, show risks, and present options for improvement.

Based on that, the board of directors makes a judgment.

And they execute what they decided, track progress, and hand it over to the next team if necessary.

Auditing and the board's decision-making are connected, and further connected to progress management and handovers.

This series of mechanisms is the governance that embeds improvement into the organization.

From my experience as an auditor, I have come to believe that a good audit is not about writing good points, but about leaving the organization in a state where it can continue to improve.

Next time, I would like to take up another important element that supports that improvement.

Episode 9: Minutes are not 'records,' but evidence of decision-making

Discussed at the board meeting. Voted. Decided.

However, if you cannot understand 'why it was decided that way' later, you cannot fulfill your accountability.

How much should minutes, voting records, and related materials be kept?

I will think about this from the perspectives of transparency and evidentiary value.

⸻

HI (Human Intelligence)

Certified Internal Auditor (CIA) at a listed company | Certified Fraud Examiner (CFE)

Based on the knowledge of governance, risk management, and internal control cultivated in companies, and the practical experience gained as an auditor for a condominium management association corporation, I am researching and disseminating information on 'governance suitable for condominium management associations.'

Series

'Governance Theory for Condominium Management Associations as Seen by an Internal Auditor'

The idea in this article that 'after issuing audit findings, the board of directors itself judges the response policy and records the results' is organized as a general operational concept based on practical experience as an auditor.

#CondominiumManagementAssociation #CondominiumManagement #BoardOfDirectors #Auditor #CertifiedInternalAuditor #CIA #CertifiedFraudExaminer #CFE #InternalAudit #Governance #FollowUp #AuditFindings #ImprovementActivities #ProgressManagement #Handover #OrganizationalMemory #Accountability #InternalControl