3.5. Audit methods

Audit methods

It is important to identify audit methods for assessing the meeting of audit criteria and to be able to obtain sufficient and appropriate audit evidence. This requires the auditor to describe what kind of information and data are to be collected, the sources, the techniques needed to gather data and the kind of methods to be used to analyse data.

Auditing methods are chosen based on the type of information needed to prove the real-life problems assumed in the preliminary study and demonstrate the scale of these problems.

When choosing auditing methods, the following questions should be considered:

• Where are the relevant data to be found?
• Are the data complete (including metadata)?
• How will the data be collected?
• How will the data be analysed?
• What do we expect to find?

Different types of audit evidence can be obtained using various methods of data collection (source of classification: ISSAI GUID-3920):

The data collection and analysis methods used in environmental audit do not differ much from other performance audits.

When planning an audit it is necessary to find out what kind of environmental data is available in the field. There can be good quality statistical data, but it may be scattered across different data sets, reports, inventories etc. Often the data is of poor quality or incomplete. Therefore, environmental auditors frequently face difficulties in sampling. Environmental data is often incomplete and contains irregularities.

Therefore, case studies are often used instead of taking statistical samples. Case studies are useful for understanding the situation and the reasons behind a problem, as all aspects of the case are thoroughly analysed, often using several methods. It is also easy to use case studies as illustrative examples in the audit report.

Examples of possible case studies:

• Nature protection measures taken in one nature protection area
• Selected cases/examples of issuing environmental permits and controlling their implementation
   

Reading suggestion on research methods! INTOSAI IDI (2020): Performance Audit: ISSAI Implementation Handbook (handbook is also available in Spanish, French and Arabic). INTOSAI GUID 3920 The Performance Auditing process (2019) Guide to our methodology (European Court of Auditors) The Research Methods Knowledge Base SAGE research methods

The qualification of auditors and the availability of resources (time and money) are significant factors to consider when choosing audit methods.

ADM example of audit methods

Thinking exercise – ADM (4/5) You have chosen the problematic environmental/sustainability issue to audit in your country and given a title to your imaginary audit (thinking exercise in sub-chapter 2.3), you have also set the objective, formulated the main audit question and/or sub-questions and criteria (sub-chapters 3.2-3.4).  Please think now what could the possible audit methods helping you to find the answers to your questions and criteria. Write them down for yourself.

Risks endangering auditing

When planning an audit, several risks need to be considered, such as insufficient human resources, lack of time, high travel costs. In some cases, these risks are included in ADM or are at  least covered in audit strategy/plan.

Besides these usual risks, an environmental audit can be endangered by additional risks. One common risk is a lack of knowledge about environmental issues. To overcome this risk, auditors need to study but could also consider recruiting experts to conduct an analysis. The selection of subject matter experts needs careful consideration, as an auditee may question the expertise. Sometimes, it is wise to form an expert panel in order to increase the credibility of results.

In environmental audits, there are often different data sets that could be analysed. There is often a risk of receiving incomplete data. Sometimes, data are not in a suitable format for analysis. The auditor needs to think about how to overcome this risk. Sometimes, there is a need to plan more time. It may even be that the entire audit needs to be redesigned if it appears that data is not usable.