Introduction

Have you ever found yourself conducting a performance audit and starting to feel that “this agency should be doing more to prepare for the future,” but you could not point to any obvious legal or other requirements to prove why the audited agency should be doing more? You were probably working on a prospective—meaning future-focused—audit. Even seasoned auditors may benefit from practices for planning and writing prospective reports convincingly because of the following:

• Prospective reports have some challenges. They often involve the audited agency confronting a new or dynamic issue, such as industry or technological changes, or new laws. Also, the criteria used to evaluate the audited agency may not be immediately apparent because there are many ways the agency could respond to the changes. There may be no obvious “right” answer.
• Most performance audits look at the past. Thus, teams working on prospective reports can face challenges in convincing their own colleagues that the audited agency needs to take more action now if the future is uncertain. And, assuming we win over our colleagues, we may still need to convince the audited agency to take some action, even though the impacts of acting—or not acting—will be uncertain.

Performance auditors have been writing prospective audit reports for decades, but the demand for them is likely to increase. In 1990, the U.S. Government Accountability Office (GAO) issued guidance for answering prospective questions. By then, the GAO was increasingly being asked to answer these questions, such as the potential impacts of proposed legislation. Factors likely to increase demand for prospective reports in the United States include the following:

• Continued budget pressures at state, local, and federal levels. Since the 2008 recession, many state and local government agencies across the United States have faced a gap between revenue and spending—a challenge they will likely continue to face in the near term. The U.S. federal government also faces budget pressures, which will continue unless there are significant policy changes. In response to such budget pressures, government entities—and the bodies that oversee them—will continue looking for ways to do more with less. This includes seeking insights from auditors about how to more efficiently provide the same or improved services.
• Rapidly evolving and emerging technologies. Current technological developments are transforming multiple sectors of society. The speed and complexity of such advances pose challenges to policymakers and could also transform the roles of audited agencies. For example, a 2019 GAO report found that the U.S. Departments of Transportation (DOT) and Labor should take additional steps to prepare for the potential effects of automated trucking technologies on the workforce. The report suggests that such technology may transform DOT’s role, since it enforces regulations such as the maximum hours that truck drivers are allowed to work.

Benefits of prospective audit reports

Prospective audit reports offer key benefits. For example, they can:

• Help audited agencies to be better prepared for an uncertain future in which they may need to adapt to a shifting role with limited resources.
• Help agencies conducting audits to keep their staff informed about emerging issues, and to identify new areas to audit.
• Help policymakers to be better informed about the emerging issues confronting the agencies whose budgets they oversee. For example, prospective reports can help Congress make sound budget decisions, especially when such decisions could be made years before the funds are spent by recipient agencies.

Selected practices for planning and writing prospective reports

This article aims to share tips for planning and writing prospective reports convincingly, based on my experience at the GAO over the past decade. This is a selection, not an exhaustive list, of practices for managing audits that could be useful for prospective reports.

To illustrate the application of the selected practices, examples are drawn from two recent GAO reports, both about the evolving transportation sector:

• Public Transit Partnerships: Additional Information Needed to Clarify Data Reporting and Share Best Practices, GAO-18-539 (Washington, DC.: July 2018)
• Vehicle Cybersecurity: DOT and Industry Have Efforts Under Way, but DOT Needs to Define its Role in Responding to a Real-world Attack, GAO-16-350 (Washington, DC.: March 2016).

Practice 1: Consider including a prospective research question

When uncertainties about the future significantly affect your audit, consider including a prospective research question. This can provide a designated report section for discussing key uncertainties. For example, the Public Transit Partnerships team began its audit with a research question about the key challenges local transit agencies face in fostering partnerships with private mobility companies. In our stakeholder interviews, however, many selected local transit agencies and their partners told us that most challenges related to future uncertainties. Using a prospective research question, we dedicated one report section to discussing trends that could impact the future of such partnerships, such as the projected rollout of shared self-driving vehicles.

Practice 2: If other criteria are elusive, use recognized internal control standards

With prospective reports, it can be harder to identify the right criteria for assessing the audited agency’s efforts, since there are multiple ways that the agency could respond to the evolving issue. Often, we are looking to make a recommendation to help the agency better plan for an uncertain future, which can require combining multiple relevant criteria. In cases where criteria are elusive, the GAO’s Standards for Internal Control in the Federal Government can be helpful (they are largely based on the COSO internal control framework, which is sometimes used by Canadian auditors for the same purpose). These standards or principles are requirements for U.S. federal agencies, but have also been adopted as best practices by state, local, and other entities. Four principles especially relevant for prospective reports include that entity management should:

• Identify, analyze, and respond to risks related to the entity’s objectives (principle 7).
• Identify, analyze, and respond to change that could impact the entity’s internal control system (principle 9).
• Use quality information to achieve the entity’s objectives (principle 13).
• (Effectively) communicate externally, including selecting appropriate communication methods, considering factors such as the audience (principle 15).

Practice 3: Combine the chosen internal controls with the audited agency’s goals to strengthen the audit criteria

Audited agencies often have goals related to being prepared for the future, such as in strategic plans. Combining such goals with the chosen internal controls can strengthen the audit criteria. To illustrate, tables 1 and 2 outline the criteria, relevant excerpts of findings, and related recommendations from the Public Transit Partnerships and Vehicle Cybersecurity reports. Both reports combined agency goals and internal controls to form a stronger set of audit criteria.

Table 1 – Selected Criteria Used for the Public Transit Partnerships Report

Table 2 – Selected Criteria Used for the Vehicle Cybersecurity Report

Page 1 of 2