Matt has also been successful in helping the company reinvent its relationship with the external auditor in the following areas:
• Prior to the heads of Internal Audit and Risk Management joining the company, the external audit process left much to be desired. Specifically, JAA never received a well-written management letter; if it received any letter at all, it was written quite superficially and was received by the company nine months subsequent to year-end. There was extensive overlap in some of the
areas covered by external and internal audit. There were, as well, some key areas missed in the external audit that created surprises for the company.
• As a result of the foregoing, the following changes were implemented, creating many positive effects for the risk management framework:
• The external auditors were invited to sit in on the key strategic planning sessions of the company.
• There were ongoing meetings between the head of Internal Audit and the principal partner on the external audit team.
• The external audit team compiled and wrote a comprehensive management letter with special emphasis on root cause analysis (meaning that they understood the root causes of specific problems). They ensured as well that all such comments were addressed by management of JAA and did not appear in the following year's management letter comments.
• The external auditors, in performing their planning work for the current year's audit, began to utilize the existing risk management framework and process at the company, as created by the risk management function. This was to ensure that all parties' efforts were clearly aligned.
• The internal auditors, in assessing effectiveness of the risk management framework at the end of the year, summarized as well the contributions to it by the external auditors.
• The internal auditors did not act as surrogates for the external auditors, meaning that no internal audit time was expended in performing external audit work to reduce cost of the external audit.