The COO Wants a Different Objective

The COO is an auditee and does not have authority to change an objective approved by the audit committee.

Response: acknowledge the constraint factually, explain that the objective was approved by the committee, and say you will take the request to the CAE and the committee with an assessment of its effect. Do not agree in the meeting to drop the objective, and do not argue with the COO about whether the dispute is genuine.

Before any change:

• Verify the claim - where the documents are, who holds them, whether a litigation hold applies, and whether copies can be obtained through counsel or a confidentiality agreement.
• Ask whether alternative evidence exists: bid waivers, approval emails, procurement system records, contract terms.
• Document the request, the date, the COO's words, and your response.
• The CAE, not the senior auditor, decides; the audit committee should be informed, because a restriction on an approved objective changes the assurance the committee receives.

The key distinction: you cannot access the documents is a scope limitation to be reported; the COO prefers a different objective is a request, not a limitation.

First characterize the exceptions: are they 'no bid' or 'no evidence of bid'? A missing document is not the same as a bid that never happened; check whether a waiver was approved and whether the file is simply incomplete. Resolve this before projecting anything.

With 30 hours left, options:

• Extend the sample within the same stratum, particularly high-value contracts, to see whether the rate holds. Twelve items is small; a 25% exception rate in a judgmental sample cannot be statistically projected but is a strong signal.
• Test 100% of contracts above a value threshold if the population is small - often a firmer conclusion than a bigger random sample.
• Stratify: if the three exceptions cluster in one business unit or one buyer, follow that trail rather than broadening randomly.
• Alternative evidence: system logs, approval records, waiver forms.

Conclusion: you cannot say the control operates effectively, and you cannot say the exception rate across the population is 25%. The report should state the population tested, the exceptions found, that they were not projected, and a conclusion qualified relative to the objective. If the exceptions are confirmed and involve high-value contracts, consider whether this is a significant issue requiring escalation before the report is finalized.

The CAE may agree to change scope, but cannot do so silently.

Document:

• The original objective and the requested change, with who requested it, when, and why.
• The CAE's rationale and who approved the change - the audit committee, since it approved the original objective.
• The work already performed, including the three exceptions, and what was done about them.

Communicate:

• The report must state the scope limitation explicitly and its effect on the conclusion - for example, 'the objective could not be fully achieved because bid documentation was unavailable; we report the exceptions identified in the work performed.'
• Tell the audit committee, in the report or a separate communication, that scope was reduced at management's request and that the committee approved the revised scope.
• The three exceptions should still be reported; narrowing the objective does not erase evidence already obtained.

The failure mode to avoid is a report that reads as a clean opinion on purchase-order approvals while the committee believes procurement competition was examined. The committee's understanding of coverage is the product; changing scope without saying so misstates it.