When we have chosen a topic, what would we look for? When we choose a topic, it's because we've spent some time deciding that it was a topic of interest, and we establish an objective that we want to accomplish. Then we set out things for which we're going to hold departments accountable. We call those audit criteria. We agree what those will be. Is it a policy? Is it a law? What are the expectations? We set those up and then we design an audit program to gather evidence to get there.
At times, however, we might come across things we didn't expect to see. It's not as though we're looking for red flags, but we are always skeptical when we receive evidence. We say, “Is this telling me the full picture? Can I get another piece of evidence to corroborate it?” There might be red flags that surface as a result of the answers we receive, or the lack of answers or evidence that we find. Then we follow that along the path.
I've often used the analogy that we have an audit program, and the audit program tells us to walk down this hallway, pass these three doors and then turn left, but if we walk past the first door and we smell something terrible, we're going to open that door and look inside. If it's food that's spoiled, we'll close the door and advise the entity that they should send a cleaning crew in and clean it up, but if we come in there and we see, God forbid, a dead body, we'll say that we need to look at that and investigate it further. We won't turn a blind eye to that, but we do have an audit program that we intend to follow.