Internal audit (IA) reporting may be the biggest challenge in the audit process next to scheduling the audit itself and implementing recommendations in today’s complex and competitive corporate environment. An audit report presents results of an examination or review within the organization and is considered by many to be the core deliverable of audit services. Therefore, the importance of good reporting cannot generally be exaggerated.
IA reports and communications strive to increase risk awareness and facilitate action to improve internal controls or effectiveness. Management and the audit committee are interested in the status of the risk and control environment as well as the effectiveness of operations. They are a key audience of IA reporting.
Below are some general considerations for effective IA report writing, followed by a sample report to the audit committee. In the context of IA services delivery, both examples illustrate the importance of setting appropriate expectations, defining services scope and managing expectations.
Each organization will have unique reporting practices that affect the format, frequency and depth of their communications. For instance, the chief audit executive or director may report quarterly to the audit committee about the status of the annual audit plan, significant findings or changes in risk and audit resource issues. Audit management also may communicate on a regular or ad hoc basis with management or other stakeholders. The advice that follows will assist in development of any audit communication.
Determine Your Purpose
Before creating any communication, consider the objective: What do you want to accomplish? Is your purpose to inform the audience or to persuade them to take action? Your approach may be quite different depending on your goal. An "audit report" can take the form of a phone call, an email, an official memorandum or a formal audit report. The information you provide should be tailored accordingly. For example, if you are simply sharing information about the status of an audit, you will want to provide straightforward facts. However, if you are making recommendations to help achieve cost-savings in a certain area, you’ll need to make a strong case for implementing your suggestions. Be sure to include support for your conclusions and incorporate quantitative results because hard facts help clarify decision-making and motivate others to action.
Develop a Structure
Next, consider how you will present the information.
Effective communication requires an organized series of thoughts. Before you begin the report, develop a list of main points. This is an especially critical step when you’re conveying a complex message. A well-developed outline will enable you to stay on point and address all relevant issues. The outline may be a good tool to gain executive sponsor support. Sharing the outline with other parties to the report also can minimize subsequent review and editorial efforts.
Most people reading your report will be familiar with the topic, and their primary interest will be on the bottom line. So, while providing the necessary historical perspective, avoid including too much background in the introduction of your document.
When considering which content to include in your report, keep in mind the following:
(1) The audience – Ensure your report strikes the appropriate tone and depth of detail.
(2) Report usage – How will the report be used and for what purpose?
(3) The "so what" litmus test – Are all data elements and conclusions valuable?
In your audit report, begin with conclusions or recommendations and then offer supporting reasons. Then be prepared to offer additional detail or supporting analysis for those who are interested. Such details may be included in clearly labeled appendices to the report.
The body of a written report should be separated into distinct sections with clear headings—for example, "significant findings," "competitive analysis" and "potential risks"—that make it easy for the reader to locate information. Keep in mind that business reports don’t need to be entirely text-based; using diagrams, flowcharts or graphs often will allow you to make your case more effectively or persuasively, particularly when presenting financial data or descriptions of processes.
Consider writing an executive summary for those interested in your high-level results and recommendations. If your report becomes lengthy due to the extensive project scope or findings, consider preparing an executive summary for each individual section. The summary should explain the purpose, conclusions and the data you must support your analysis. To determine what to include in the summary, you may find it useful to reread the document and highlight key information as you review it.
Be Succinct
Keep reports simple and concise. Let your readers know, from the outset, what topic you are addressing and why it’s important to them.
Tailor the information to the knowledge-level of your audience. While your company’s chief financial officer will obviously be familiar with accounting terminology, other department managers who will see the report may not be. Use plain English whenever possible and avoid buzzwords or acronyms unless they’re understood by everyone who will review your findings.
If you do need to use acronyms or specialist terminology, be sure to provide explanations. Consider appending a glossary of terms so that readers who need them can look up definitions without disrupting the flow of the report.
Pay Attention to Details
Remember that the little things can make a big difference. Always proofread carefully. Spelling and grammatical errors reflect poorly on your attention to detail—one of the primary qualifications of an audit or accounting professional. While the spell-check function on your computer can help, it may not catch mistakes such as incorrect word usage or omitted phrases, so take the time to review reports closely.
Finally, here is a quick checklist with some guidelines and tips for giving your reports impact and clarity:
- Review the IIA Standards for guidance on communicating results.
- Write a descriptive title, include the audit objective.
- Describe the scope of the review and the date of the fieldwork.
- Use objectivity. Your reports and communications should be without bias.
- Be constructive. Focus on improvement rather than condemnation.
- Be neutral. Point our requirements and contrast that to the actual actions taken rather than directly pointing out violations of policy.
- Let people remain nameless. Avoid pointing our individuals; instead, describe positions and functions.
- Present a balanced perspective. Be sure to include management’s responses to related findings.
- Follow an informal rule of "no surprises." Substantiate all your findings in advance and agree upon your conclusions and recommendations with process owners/auditees prior to reporting them.
- Focus on key performance metrics and essential pieces of information rather than peripheral details about the project or area under review.
Submit timely reports. Communicate results immediately after completing fieldwork, especially if there are significant findings requiring immediate action. Consider immediately escalating extremely important issues or events to both executive management and the audit committee.
Develop a standard vocabulary for audit. Having agreed-upon descriptions, performance thresholds and indicators (such as red-yellow-green, or A-B-C type grading) will assist both audit report writers and readers in understanding the importance and consequence of reported issues.
The most controversial aspect of IA reporting is report language. Language conveys the meaning and tone and can be used to either praise or condemn. In general, audit language should remain as neutral and professional as possible. The use of encouraging and constructive words will help facilitate progress and acceptance of action plans by all parties. Avoid language that condemns, such as "did not perform" or "failed to control."
Remember, the goal of audit reporting is to raise awareness and affect positive change rather than to generate consternation and political warfare.
These tools on KnowledgeLeader can assist you with the audit report writing process: