The other side of the table – Size does matter
When the doorbell rang, I knew it was the president’s driver delivering the package with audit reports I was going to have to work my way through in the coming days, in preparation for the audit committee. The driver is not an anachronism, but a necessity given the size and weight of the packages I receive two weeks before the quarterly audit committee meetings.
I’m a member of a few audit committees and I take my role seriously. I read every audit report front to back and I aim to be as prepared as I possibly can going into the meeting. But quite often I have to plow my way through a lot of information which is less relevant or even irrelevant for an audit committee member. Sometimes it makes me feel like a pig looking for truffles. Reading audit reports takes time and on occasion I despair when I see yet another large package landing on my front door mat. Because let’s be clear, size does matter, especially for audit reports.
Now, having been one, I fully understand and appreciate the need of the Chief Audit Executive to show her or his work. The teams have worked hard and the internal audit department wants to show that they contribute to the wellbeing of the business. But I don’t believe that that contribution can be measured in kilograms of reports delivered to audit committee members.
I’ve been confronted with the problem of audit report overproduction quite a few times. Audit reports in excess of seventy pages are more the rule than the exception. If an audit report really needs to cover that many pages, that is fine, but all too often the audit report is a rambling summary of the audit working papers, which is not at all what a report should be.
Ideally, a good audit report for an audit committee or a board provides information and insights into where the current and future fires will be, what their causes are and how management will prevent or at least fight them. This allows us, as an audit committee, to advice the board whether the management team needs additional mandates to carry out their role. I once explained it to an audit committee member as follows: “the role of the internal auditor is to make sure the audit committee members and, by extension, the board members, lie awake at night worrying about the right things.” An audit report usually contains important issues, but at least the audit committee and the board focus on the right issues.
But what should a good audit report contain? The easiest thing would be to refer you to “Sawyer’s Guide for Internal Auditors”. If you haven’t read Sawyer yet, you should go and order it from the IIA bookstore now, because most questions you ever had as an internal auditor have been answered in that tome.
An ideal report, according to me, starts with a short management summary. Short as in not more than two pages. This is where the burning issues are narrated in an accessible manner. This is where you, auditor and author, grip your audience. The least the reader needs to know and remember is right there in those two pages. This can be written in freeform, but it needs to be engaging.
A second element I look for is a short description of the context of the audit. What are the audited activities, what was the scope and possible scope exceptions … in short, where does the story in the management summary I read play out? As an audit committee member, it’s important to be able to understand in what specific context the audit took place because it may influence my perception of the audit.
If I want more information, I need to be able to refer to a structured overview of material key findings. This could be as simple as a structured overview of that finding on a single page. This allows me to go and explore those findings that should keep me, as an audit committee member, awake at night.
And finally, I want to see a management response. What does the management commit to doing and what remains open, if anything? What is my exposure as an audit committee member or board member? What is left on the table to deal with?
I know that this limits the size of the audit report considerably, as it will not contain a detailed overview of all findings. But that is okay, because you are professional auditors whose activities conform to the IIA standards. More detailed elements are elements you, as an auditor, need to share with your auditee to allow her or him to then address these findings. The auditee can ideally plug these more detailed findings directly in their to do lists and you can connect them straight to your follow-up system.
No matter what structure you chose to adopt for your report, make sure I can find my way in it. Standardisation is good as long as it does not undermine the effectiveness of the objective narrative.
And please make sure your writing is as relevant as you can make it. Keep it short and factual. Do not undermine the clarity of your findings by adding emotional qualifiers. There are two questions one of my earliest internal audit mentors taught me that I have never forgotten. They are relevant not just for audit reports but for any type of non-fiction writing you can do … ask yourself for every paragraph in your audit report the following two simple questions:
“Says who?” … where does this information come from and has it been validated as part of my audit? If it has not, you are not doing an audit, you are capturing hearsay. Hearsay is opinion and should never be in a report. Only validated facts and figures have a place in your audit reports.
“So what?” … does this paragraph, this point or this sentence matter for my reader? Does this enhance clarity? Does the report get better when I leave it out or does the point make a difference? If it does not, dare to drop it.
There are good audit writing skill trainings the IIABel offers, and if you feel you need the practice, you may want to check these out. Meanwhile, from the other side of the table, I’m looking forward to the high quality of audit reports I’ll soon see coming my way. And the president’s driver is looking forward to them as well … it should lighten his load carrying more concise and less bulky audit reports.