The Art of Internal Audit Reporting: Direct Impact and Clarity

Internal audit (IA) reporting may be the biggest challenge in the audit process, next to scheduling the audit itself and implementing recommendations in today’s complex, competitive corporate environment. An audit report presents the results of an examination or review within the organization and is considered by many to be the core deliverable of audit services. Therefore, the importance of effective reporting generally cannot be overstated.

IA reports and communications strive to increase risk awareness and prompt action to improve internal controls or operational effectiveness. Management and the audit committee are interested in the status of the risk and control environment and the effectiveness of operations. They are key audiences for IA reporting.

Below are general considerations for effective IA report writing, followed by a sample report to the audit committee. In the context of IA service delivery, both examples illustrate the importance of setting appropriate expectations, defining the scope of services and managing expectations.

Each organization will have unique reporting practices that affect the format, frequency and depth of its communications. For instance, the chief audit executive or director may report quarterly to the audit committee on the status of the annual audit plan, significant findings, changes in risk or audit resource issues. Audit management also may communicate with management or other stakeholders on a regular or ad-hoc basis. The advice that follows will assist in the development of any audit communication.

Determine Your Purpose

Before creating any communication, consider the objective: What do you want to accomplish? Is your purpose to inform the audience or persuade it to take action? Your approach may differ significantly depending on your goal. An “audit report” can take the form of a phone call, email, official memorandum or formal audit report. Tailor the information accordingly. For example, if you are simply sharing information about the status of an audit, provide straightforward facts. However, if you are making recommendations to help achieve cost savings in a certain area, you’ll need to make a strong case for implementing your suggestions. Be sure to support your conclusions and incorporate quantitative results because hard facts help clarify decision making and motivate others to act.

Develop a Structure

Next, consider how you will present the information.

Effective communication requires an organized series of thoughts. Before you begin the report, develop a list of main points. This is an especially critical step when you’re conveying a complex message. A well-developed outline will help you stay on point and address all relevant issues. The outline also may help you gain support from the executive sponsor. Sharing it with other parties involved in the report can minimize subsequent review and editing.

Most people reading your report will be familiar with the topic, and their primary interest will be the bottom line. Therefore, while providing the necessary historical perspective, avoid including too much background in the document’s introduction.

When considering which content to include in your report, keep the following in mind:

• The audience — How will the report strike the appropriate tone and level of detail?
• Report use — How will the report be used and for what purpose?
• The “so what” test — Are all data elements and conclusions valuable?

In your audit report, begin with conclusions or recommendations and then offer supporting reasons. Then be prepared to offer additional detail or supporting analysis for those who are interested. Such details may be included in clearly labeled appendices to the report.

Separate the body of a written report into distinct sections with clear headings (for example, “Significant Findings,” “Competitive Analysis” and “Potential Risks”) so readers can easily locate information. Keep in mind that business reports do not need to be entirely text-based. Diagrams, flowcharts or graphs often can make your case more effectively or persuasively, particularly when presenting financial data or describing processes.

Consider writing an executive summary for readers interested in high-level results and recommendations. If your report becomes lengthy because of extensive project scope or findings, consider preparing an executive summary for each section. The summary should explain the purpose and conclusions and present the data supporting your analysis. To determine what to include, reread the document and highlight key information as you review it.

Be Succinct

Keep reports simple and concise. Let your readers know, from the outset, what topic you are addressing and why it’s important to them.

Tailor the information to your audience’s level of knowledge. Although your company’s chief financial officer will be familiar with accounting terminology, other department managers who see the report may not be. Use plain English whenever possible and avoid buzzwords or acronyms unless everyone reviewing your findings will understand them.

If you do need to use acronyms or specialist terminology, be sure to provide explanations. Consider appending a glossary of terms so that readers who need them can look up definitions without disrupting the flow of the report.

Pay Attention to Details

Remember that the little things can make a big difference. Always proofread carefully. Spelling and grammatical errors reflect poorly on your attention to detail, one of the primary qualifications of an audit or accounting professional. Although your computer’s spell-check function can help, it may not catch errors such as incorrect word usage or omitted phrases. Take the time to review reports closely.

Finally, here is a quick checklist with some guidelines and tips for giving your reports impact and clarity:

• Review the IIA Standards for guidance on communicating results.
• Write a descriptive title that includes the audit objective.
• Describe the scope of the review and the date of the fieldwork
• Use objectivity. Your reports and communications should be without bias.
• Be constructive. Focus on improvement rather than condemnation.
• Be neutral. Point out requirements and contrast them with the actions taken rather than directly identifying policy violations.
• Let people remain nameless. Avoid identifying individuals; instead, describe positions and functions.
• Present a balanced perspective. Be sure to include management’s responses to related findings.
• Follow an informal “no surprises” rule. Substantiate all findings in advance and agree on conclusions and recommendations with process owners or auditees before reporting them.
• Focus on key performance metrics and essential pieces of information rather than peripheral details about the project or area under review.

Submit timely reports. Communicate results immediately after completing fieldwork, especially if there are significant findings requiring immediate action. Consider immediately escalating extremely important issues or events to both executive management and the audit committee.

Develop a standard audit vocabulary. Agreed-upon descriptions, performance thresholds and indicators, such as red-yellow-green or A-B-C grading, will help audit report writers and readers understand the importance and consequences of reported issues.

The most controversial aspect of IA reporting is report language. Language conveys meaning and tone and can be used to praise or condemn. In general, audit language should remain as neutral and professional as possible. Encouraging, constructive words will help facilitate progress and the acceptance of action plans by all parties. Avoid condemning language such as “did not perform” or “failed to control.”
Remember that the goal of audit reporting is to raise awareness and effect positive change, not create consternation and political conflict.

These tools on KnowledgeLeader provide different examples on how to write audit reports:

• Financial Reporting Process Review Audit Report
  Streamline financial reporting and close processes with actionable insights, optimized workflows and enhanced compliance strategies.
• Internal Control Review Conclusion/Opinion Guide – Writing Example
  Use these writing examples to develop clear conclusions and opinions for an internal control review.
• Post-Implementation Controls Audit Report
  Evaluate the effectiveness of your newly implemented enterprise resource planning (ERP) systems.
• Pre-Audit Readiness Audit Report
  Address revenue recognition, equity awards, valuation, Section 409A impacts and documentation gaps before finalizing the general ledger.
• Treasury Review Audit Report
  Strengthen financial integrity with insights that help optimize treasury controls, processes and risk management.