It is always possible to write a better audit report. Needless to say, many reports do not fulfill their purpose. Although deadlines, piecing work together, and maintaining user readability are stress factors, writing a report doesn’t have to be a daunting task.
Knowing the requirements and expectations of the target audience is the first step toward writing a better audit report. Content should be easy to read and provide information to keep the stakeholders’ attention. Several suggestions can help ensure stakeholders read the report and go further into detail.
Include employees in the reporting process.
Organize solution-design meetings, exchange ideas, and get employees’ opinions on action plans, because they are the ones who take the corrective actions related to the findings. Related process owners can suggest different solutions that will help achieve company objectives and have a positive impact on stakeholders.
Determine the target audience.
Who is the report presented to and what kind of business habits do they have? Reports have different audiences — clients, senior management, the audit committee, and regulators — with different concerns and focus points. In short, make sure the report meets the expectations of all stakeholders.
Be sensitive to time constraints. Audit clients have numerous duties and responsibilities, and hectic schedules. They want to read about subjects that are important to them and not have their time wasted.
Thank the client.
Even if there are no positive findings to report, do not forget to thank clients for helping during the audit fieldwork. This goes a long way to help build business partnerships and maintain long-term relationships with audit clients.
Keep reports simple.
State strong points — such as well-designed control processes, outstanding results and achievements, or best practices — in the process being audited. Sentences should be concise, simple, and comprehensible. Long, redundant sentences and repeating what has already been said several different ways does the reader no good. Use shorter paragraphs and subheadings to separate sections. Clients can call if they need more detailed information.
Be careful with executive summary content.
The executive summary should provide an overall picture of the findings and action plans. Keep the details of the work to the main body of the report; don’t suffocate executive summary readers with excessive details, numbers, and data. Just show the big picture. If it’s all given away in the summary, no one will read the rest of the report.
Enlist a report mentor.
After completing the first draft, share it with a colleague and get his or her opinion. Feedback can help reduce the number of revisions, and the reviewer’s experience can be used to the auditor’s advantage.
Though it is the final product of an internal audit, the owner of the report is the client. Instead of using traditional audit reporting processes — which consist of findings, recommendations, management response, and final internal audit opinion steps — schedule meetings with process owners first and then mid-management about the findings and action plan as auditors discover them. Determine an agreed management action, which means action is decided concurrently by both auditor and client. Solution-design meetings include management level in the reporting process, which facilitates report ownership and actions and also helps to simplify reporting. As a result, the C-level is able to see the big picture.
Auditors may have written a “perfect” report that explains all critical risks and recommended mitigating actions, but all of this means nothing unless it is presented to the right people at the right time and communicated appropriately. The key methods to communicate effectively and emphasize value added are determining the distribution list, submitting the report via email and delivering a hard copy, and making a short presentation or holding a closing meeting with key stakeholders to highlight critical issues. Internal auditors miss the opportunity to elevate the level of importance of their work when the work is not completed accurately. They also may miss the opportunity to increase awareness levels of internal audit and internal control within their organization.