The audit report represents the end result of weeks of reviews, analyses, interviews, and discussions. It provides important information to audit clients about the area reviewed by internal audit. More importantly, it provides details to management about significant issues that need to be addressed. How well internal auditors communicate that information is critical to getting their client’s acceptance of findings and their agreement with audit recommendations.
Quality reports require thought and effort. Auditors should consider who will read the report, what they will do with it, what level of detail is necessary, what the organization’s culture and norms call for, and if industry-specific language is necessary. IIA Standard 2420: Quality of Communication says communications should be accurate, objective, clear, concise, constructive, complete, and timely.
Inaccurate information could adversely impact the credibility of the entire audit report, so accuracy is critical. All of the numbers should be correct, the information should be factual, and documentation verifiable. There may be disagreement on what the numbers or facts mean, but there should never be an argument about their accuracy.
Accuracy is enhanced by appropriate supervision of the audit engagement. The IIA’s International Standards for the Professional Practice of Internal Auditing requires adequate supervision of engagements, and part of that includes verification of numbers and facts. Accurate and precise information lessens the chance of a misunderstanding.
Objectivity is the second most important quality behind accuracy. If readers feel that the report is not objective, it could undermine the confidence they have in the report. And while the report may be objective, the subtle use and placement of certain words can appear to show bias. This can be crucial to whether the reader accepts the auditor’s conclusions and recommendations.
Objective words are precise. They speak to the facts and can be supported by evidence. Biased words are subject to generalization and distortion of information. For example, the statement, “Very confidential files were just stuck in a drawer where anyone could get to them,” is biased and opinionated. A more objective statement would be, “Confidential files were stored in an unsecure drawer to which unauthorized personnel had access.”
Reports must be clear enough for readers to understand without having to refer to anything else. Language should include precise modifiers and clear technical terms.
Precise Modifiers A modifier is a word or phrase that alters the meaning of another word. Generally, the modifying word should be as close as possible to the word it is modifying. Otherwise, the modifying word could attach itself to a word that was not intended to be modified. This can subtly alter the meaning of the sentence or make it ambiguous.
For example, see how the placement of the word almost changes the meaning of the sentence: “The plane almost failed every inspection” vs. “The plane failed almost every inspection.” The first sentence leads readers to believe that the plane passed every inspection, whereas the second sentence indicates that the plane rarely passed any inspection.
Clear Technical Terms Auditors should consider spelling out acronyms, replacing technical terms with nontechnical words, and embedding definitions within the sentence. For example, “The audit department uses the COSO framework, a comprehensive list of controls, as a standard for controls and risks.”
Readers always appreciate conciseness, but it should not mean cutting down on information. It means using fewer words to convey the same information. Some things that impact conciseness include drawn-out verbs, overstated language, and redundant modifiers.
Drawn-out verbs turn verbs into noun phrases. They often, but not always, contain a noun with the “tion” ending and require a preposition. In most cases, the phrase can be replaced with one word. For example, “Make a determination of …” can be replaced with the word “Determine.” And “Perform a verification of …” can be replaced with “Verify.” Replacing the words conveys the same information with fewer words.
Overstated language uses longer, more complicated words where simpler, shorter words will do. For example, “Due to the fact …” can be replaced with “Because.” And “In order to …” can be replaced with “To.” Again, this doesn’t detract from the information.
Redundant modifiers turn a simple adjective into a long phrase. For example, the phrase, “In the month of May …” can be replaced with the words “In May ….” And the phrase, “On a daily basis …” can be replaced with “Daily.”
Constructiveness primarily refers to the audit recommendations, which should give audit clients information to correct the current problem and also address the root cause so as to mitigate future occurrences. For example, departmental procedures call for inventory to be reconciled monthly. The audit determined that there were three months that did not get reconciled, and the manager explained that the person who normally does it was on sick leave and had no backup. In the audit report, the recommendations read:
“The inventory manager should review the three months of inventory to ensure its accuracy. Further, the manager should cross-train another person in the department to serve as a substitute when the primary person cannot reconcile the inventory account.”
The recommendation addresses the three months that were not reconciled, the root cause, and cross-training another employee to ensure this does not happen again.
Giving management information to correct the problem and keep it from happening again adds to the quality of the report and shows how audit adds value to the organization.
Everything the reader needs to make an informed decision should be included in the report, and no significant information should be left out. The auditor must not omit valid information because it does not support his or her points. Present all the facts and allow the reader to decide.
Standard 2410 states, “Communications must include the engagement’s objective, scope, and results.” So, the report is not complete without the reason for the audit, the final conclusion based on the evidence reviewed, and the amount of evidence reviewed to come up with the conclusion.
Auditors should complete and issue reports as soon as possible to give the audit client a chance to address the issues timely. Timeliness may vary based on things like the audit resources needed to complete the audit, the complexity and significance of the audit, the report review process, and other factors.
If serious issues need to be communicated before the report is completed — such as customer or employee safety or significant loss of assets — the auditor should immediately issue an interim report or memo to allow the client the opportunity to address the problems as soon as possible. The interim report or memo can be referenced in the final report.
An audit report must be accurate and objective; flexible enough to communicate sometimes complex information to various levels of people; and able to withstand the scrutiny of peer reviews and other assessments, depending on the industry. A quality audit report aids audit clients in making informed decisions, so taking the time and effort to put it together benefits the audit client and auditor.