Death of the Audit Report: It’s Time to Reconsider How to Convey Internal Audit Findings

Does anyone really enjoy any aspect of internal audit reports? Raise your virtual hand if you like drafting them, editing them, issuing them, or even reading them? It is likely there are very few, if any, hands raised. Anyone who has authored, edited, or received an audit report would probably say they do not look forward to the process—and many would even say they despise it. So why do we issue audit reports? Are we required to do so? And are there other options? Does the return on investment outweigh the time spent drafting, editing, reviewing, and issuing traditional internal audit reports? We’ll explore these questions in depth, but the short answer is a resounding “no!”

When most internal auditors consider why they issue audit reports, far too many say it is because “the Standards require us to.” Well, that is not true at all. The Institute of Internal Auditors’ Standards for the Professional Practice of Internal Auditing states the following regarding reporting the results of internal audit work:

• “Internal auditors must communicate the results of engagements.” – IIA Performance Standard 2400.
• “Communications must include the engagement’s objectives, scope, and results.” – IIA Performance Standard 2410.

IIA President and CEO, Richard Chambers, puts it better when he articulates the purpose of internal audit reporting in his own words: “The ultimate objective of internal audit reporting is not to describe what we found or to make recommendations for improvement. It should be to persuade readers to take action,” he wrote in a2018 blog post on the topic.

Want to learn more on this topic? Register for the free Webinar: The Demise of Traditional Audit Reports: How to Get Stakeholders to Finally Act on Audit Findings. The webinar is free and attendees will earn 1 CPE Credit. REGISTER HERE!

Why Issue Audit Reports?
So, if the Standards do not say, “you must issue an audit report,” why do we do it? Another common response to the “why” question, beyond erroneously thinking that we need to, is: “Because that’s the way we have always done it.” If we are unwilling to accept a statement like that as an answer from an audit client, then that cannot be an acceptable answer for why we continue to issue standard audit reports.

A more sound reason might be: a formal audit report at the end of a project is the best way to sum up the results of all the work, articulate findings and recommendations, share positive outcomes, and generally communicate a conclusion about the entire area under review, with the supporting details behind a final opinion. That’s a far more logical response, but does all that detail really serve the organization best in today’s time-constrained world of information overload, limited attention spans, and “get to the point” attitudes? In some governmental contexts and certain heavily regulated industries, there might be limited flexibility on how audit reports are handled. However, every opportunity to lessen the burden on the reader will likely enhance the likelihood that the report will achieve its desired goal: spurring action.

Jason Mefford, president of Mefford Associates and CEO of cRisk Academy, agrees that it’s time to rethink the traditional audit report and instead focus on the best way to achieve its objectives.”We all need to rethink how we communicate the results of our audit work,” he says. “The typical long, jargon-laden internal audit report may not be the most effective way to do that any longer. In fact, if you want to find an extra 30 percent of time in your budget, quit wasting time writing reports,” he asserts. In a time when efficiency matters, the audit report process may be long overdue for an overhaul.

If we add up all the time spent drafting, editing, revising, re-editing, reviewing, sending out for feedback, modifying, and editing some more, we will likely reach the same conclusion. These tasks require an enormous investment of time and energy, not to mention the opportunity cost of all that time and energy. We’ll ignore any of the built-up frustration rewrites might also cause with your staff, frustration among your clients with issuance delays, and the haggling over findings. If we audited the way some of us develop, edit, review, and eventually publish an audit report, we probably could write a very actionable audit report on just what is wrong with the audit report writing process!

Who Is the Report For and Do They Care?
Remember when our high school writing teachers advised us to begin with the end in mind. The “end” in this case is not issuance of the audit report, the end is having the highest probability possible that our communications prompt people in the organization to work to achieve the desired actions. These are often rather important items, so is having a dense, hard to read, hard to digest, and difficult to act on audit report can be counterproductive.

Other internal audit experts say the focus should be on the purpose of the communication and not the format. “The goal is risk mitigation and operations improvement, not reports,” says Amanda “Jo” Erven, president of Audit Consulting Education LLC. “Communicate clearly and concisely in an effective manner to achieve results.”

Therefore, when considering the importance of an internal audit report, other than capturing what we want to communicate, we need to consider the recipients of the report. I suspect you, like me, have not run into too many people who say something like, “thank you for this audit report, I have so been looking forward to it.” Importantly, we need to have a couple of perspectives in mind when deciding what to communicate and how to report it. Those perspectives are:

• The report, in the end, is just a means of communication. Communication only has value if what the author wants to say is completely and accurately understood as intended by the recipient of the communication.
• The communication is in a form that is most easily digested so it can be acted upon in some way by the recipient, in the manner originally intended.

Given those considerations, ask yourself whether you are fully convinced that the audit reports you and your team have been issuing fully achieve both perspectives as a successful form of communication? What would your audit clients, your executive leadership team, and your audit committee say, if asked?

Let us think about how we digest the barrage of information that comes our way, and how that can help us rethink how we report on our work. Other than possibly a fiction novel, when was the last time you read several pages of material from beginning to end, absorbing every word? We skim, we scan, we jump around the text to find the information we are interested in reading. Other unimportant information in “required reading” often causes our minds to wander— particularly text that is written in an overly formalized and heavily jargoned way that is typical of much business writing. Suddenly we are reading words but not comprehending them. So, because it is “required,” we start again or set it aside for when our attention span is, hopefully, better. Certainly, these same reading and comprehension challenges exist with the readers of our prized audit reports!

In a recent poll conducted on LinkedIn of internal audit leaders, 22 percent of respondents said the average length of their standard audit report is more than 10 pages, and another 48 percent said the average length their audit reports ran 5 to 10 pages. With these lengths, it is possible that such reports are not easy to read or digest. Some internal auditors will readily admit that they are not written with the reader in mind.

How Can We Improve Audit Reports?
Improving our audit reports starts with considering your audience and asking a few simple questions: What information do they need to know? What is the best way to sufficiently document the work that was completed? And, most importantly, what is the best way to convey the findings that, when addressed, will make the biggest impact on the organization.

This brings us to an important point: Don’t sit on important findings to put them in an internal audit report that could take weeks to write. Hopefully, all the reportable findings would have been communicated previously, and the final report you are issuing contains no surprises. So, a short and to-the-point summary might be all that is needed.

Far too many audit reports are built from the bottom up, meaning the authors compile each reportable condition into the report draft and only then add the summary and conclusion. Instead, with “begin with the end” in mind, audit report authors can write the summary and conclusion first, then include the minimum amount of information that needs to be included to support that conclusion. Leave everything else on the cutting room floor since, ideally, you have already reported the relevant details to anyone who needs to know during the audit process.

One practitioner explained that they issue findings as the work is done, as reportable conditions are identified. Their final report is solely a high-level summary of the previously reported individual items, focused on key and important highlights and their conclusions about the control environment of the area, function, or activity being audited. The final report is written with the executive leadership and the audit committee in mind, in as brief a form as is possible, typically well under five total pages.

Another thing to keep in mind is that different people absorb information differently. Some people are more visual learners. Charts, graphs, and images can often tell the story you want to communicate much better than text. Consider using more graphics whenever possible. And use different mediums as well. If audit reports will be circulated online, it may allow for the use of audio and video clips too, especially if they convey the message in a more compelling and precise way.

Don’t Forget the Elements of an Audit ‘Finding’
Regardless of when, how, or what format we use to communicate our internal audit results, there are still some basics that cannot be forgotten when reporting a finding, observation, or specific audit results.

Regardless of how we communicate the results of our audit work, each ‘finding’ must cover certain elements that are fundamental to good internal audit reporting. There are great articles and other material covering the details, but be sure that each finding addresses these elements if you want to completely cover the matter at hand: condition, criteria, cause, effect, and, in most cases, a recommendation.

While it may be premature to mark the death of the audit report, it’s clear that the current format needs to evolve. “I don’t think the audit report will fully die, but rather experience a rebirth as something new and better. Hopefully, it will become more about swift and accurate communications,” says Robert Berry, president of That Audit Guy, an audit consulting and training organization.

Internal audit will always strive to ensure its ability to be relevant and add value. Too often, we as internal auditors do what we do because we are looking at the world through our perspective, what we want and need to accomplish. But this somewhat self-centered approach might actually work against us in our quest to be relevant. When it comes to communicating what we have to report, perhaps the final audit report should be as brief as is humanly possible and use other means to communicate details in a more contemporaneous manner with the actual work being done. The audit report might not be dead after all. But, maybe a more useful refrain applies: The audit report is dead, long live the audit report. 

Hal Garyn is Managing Director and Owner of Audit Executive Advisory Services, LLC based in FL.