Are most internal audit reports the right length? For many consumers of audit reports in the executive suite and boardroom, the answer is probably that they’re “too long!”
Audit reports may run to extraordinary lengths these days. For example, I recently talked to one organization where they could easily extend over a hundred pages. One hundred pages is clearly too long for anybody to rationally expect our stakeholders in top management and on the board to want to read them. When is there 100 pages of value, actionable information, in an audit report?
So, is the answer ten or twenty pages? Is it two or three? Let’s tackle the question a different way.
Audit reports are a communication vehicle. The IIA Standards do not require that we write an audit report. Instead, they require that we communicate the results of our work to our stakeholders. So, a better question is: What should we communicate?
When Will It Stop Hurting?
When you visit the dentist because you have a toothache, do you want even a three-page report? Probably not. You want to know: (a) Can he or she stop the pain? (b) When will that be done? (c) Is there a serious problem? And (d) What is this going to cost me? You don’t want to be asked to read a recap of your dental history, the status of recommendations from your last visit, or a report on the depth of your gums. You want to receive the information you need, concisely and clearly written, without wasting a minute of your time.
See Also, “Death of the Audit Report: It’s Time to Reconsider How to Convey Internal Audit Findings“
What about your executives and board members? What information do they want to get from you? They want to know:
- Is there a problem that is serious enough to potentially affect the organization and the achievement of its objectives in a material way? Is there a problem I need to worry about at my level?
- Are the right actions being taken?
- Is there anything I need to do personally?
- Is there anything I need to make sure others are doing?
So why do we include more? Is it because we feel a need to justify our existence? I know of chief audit executives who insist that every audit report has at least one finding and recommendation. Why? If you have this need, this irrational compulsion, stop!
Is it because the report is a form of documentation, or because it is really being written for a regulator rather than the executive readers? Both are equally wrong.
The Elevator Version
Imagine this. You enter the elevator at your company’s head office and are greeted by your CEO. She asks you about the audit your team recently performed of the Treasury function, saying that she is interested in the results. Do you tell her about the background to the audit? How about your scope and objectives? Do you list all the medium and low issues? Or do you just tell her whether there were major issues that merit her attention, whether management is taking the right corrective actions, and any other insights that would be of value to her?
So why do we put more than these essentials in a written audit report? Why hide valuable, actionable information in a haystack of unnecessary detail? The length of the audit report, if one is even needed, should be just enough to tell the consumers of the report what they need to know—and no more.
Ah, I can hear you saying that the report has to include all the findings so you can make sure management owns the issues and will take necessary corrective actions. But do the executives and board members need to see that level of detail in the report? Weren’t these all discussed and agreed upon at your closing meeting (and if not, why not)?
Send a note to those present at the meeting, confirming the discussion and the corrective action details (who will do what by when, and other details). And then keep what you send to the executives and the board limited to what they need to read and no more.
Make it easy for them to pick up your reports promptly, digest the actionable information, and take whatever actions are needed—now, when they are needed. Make it easy and not hard for them to read, understand, and take any necessary actions.
If you don’t waste their time with trivia, when you have something to say they are far more likely to listen.
What say you? Can we cut most audit reports back to half a page? Let’s hear your thoughts in the comment section below. 
Norman Marks is an internal audit and risk management expert and author of the blog, “Norman Marks on Governance, Risk Management, and Audit.” He is also the author of several books, including World Class Risk Management, Risk Management in Plain English: A Guide for Executives, and Auditing that Matters.
Cutting audit report back to half a page, this depends on the number of risk issues that require Management/Boards attention, as a result you may find that it is not possible to remove out some of the issues in order to make the report short as possible.
I can say that , this will be handled case by case, not all reports will have the same requirements in terms of length.
Many think that the number of words in the report, proves our value as auditors. It’s the minds of your leaders and your direct boss that you have to win first.
Great article. I personally believe that the right message has to be delivered to the right audience in a shortest possible way. The Board and Sr. Management are definitely not interested in the 100 pages. Even its too much for the operating management to grasp and action. I personally try to summarize the key points in 3 ppt slides for sr mgt and the Board.
It’s true. Many times I felt that when a organization performs well, I wanna give a clean report says that i have checked these areas and this much samples, the internal controls are good provided organization is performing well . But, it raises questions from both sides that audit is not performed/conducted properly.
Executive Summary featuring all the most important findings. No more than 4 pages. Then the rest of the report giving full details of ALL findings with no predetermined limits on how many pages. If you have found breaches they MUST be identified.
Is important to communicate key findings in the best possible way. I agree that an audit report should not be too long, because management do not have time to read lengthy reports. They all interested in the findings. The scope also should be reasonable so that reports are produced on time and be relevant.
The way we do it in our organization, we prepare one slide for each audit presenting the High and Medium points; sometimes Low depending on the audit, to Audit Committee members and Top Management. The lengthy audit report is usually for the department head and his/her employees so they can have the full background on the finding, risk and provide a timeline to accomplish.
Communicate what Management / Stakeholders don’t want to hear as long as those points are backed up by evidence and for the good of the entire organization/community where the business operates.
Are we talking about something like the external auditors report?. It would be fine, but, there might be someone who is interested in the depth of the work done. How would that be satisfied?