Some Radical Advice for Writing Better Internal Audit Reports

GUEST BLOG POST:
Having read more than 4,000 internal audit reports over the years, I can honestly say I’ve never read a single one I’d wished was longer. Most of the time, I’m wishing it were over halfway through the so-called “executive summary.”

Most internal auditors—and others—drafting audit reports completely forget about their readers. They forget what it is like themselves to read long, convoluted reports full of overblown and sometimes simply misused language.

Long words and long sentences don’t impress readers—they simply irritate and exhaust them. Try to keep your sentences to fewer than 20 words (in English), and use short, simple, plain words. If you fear that the reader will think less of you for not flaunting your advanced vocabulary—don’t. The reader will notice nothing except the message, flowing clearly and cleanly, unimpeded by verbiage.

It’s not just about internal audit reports that are too wordy and contain long paragraphs with run-on sentences, however. Too many audit reports also wallow in using the passive voice, rather than the active voice, where the doer of the action starts the sentence. “The procedure was not followed,” they write, for example, rather than: “The business unit team did not follow the procedure.”

If you limit your use of the passive to less than 20 percent, the internal audit report will be easier to follow. Your voice will also come across as more credible and convincing. For those who worry that stating facts plainly is undiplomatic, keep in mind Standard 1.1 of the new Global Internal Audit Standards: Honesty and Professional Courage. Favoring the active voice isn’t picking a fight—it’s communicating the facts clearly.

Clarity suffers when we don’t have the facts, or when we are vague about them. Certainly, the passive voice can obscure what is happening or who did what. But what I call “corporate-speak” also plays a big role in hiding the message. Most of you can think of terms popular in your organizations—how many of you can say exactly what they mean? I’ve seen HR teams argue about what exactly they mean by “onboarding,” assurance teams struggle to define “formalize,” and everyone losing patience with classics such as “going forward,” “impact,” and others.

Toward Radical Reporting

These are just some of the common mistakes internal auditors make when writing audit reports. In fact, the need for better report writing inspired me to write Radical Reporting: Writing Better Audit, Risk, Compliance, and Information Security Reports. The first edition came out in 2022, and the second edition has just been published (an excerpt from the book follows). The first edition was the bestselling title in its list in 2022, and assurance professionals across the world found practical, empathetic advice in each chapter.

The book draws on my experience not only as a Certified Internal Auditor and global trainer in written communications, but also as a language professional. As a freelance writer, copyeditor, and translator, as well as a background in language teaching, I see firsthand how logic and language intertwine—and sometimes tangle.

Why radical? Because the word radical means going to the root of something—in this instance, written communication. Unless we understand the deep-seated causes of unclear writing, how can we improve?

Radical Reporting approaches report-writing from three angles: words in the mind, on the page, and into action. Each delves into areas we often forget to consider or think we don’t have time for. Yet if we don’t pause, take a breath, and think hard before writing, nothing we produce will help organizations improve.

“Words in the mind” is about how we use language, through cultural and organizational conditioning. Understanding this is the foundation of any thoughtful, effective communication.

Cultural conditioning is both vast and varied: linguistic, regional, national, social, and yes, organizational habits and norms inform everything we think and do. Even in small organizations, based in one region that uses perhaps only one language, misunderstandings always arise.

This is because—in spite of our conscious awareness that our individual ponds are not the ocean—we cannot help but subconsciously write from our own perspective. It takes tremendous discipline to look outwards, to consider others and their unique backgrounds and influences.

Yet everyone is busy, tired, juggling multiple tasks—imposing that discipline is always hard, especially under pressure. When we add the temptation of habit, using shortcuts such as cliché, jargon, or even AI-produced text without checking it first, bad writing abounds.

The book also openly—and, I believe, uniquely—addresses the topic of fear. This isn’t simply about working in organizations with toxic cultures (although they breed both fear and bad writing). It’s about the fact that most humans experience a range of emotions throughout the day, and fear of different consequences is one of them. Fear of upsetting a reader with too direct a statement; fear of using plain language, which some people wrongly assume is unprofessional; fear of conflict through a clearly stated difference of opinion. Few of us get through an average week without one of these situations arising.

We must think clearly, with full awareness of our and others’ assumptions and biases, before we can hope to write clearly. And writing clearly is no easier.

The Importance of Structure

Once you have weaned yourself off corporatespeak and reduced your reliance on the passive voice, think about structure. Executive summary, findings, appendices if necessary—that’s all any report needs. The executive summary is your “elevator pitch”—what would you tell the chair of the audit committee, or the CEO, in 30 seconds?

Findings—issues, observations, whatever—should go straight to the failed or non-existent control, the risk, and the root cause. Anything else is fluff; anything other than these three elements may be a finding, but wastes the reader’s time. If you do feel that some readers will want extensive background, detailed test results, or references to regulatory guidelines—well, that’s what appendices are for!

I’ve known several people recommend a “storytelling” approach to internal audit reports, and I still don’t understand why. With the exception of fraud investigation reports, a chronological approach makes no sense. You have an executive summary, putting the bottom line up front—telling a story with a beginning, middle, and end is the opposite. It trespasses on the reader’s time and goodwill.

Finally, the book considers the first readers of any reports—those who review drafts. I can’t promise that the tips and insights in the chapter on reviewing and editing will make the process a pleasure—but they should reduce the pain.

Below is an excerpt from the second edition of Radical Reporting. Enjoy! (For more information on Radical Reporting: Writing Better Audit, Risk, Compliance, and Information Security Reports, or to buy the book, go here.)  

Sara I. James, PhD, CIA, has over 30 years’ teaching, writing, publishing and corporate experience in the U.S. and Europe. She provides report-writing training worldwide through her business, Getting Words to Work^®. She is also the author of the bestselling Radical Reporting: Writing Better Audit, Risk, Compliance, and Information Security Reports and was one of Richard Chambers’ 2022 Internal Audit Beacon Award winners.