Writing an Impactful Audit Report
Not only is an internal audit important for ensuring information security and regulatory compliance, but it’s also a valuable way to evaluate company performance and manage risk. It is a helpful tool for businesses of all types. An internal audit assists an organization in defining areas where it could improve, while also providing information it needs to accomplish its goals.
During my career as an internal auditor, I wrote or edited hundreds of internal audit reports – some that were good, and some that could have used another round of edits. Following are some recommendations that can help ensure your audit reports are effective – that they will not only change minds but that they will create a call to action that gets results.
1.Keep It Short
I am not opining on the report’s findings or the politics still swirling around it. I can appreciate the need for detail. The scope of the review was daunting, the issues were complex, and every aspect of the engagement was surrounded by controversy. But it’s always important to keep the readers in mind, and the style that works for a major IG investigation probably would be inappropriate for your internal audit department. Trying (and failing) to read the IG report in a single evening reminded me of the words of the great Winston Churchill, who said, “This report by its very length, defends itself against the risk of being read.”
The lessons for internal auditors:
- Internal audit reports are most persuasive when they are tailored to our stakeholders’ needs
- If we overwhelm our readers with too much information, our reports will have less impact. If a word, idea, or sentence does not contribute directly to the point, consider eliminating it.
2 .Keep It Simple
The best internal audit reports express big ideas in small words, never small ideas in big words. Our writing is most persuasive when we use clear, direct, and familiar language. This does not mean “dumbing down” our reports; it does mean clear and effective communication — the opposite of legalese.
There is compelling evidence that plain language is more likely to be read, understood, and heeded in much less time. In 1989, the U.S. Navy conducted a study of officers who read business memos written either in plain English or in a bureaucratic style. Officers who read the plain memo:
- Had significantly higher comprehension.
- Took 17 percent to 23 percent less time to read the memo.
- Felt less need to reread the memo.
Many internal auditors use tools such as the Flesch Reading Ease or Flesch-Kincaid Grade Level tests to determine whether their reports are readable. Those tests are available online at no cost, or if you prepare your reports using Microsoft Word, you can choose to display information about reading level when you finish checking the spelling and grammar.
- Don’t Neglect the Basics
Ever received a resume or business proposal that contained spelling or grammatical errors? You probably thought twice about seriously considering the individual or company that sent it. The same goes for your audit report. If it contains misspellings or incorrect grammar or punctuation, readers may get the impression that you are not detail-oriented or, worse, careful about your work. Even a single error can adversely impact your credibility. It may not be fair, but if your report contains errors (careless or otherwise), your well-reasoned arguments may fall flat.
The lesson for internal auditors: Pay attention to details. It’s difficult to be persuasive if you lose your credibility because you ignored the basics.
4.Remember the Five C’s
An IIA seminar, Audit Report Writing, describes five important components of observations and recommendations:
- Criteria (what should be).
- Condition (the current state).
- Cause (the reason for the difference).
- Consequence (effect).
- Corrective action plans/recommendations.
Even if you use the five C’s, your report might not be persuasive. But without the five C’s, your odds of success will plummet. Your description of potential consequences is particularly important.
What Happens During an Internal Audit?
When an internal auditor comes into a company or organization, they analyze documents regarding the company’s risks, objectives and performance, as well as observe how particular strategies are being implemented. Experts recommend relying on outsourced auditors as they are better able to view the operations of the company objectively and without the bias typical of actual employees.
During the audit, skilled professionals who know what to look for will observe, take notes, review documents and interview employees. Auditors will often test employees’ knowledge of company objectives, safety standards and compliance rules.
Purpose of an Internal Audit?
Auditing on a periodic basis keeps a company – big or small – and all of its employees at the top of their game. Regular internal audits are important for organizations in a wide range of industries, including financial institutions and healthcare providers. They are positive experiences for the business aimed at evaluating performance and identifying actionable ways to improve in the future.
Read more about the Auditing or for any Query to keep your company running safely and efficiently.