Audit reports
Lawrence Sawyer, one of the “fathers” of modern internal auditing once observed that, “Few sources of friction within the
auditing department exceed that caused by the process of report writing. The most brilliant of analyses and the most
productive of audit findings seem to be forgotten during the trauma of report writing.” From my experience truer words
have never been written.
I learned early in my internal audit career how time-consuming and frustrating it could be to write an effective audit report.
No matter how well I thought I had captured the results of the audit, the audit team leader would inevitably rewrite much
of what I had written. To make matters worse, the chief audit executive (CAE) then would rewrite substantial portions yet
again. As my career progressed, I later found myself fulfilling the roles of team leader and CAE that I had so vilified earlier
in my career. I became just another culprit who rewrote internal audit reports and perpetuated the age-old tradition of
changing “happy to glad.”
Team leaders and CAEs aren’t the only contributors to the report timeliness challenge. As I illustrate for students in my
new seminar, “Auditing at the Speed of Risk,” depending on the size and structure of an internal audit department, there
can be several other “cooks in the kitchen” when a draft report is being finalized. These can include additional levels of
review, legal reviewers, professional editors, and the quality assurance review team (referencers). By the time everyone has
taken their shot at a draft report, it can sometime take as long to issue a report as it took to perform the audit!
The impediments to timeliness of audit reports are not even limited to the players in the internal audit department. As
most internal auditors have experienced, the release of an initial draft is sometimes only the beginning of the timeliness
challenge. The draft report frequently is received with a resounding thud by those whose areas of responsibility were the
subject of the audit. Thus begins the negotiation process and give-and-take over the draft report that may add weeks to
publishing a final report.
Over the years, I have led or worked with numerous internal audit departments that have tackled the audit report timeliness
challenge. Many of them have achieved enviable results in reducing the audit report “cycle time.” From my experience,
there are at least five strategies that (if deployed effectively) can substantially reduce the amount of time it takes
to report audit results:
- Share internal audit results with client “as you go” — Client “push-back” against an audit report can be intensified by the shock effect of seeing all of the results at once. Providing the client with results incrementally can help. Once the internal audit team gets to the point in the engagement where they are satisfied there is a reportable condition, you should share the information with your client, either informally or through an interim audit memorandum. Regular communication with clients during the audit—including sharing draft findings and recommendations in writing—goes a long way toward fostering a positive reaction when the full report is presented for comment.
- Eliminate or reduce levels of review — As Sawyer observed, multiple levels of review within the internal audit department are often a major source of delays in audit reporting. Streamlining the review process and reducing the number of reviewers can shorten and speed up the process. Large organizations in particular seem to get quite a few people involved in crafting their engagement reports. Yet, in my experience, the reports produced for these organizations are not necessarily better than reports written elsewhere that undergo only one or two reviews. Many of the organizations I’ve worked with over the years have found that, if you eliminate some of the additional reviews, the reports move along much more quickly. Others have delegated the reviews to lower-level staff. Such tactics entail some risk; every additional review provides a fresh viewpoint and a different level or type of expertise, while having more-senior staff do reviews ensures more experienced eyes will examine the drafts. Sacrificing those could affect reports’ accuracy, clarity, and constructiveness; for example, considerations that should be weighed when attempting to speed up the process. Reducing levels of review is a way to move the audit along faster, but it pays to consider the risks.
- Use team editing or report conferencing — Bringing the audit team together with all of those who will edit or review the draft report for a single editing session can reduce reports’ cycle time dramatically. This approach allows the internal audit team and the department’s upper-level supervisors to discuss the draft report and propose changes without the endless back and forth of the usual editing process. This is a strategy I used when working for the USPS Office of Inspector General several years ago. Team writing brings together the engagement team, the first- and second-level reviewers, the editor, the quality assurance team (referencers), and the lawyers (if any are involved). Everyone sits around a table in a conference room, with the audit report projected onto a screen at the front of the room, and each person commits to not leaving that room until the review process is complete. When team editing is done correctly, once you’re done, you are done. You don’t have to worry about anyone circulating new versions of the report, and the draft report gets out the door much sooner.
- Use automated working papers’ report-writing features — Commercially available audit management systems often include features in which extracts from the electronic working papers are automatically imported into a draft report template. In such cases, the draft audit report virtually writes itself. This can generate major efficiencies in the report-writing process.
- Streamline the report format — Internal audit departments that have successfully reduced their reports’ cycle time generally produce leaner audit reports, which makes them not only easy to edit but easy to read. The shorter a report is, the less time it typically takes to write and edit. Complexity can also slow the review process, so generally speaking, simpler is better, too. And reaching consensus with clients can become onerous with longer reports, so streamlining formats pay dividends throughout the process. I have on occasion seen internal audit reports that exceeded 100 pages. I am convinced reports that are long are not read in their entirety by all of those who were likely to benefit from the information. It’s always tempting to include more detail in an internal audit report than the minimum needed to make your point, but my advice to new auditors is to tell your story clearly and succinctly. There’s nothing worse than working hard and coming up with a good report that people then ignore. Think of it this way—the longer your report, the less likely it will be read by those in a position to take action on your recommendations.
There are no quick solutions or easy answers to the age-old challenge of audit report timeliness. However, from my
experience, internal audit departments that recognize they have a timeliness challenge and seek to reduce cycle time can
make an impact. The strategies outlined above have worked in numerous organizations around the world. I would be
interested in hearing from you about any additional strategies for success
- Log in to post comments
