The audit report was 25 pages long. The results didn’t begin until page 16. Even worse, the audit’s purpose was not revealed until well into the document. It appeared past the auditors’ signatures, past a boilerplate that defined internal audit’s role and established its independence, and past a description of the standards that were audited against. On the fourth page, 600 words into the audit report, the authors included just a single sentence that explained, albeit vaguely, why the audit had been performed.
This is a true story, but it is not a tale of incompetence. Indeed, the audit itself represented superior work performed by a proficient and experienced practitioner. The anecdote instead points to a far-too-common breakdown between performing internal audit work and communicating results. It demonstrates audit reporting that focuses too much on the audit and the auditor, and not enough on the clients and their business objectives.
To fix this problem, auditors must train themselves to write audit reports with audience awareness. Putting that skill into practice, however, requires the support of audit management and the trust of the audit client. With these elements in place, auditors can produce reports that serve as a much more effective communication vehicle and provide greater value to their clients.
Making the Grade
In an article titled, “Understanding a Writer’s Awareness of Audience,” author and writing professor Carol Berkenkotter analyzed expert writers and the role of audience awareness in their composition process. Her work was inspired by “The Cognition of Discovery: Defining a Rhetorical Problem,” a study by researchers Linda Flower and John Hayes that found experienced writers formed a mental image of their readers. College freshmen in the study struggled to think beyond the topic and content of their essays.
“Unlike real-world writing situations,” Berkenkotter wrote, “which confront the writer with a variety of rhetorical situations and audiences with differing needs, school writing demands that the student write for a single authority, the teacher.” As a result, success in the writing process is determined by the student’s ability to demonstrate his or her expertise on a given subject to this authority figure.
Although professional auditors have left behind the classroom setting, reverting to a classroom mindset when writing audit reports can easily result in a focus on demonstrating the auditors’ own authority. Reports produced this way often fail to effectively communicate the audit’s value or meet stakeholder needs.
Fortunately, writing with audience awareness is a skill that can be learned and developed. Writers who exhibit audience awareness, Berkenkotter found, engage in four main types of activities — as shown in “Audience Awareness” below. Each activity is accompanied by a list of questions, shown in the right column. Berkenkotter suggests that with practice over time, addressing these questions becomes less of a process and more of a state of mind. “Professional writers automatically internalize their audiences; as they write, they ask themselves the questions that their readers might be expected to ask,” she says. “In the process of being one’s own reader, an expert writer is constantly revising [his or her] own work.” This imagined audience, she adds, becomes the touchstone upon which the writer bases his or her decisions, including organization.
Structure and Sequence
Audit report content should be organized by its importance to the audit client. Beginning the audit results only after pages of describing audit procedures, as the report cited earlier did, makes sense only to the practitioner who has been immersed in the engagement for months. For internal audit stakeholders, seeing and understanding the results is more important than knowing how the results were found.
As a practical guide, the content of a client-focused audit report should be prioritized by four main areas:
- The reason for the audit, related to client business objectives.
- The results of the audit and their impact on client business objectives.
- Recommendations, if any.
- Information about the audit process and the auditors.
Although this structure reflects the order of importance, it does not strictly dictate the sequence of the report. For example, some information about the auditors and the audit process may be interwoven throughout the document — auditors don’t necessarily have to place it all at the end. What matters is whether the report is client-focused (as opposed to audit-focused) and whether it prioritizes the information most important to the clients.
Audit reports, in other words, should not all follow the same template. Decisions about what to include, what to leave out, and how to organize the report should be made based on awareness of the audience. Writing with audience awareness will help auditors overcome the task-oriented mindset that results in audit-focused reports. But to put this technique into practice, auditors must believe they are empowered to change.
Culture and Empowerment
The audit report that tells stakeholders what auditors want to say is an artifact encountered by many new practitioners when learning the profession. Cultural subtleties, such as referring to the report with words like “deliverable” and “work product,” reinforce the notion that the report’s purpose is to document internal audit’s execution of the engagement.
To change this mindset, audit managers and chief audit executives (CAEs) must begin to empower their staff members and require them to take a different approach to reporting. Regardless of how many articles they read or seminars they attend, practitioners will never change for the better if their audit department’s culture includes an unspoken expectation that audit reporting involves filling in old templates. When CAEs and audit managers read audit reports that begin with, “Internal audit conducted a review of …” they must start sending them back and coaching their staff to write reports that focus on the client’s business objectives.
In fairness, because the audit report typically serves as the primary method of documenting what happened in an audit, practitioners will naturally want to justify their value by demonstrating the volume and quality of the work performed. Rather than asking the auditor to merely suppress this inclination, audit managers can relieve the burden by giving auditors other outlets through which to communicate in detail about the rigor and quality of their work. For example, managers could simply meet with auditors to discuss the execution of a given engagement, allowing the auditors to discuss how much time they spent on it and any difficulties encountered, as well as revisit decisions that were made. These types of details — important to the audit process but too granular for the client — should be documented in the audit’s workpapers for later reference. The documentation can help assure auditors that even though clients might not be apprised of process minutia, audit management understands and appreciates these details.
To make the transition from defensive audit reporting that focuses on process documentation to reporting that is proactive and focused on audience utility, internal auditors must also have the trust of their clients. One reason audit reports often contain excessive process detail is that practitioners worry clients may be resistant to, or suspicious of, the audit process — especially if the client might view the results as unfavorable. When this occurs, internal auditors focus primarily on defending their work and results rather than communicating what those results mean to the client’s business.
To overcome this defensive mindset, internal auditors must constantly work to strengthen trust — in both the audit function as a whole and each of its practitioners, from one engagement to the next. If clients receive regular communication throughout engagements, understand that internal audit’s mission is to help the business achieve its objectives, and have been educated about the audit process, they will be able to accept audit reports with trust, boilerplates and disclaimers aside.
It’s About the Audit Client
Writing engaging audit reports that are suited to the needs of the individual client can be liberating for practitioners, but it also represents a challenge. Outside the safety zone of template-based reporting, auditors must make careful choices about what to include, what to exclude, and in what order to place information to maximize the client’s perception of report quality and utility. However, the payoff for practitioners willing to undertake this challenge is enhancing their clients’ understanding and appreciation of the value of internal audit.
Source: Internal Auditor: It's not about you! (url), It's not about you! (pdf)