An audit issue with too much information can be just as ineffective as an issue with too little information. But how do you know when you're writing too little and when to cut the chatterbox chord on the report? Welcome to the Audit Writer's Hub, an article series that answers such questions. As we progress in the Audit Writer's Hub, we will explore specifics of audit reporting.
But first, let's focus on content. Here are 6 simple content strategies to follow to streamline your audit issue writing today.
Rule 1: Keep the background simple
As an auditor, you're auditing against rules, standards, or guidelines of the company. But this doesn't mean you have to completely share the entire guideline. Share what's relevant to the issue and keep it short. One or two sentences are good.
Too much background typically won't relate directly to the evidence and large quotes or policy statements get overlooked and delay the purpose of the issue. The following examples demonstrate background statements to avoid (✗) and to try (✓).
Travel policy guideline A.1.6 of the ABC Company Policies and Procedures manual states, "Travel advances must be liquidated within 10 business days. Employees with aged travel advances will not be issued additional travel advances until previous advances are liquidated."
✓Travel advances should be liquidated within 10 business days.
Background simply gives your audience enough information to make sense of evidence and conclusions. Keep it simple.
Rule 2: Find concrete evidence
Evidence is a fact of what went wrong. Evidence is concrete and can be proven. It normally contains numbers, amounts, or specific data. Make sure the evidence is important enough to share with an executive. Nominal findings and long bulleted lists and charts can lose (or annoy) your reader. When possible, sum up the evidence into a tidy sentence so they can get an overall understanding of the problem.
Rather than stating true evidence, auditors sometimes skip around evidence and go for something softer, such as:
✗Several employees had open aged advances.
This sentence is full of words, yet says nothing. Avoid such content-free sentences.
Be specific. How many employees? How long were the aged advances open? What was the total number? How pervasive is the problem?
✓In December 20xx, four out of ten employees sampled had $15K total in open advances aged past 90 days.
These facts and figures are important to your audience, who are concerned about specifics and the bottom line – not just generalizations.
Rule 3: Connect the dots with conclusions
To the reader, evidence without a conclusion is just a fact. Take the guesswork out of the evidence and tell your reader what you want them to conclude from the evidence presented.
The conclusion can be a very simple sentence:
✓The country office does not liquidate aged advances on time.
Although conclusions may seem innocuous or inconsequential, they serve a strategic purpose. Conclusions are the metallurgy behind the evidence, the background, and the risk. A good conclusion can even inform the reader that you're aware of the goals of the organization and are finding issues that don't meet the organization's goals.
You have the power to connect the evidence discovered with underlying root causes, and it's just a simple sentence.
Rule 4: Don't skimp on root cause analysis
The root cause is something management can resolve and often boils down to a problem with process, policy, human error, or lack of resources. Use lack of resources SPARINGLY – lack of resources can become a scapegoat from deeper problems. Creative thinking can bring about a solution to most problems.
Sometimes auditors skirt the root cause. It can be intimidating to tell the auditee why you think that the issue took place or even implicate a job position or process. However, if you have evidence and conclusions in place, you can engage in a more thoughtful conversation with the auditee to discuss the root cause and potential solutions.
There are many articles, presentations, and training courses on Root Cause Analysis. A quick rule of thumb is to never settle for the first why. Drill down a few times, asking why, until you get to something management can resolve.
Root cause analysis can be like peeling an onion– you just keep peeling away layers. You can analyze root cause to a point that management can no longer solve the issue and is left helpless. That's too much. Drill down to where management can resolve the problem effectively, and let it go there. Persistent control issues (e.g., "Headquarters not communicating with satellite offices.") may be best reserved as an overall audit observation in the executive summary.
Rule 5: Glue the issue to the company with effective risk assessment
The business impact (or risk) is what the company risks if the problem goes unresolved.
Conclusions and risks are different.
The conclusion only states what happened based off of current evidence specific to the issue:
✓As a result, the company lost $3M during the first quarter. (Conclusion)
Whereas the risk states a larger conclusion of what could go wrong if the issue goes unresolved:
✓On the same trajectory, without a strategic plan in place, the company could lose an additional $4.4M in the second and third quarters of 20xx. (Risk.)
Assessing overall risk may seem like too much speculation, but think about the reader. They want to know risk. They want to know risk so much that they hired an entire team of smart, skilled professionals to help them assess and mitigate risk: internal audit. The audit issue being written is for the management, the executive, the audit committee, and others who want to know risk.
What a rare opportunity it is to be an auditor! Auditors see the nuts and bolts of what make a business jive. They get to be in the trenches with the auditee and then give the bird-eye view of how issues affect the company as a whole. Auditors can influence positive change!
Rule 6: Recommend solutions that fix the problem
Once you gather evidence, draw conclusions, assess risk, and engage in root cause analysis with the auditee (when appropriate), you can better develop solutions as a team. If you don't have a solid root cause, then your recommendations will be futile. On the other hand, sometimes root causes are discovered as recommendations are made.
✓Root cause: Lack of training. Recommendation: Update training and train every six months
✓Root cause: An outdated process. Recommendation: Update the process
✓Root cause: A manual process that led to errors. Recommendation: Automate a process with new software
These are obviously simplified versions, but you get the point. Recommendations primarily speak to the root cause. As needed, include both short and long-term strategies for success.
Final tips: Write with purpose
Each sentence you write in an issue should cover these strategies. It's easy to scribble a list of these 6 elements:
Background
Evidence
Conclusion
Root Cause
Risk
Make sure all your sentences fulfill one of these basic elements. If the sentence you write doesn't fulfill one of these basic elements, then it's probably a superfluous sentence. Take it out so your reader can enjoy the beauty of a well-written audit issue.
No one ever wanted to read an audit novel.
Learn auditing skills online and on-demand with AuditProTV. AuditProTV is subscription-based, on-demand audit training that's effective and engaging. Learn more about it here.
IT Audit
Business Communications