A significant amount of time is committed to any internal audit. Scheduling, planning, information requests, questionnaires, walk-throughs, interviewing, testing and documenting are all part of the audit process. Yet, even though 90 percent of the hours are allocated to these aspects of the audit, the main thing, and sometimes the only thing, the stakeholders will remember is the communication of the results. The way findings and observations are communicated written and verbally by the auditor will impact the perceived quality and value of the audit.
Effective communication of audit results helps foster a constructive relationship between management and internal audit, increases the rate of resolution of observations and recommendations, and improves efficiency of the internal audit department. For management, reports serve as a window into daily operations, a means to evaluate operating performance, a source of objective information about controls and operations, and as a facilitator for gaining support of upper management for issues requiring attention. For internal auditors, reports enable audit follow-up, provide a means to teach and train audit staff, summarize results of audit work and support the auditor’s performance evaluation.
The goal of effective reporting is to help ensure stakeholders’ understanding of the issues, the risk and impact to operations and to share practical solutions. This can be achieved by implementing simple best practices.
5 Best Practices in Communicating Internal Audit Findings
1. Have discussions with the auditee
The auditee can provide insight on matters auditors would not have otherwise known about, helping to improve report quality. Remember, the auditee works in that area every day and are the experts. Leverage the auditee’s knowledge to enhance your audits. In these situations, patience and the use of critical listening skills are beneficial.
Because listening skills are so critical to an auditor, consider your own effectiveness, which may include asking for input from others who will be honest. Only upon acknowledging reality can you devise a plan to improve this or any skill. When it comes to reporting audit results, surprises are rarely welcomed. It is critical to discuss the cause, impact and recommendations with the auditee before the report is released.
2. Report on facts
Facts should be confirmed throughout the audit and reported matters should be based on well-documented facts and certain logic. Only what was observed and validated to be factual based on specific audit evidence should be reported. Avoid the use of phrases that don’t indicate that, such as “it seems that”, “our impression is” or “there appears to be.”
3. Provide precision
Words like “sometimes”, “many”, “a few” and “several” leave report readers with more questions than answers. Instead, provide specific data which allows them to have a better understanding of the issues to determine how to best resolve them. However, aggressive words like “everything”, “nothing”, “never” or “always” should also be avoided.
4. Write with clarity
Have a clear understanding of the issue before writing the audit report. Be cognizant of the reader’s point of view and understanding of the subject matter. Use simple words when possible. Yes, some technical jargon may be needed, however excessive use of complex terminology may lead to confusion, causing the reader to check out mid-way through the report.
This can be a challenge when writing to different levels of readers, such as senior management and Supervisory Committee members. The use of a glossary to define more technical terms can be very helpful, especially in the credit union world which loves acronyms. When using these terms assume the reader does not know what they mean. Spell it out when first introducing it in a report. If further explanation is necessary, expand the description to help ensure understanding.
5. Share background insight on the scope and objectives
Set the stage for how the audit was initiated, what it strives to achieve and the scope of procedures. Without providing adequate information regarding the scope, one may conclude the scope was not significant and discount the efforts of internal audit.
Bonus: Provide reasonable audit recommendations
Auditor recommendations should only be considered as an option to management, as they may be willing to accept the risk of the deficiency or have a different solution. It is important to establish and utilize business acumen in developing recommendations. Adding four people to a process to create perfect internal controls is not reasonable, nor valuable to the organization.
While this may be an extreme example, it is critical auditors take into consideration the organization’s available resources, business environment and organizational goals when suggesting practical recommendations to address the deficiency identified.
Wrap Up
As an auditor, you already know the critical nature of effective communication. Over the years, many internal auditors have been discounted or not given the respect they deserve in an organization. While this type of treatment can be caused by the organizational tone at the top, or the lack of support and respect for internal audit by the senior management team, quite frequently it is self-inflicted. Poor communication skills can destroy credibility and create animosity between auditor and auditee.
Take some time to self-evaluate your communication against the concepts in this article. If you find this self-evaluation difficult, summon the courage to ask for honest feedback from those you trust and respect, or contact Taxmart Kenya for assistance.