Introduction

In this series of articles, we have focussed on how internal auditors (IAs) can better communicate with non-executive directors (NEDs). Whether NEDs sit on the Audit Committee or the Board, understanding and influencing them is essential to improving an organisation’s overall risk and control framework.

In the first article, we discussed the unique position NEDs hold; in the second, accountability. A common theme, though, is IAs’ unique ability to provide NEDs with objective information and insight, crucial for NEDs to fulfil their roles.

This last article addresses what many may have expected to come first: reports and the reporting process. After all, traditionally IAs convey plans, progress and findings to NEDs (and others) through reports, not informal discussions, although much has changed recently.

In this piece, we will touch on some of the basics of report-writing – it’s easy for everyone to fall into bad habits, especially under pressure. But we will also cover how a clear, concise, compelling report helps NEDs understand our findings and prompts senior managers to act. 

Content

In a 2016 ACCA IA eBulletin article, ‘Writing the right report’, we established that all reporting must be clear, concise and useful. This seems obvious enough, until we realise what it demands of us. 

Clear means no vagueness, euphemism or jargon. This requires writers to understand what they have done, how and why. Concise means only what is needed. Many of the NEDs you work with – and other readers – will receive monthly and quarterly reports running into hundreds of pages. If you want to contribute to making your organisation better run, better informed and more successful, cut the verbiage. 

Concise writing is part of clear writing – each needs the other. Both lead, happily, to useful, which means relevant. Make clear how your findings and recommendations link to the organisation’s objectives. Just because something happened doesn’t mean it earns space on the page.

Achieving this is hard. We all want to reassure readers we’ve been thorough and attentive. However, consider them and their needs – not our egos. Our readers, whether clients, NEDs or regulators, need to understand promptly what is wrong and how to fix it.

Some teams may want to replace the final report with an exit meeting using slides. While this can be an excellent mechanism to communicate engagement results and take questions, it is unlikely to be the final record of an engagement. 

Other IAs have recently wondered if ‘agile’ auditing precludes issuing a final report. Why not simply issue a series of individual findings and recommendations, as and when they arise, they ask. While this suggestion proceeds from a correct observation – too many teams spend too long drafting unwieldy reports – it is risky. 

If, for example, an IA team communicates only findings in isolation, how will it detect and articulate underlying problems and overarching themes? The process of fieldwork and drafting findings, performed correctly, should lead IAs to examine root cause, and to identify and articulate broader, underlying issues.

Isolating findings from each other makes this difficult. The result is likely to be repeat findings, as recommendations will have been limited and superficial. This does not add value. Recording these findings and any common themes in a clear, concise, useful report does! 

Structure

As of this year, the EU requires annual financial reports to be filed digitally. However, much more than that has moved online since then. The move to more interactive, digital engagement means that many teams have had to streamline both reports and the reporting process. While everyone is keen for the current crisis to abate, not everyone is keen to return to previous practice. 

How can we take what we have developed this year and improve it further? If you have been using virtual meetings to discuss and agree engagement results and recommendations, why not keep doing so? If the resulting reports have been shorter and more to the point, why return to previous, less effective habits?

If this year has forced your team to improve processes, your report structure can benefit. Does the template you currently use force colleagues to include irrelevant information? Does it repeat itself, or hide the most important message halfway through the document? If so, change it. After all, if you make readers flick or scroll through too much content to get to what they need, you are not communicating effectively.

The simple approach would be to start with the executive summary. This is crucial, not only for NEDs and their colleagues, but for anyone who wants to grasp immediately your high-level conclusions.

After the executive summary come findings, resolutions and deadlines. List the findings in order of their importance, so that those with the greatest risk for the organisation come first. Even if you prioritise in this way, remember – findings alone cannot convey the broader underlying problems. The executive summary does that.

Consider too whether you need to draw attention to specific ratings. Many teams put a summary of findings and high/medium/low ratings (often colour-coded) towards the front of the report. Given that this is primarily a matter for IAs and the audit committee to agree, does highlighting it in this way distract other readers, or put them on the defensive? Does it lead to horse-trading between IAs and senior managers, a war of attrition that often downgrades ratings with little justification other than the desire for a quiet life? 

If so, you are incorporating unnecessary conflict into your reports, with the high risk of withholding the true picture from senior decision-makers, including NEDs.

Every ‘downward’ negotiation of a finding means that we are not adequately identifying significant matters to the executive. This in turn prevents NEDs from holding executive management to account effectively.

Review

Most IAs put great effort into their work, only to be disheartened by colleagues who don’t review constructively. If most people spend too long writing reports – or more importantly, write too-long reports – then most people also spend too long reviewing, without doing it very well.

If writers write less, but better, then reviewers can play their parts more effectively. If the report contains fewer, but more precise words, reviewers will spend less time slogging through pages of verbiage, unsure of the meaning.

We can also hope that shorter, sharper reports will prompt reviewers to display similar levels of discipline. Some believe they alone understand grammar – not true. Others are frustrated novelists, and love nothing more than wordsmithing other people’s perfectly acceptable drafts. Yet others, terrified of resistance from readers, will agonise over every word – delaying the report while failing to improve it. This isn’t simply a waste of time; it actively damages IA morale and effectiveness.

The result is the same outside the IA function. If writers and reviewers spend too long on the wrong tasks, producing lengthy but woolly reports, what value do readers get? How can anyone tasked with making improvements understand what they are to do? And how can senior decision-makers such as NEDs grasp what the underlying problems are they need to take action on?

Conclusion

Although the pandemic has seen many IAs forced to change their working practices, this has been an opportunity to streamline reporting practice. In content, structure and review, think first of your readers and the action they should take. In doing so, you will give NEDs an excellent resource, enabling them to challenge and encourage senior management.

Sara I. James, PhD, CIA, is the owner of Getting Words to Work (www.saraijames.com) and a member of the Chartered Institute of Internal Auditors.