The audit report is the outcome of weeks or months of detailed and painstaking work, often following years of training to develop the vital technical skills required to understand the critical elements of internal auditing. It’s our final product, and as such, it’s the thing on which we’re judged. 

Get it right and the organisation will take the required steps to address control gaps and failures, adjust risk appetite and streamline operations. Get it wrong and in the next cycle, if you’re lucky, you’ll find the same control gaps, the same control failures, and the same discussions with management; if not, one of those issues you’ve detected this time around will catastrophically affect the entity and its going concern status.

Many auditors approach a report from one of two standpoints: 

• that no matter how well presented, the client won’t be interested in, or won’t understand, the issues; or
• that what influences the writer will influence the reader and they will get our point.

I work in the technical world of language, where we speak of ‘meeting the other person at their bus stop’. That is, thinking about how the client(s) will understand the report and how our writing will motivate them to take action.

Ahead of drafting your report, you need to get key influencers ‘on board’ with the message you will present.  

Remember our reader is an individual and will have inherent motivation and thought patterns that are context dependent and may affect their rational acceptance of the facts. Context dependent because how individuals react can differ by context (such as work/private life) or time of life. These motivations and thought patterns are well researched and documented in the Language and Behaviour (LAB) Profile® (Words that Change Minds[1]).

Most people will want to make their own mind up by gathering information from the outside and judging it based on their own internally held standards. I’m sure we’ve all had one person in the room who, no matter the facts, sticks to the completely unfounded belief that nothing needs to change and you have to turn that ‘faith’ into objective and logical acceptance of the evidence coupled with motivation to change.  Try to agree the facts, as this gives you a starting point from which to leverage cooperation for change.

Once the facts are agreed, you can turn to solutions. They know the business better than you do, so you want their assistance in defining the ‘fix’.  Once you’ve agreed there’s a control gap or failure ask for their ideas and if none is forthcoming, use phrases such as: ‘a suggestion for you to think about’, or ‘something like this would work but only you can decide’.

Many people are motivated by solving a problem – moving away from something that is happening. To have them understand and implement your point of view use phrases such as: ‘here’s how this can help you avoid this problem’, ‘if fixed now it won’t deteriorate’, ‘the company can avoid this by …..’, ‘this will prevent’.  Others will respond better when hearing of the ‘advantages’, what you are proposing ‘will enable them to do’.

Here is a tried and tested formula from the LAB® Profile giving a concrete example.

The scenario: project management controls are in place. The monthly RAG (red amber green) report shows: green, green, green, red, green. The auditors query the reporting as to why there were no amber warnings and the response from management is: ‘We knew we were a bit over budget and behind but we thought we could catch up and didn’t want to alarm anyone so we stayed green until we realised we couldn’t meet the deadline’.

Auditor: ‘Why did it then go from red back to green?’

Management: ‘Because the project authority extended our timeline by three months and increased our budget.’ 

Auditor: ‘Can you deliver within the new budget and timeline?’

Management: ‘We hope so, if we work enough overtime we should be able to meet the deadline.’

Auditor: ‘How will the overtime affect the new budget?’

Management: ‘It’s not budgeted...’

A tried and tested formula for vastly improving stakeholder engagement is:

Fact > Problem > Solution > Benefit > As you know ….

Start with the root-cause analysis you have to present. Avoid judging this information and make sure it is purely factual.

Problem: What problem(s) does this fact cause (for the company)?

‘Given you’ve indicated that it’s highly likely that either the new timeline or the new budget will not be met, reporting green will mislead the Project Authority as to status of the project.'

Solution:  What is the proposed solution?

‘I suggest (rather than command language such as ‘you should’) the status remains amber and remedial actions are carried out until the ‘return to green’ plan is on track.  You can highlight to the Project Authority the challenges and ask for their support during the critical phase you’re now working on.'

Benefit: State the positive result that your client can expect from the solution.

‘This will ensure that the Project Authority is fully aware of the tight timelines and budget and will not be surprised if one or other needs to slip again.’

As you know…. triggers the start of the process which leads to the end result – buying in.

‘As you know, when you are reporting on the remedial actions being carried out they can have confidence in your transparency and will be more likely to support you should the budget or timeline prove impossible.’

Once you’ve got their buy-in, you’re ready to start developing the report.  Write the main body of the report first, and then create the executive summary. In this, we need to concentrate on providing a balanced summary of the facts in plain language, avoiding technical terms, jargon, ambiguity and emotion. If done well, the opinion included at the end should be obvious without even being recorded.

Remember that this is aimed at the audit committee, who will not have the same depth of process knowledge that the audit team or management has but they need to understand what they should be concerned about and who needs to take what actions to allay those concerns.

You can include significantly more detail, including technical jargon and acronyms (providing they’re explained in context), in the main body of the report. While reporting styles will vary by organisation, best practices suggest that the main body of the report should be ‘by exception’ in order to focus the executives on the issues that need to be addressed. Additional detail, examples and even reports of exceptions can all be included as appendices as required. 

Do not make recommendations; instead include agreed SMART (Specific, Measurable, Attainable, Relevant and Time-bound) actions. Avoid words such as ‘consider’, ‘should’ or ‘might’ and ensure the action owner is named by position.

Take away! (How to use this information right away in your work)

You can prepare your next meetings/reports the easy way — and reduce the time it takes to get ready and increase the likelihood of getting buy in.

FACT What information do you have to give your clients that they don’t already know (or are not being realistic about)?

PROBLEM What is the negative consequence of this information that they will want to prevent?

SOLUTION What is the solution you have to state (no ‘shoulds’ allowed)?

BENEFIT What is the positive consequence of this solution that they will want to go towards?

AS YOU KNOW What do they believe to be true that proves the problem exists?

Rosie O’Hara, Master Consultant of the Language and Behaviour (LAB) Profile® (Words that Change Minds) www.developingworks.com

[1] Charvet, 1995