Latest Blogs from SBS and Company LLP

    Quality Audit Reports - Inform and Influence clients

    The purpose of the audit report is to summarize the findings in a way that auditee management can readily understand and see the impact of these findings. The audit report represents the end result of weeks of reviews, analyses, interviews and discussions. It provides important information to audit clients about the area reviewed by internal audit.

    More importantly, it provides details to management about significant issues that need to be addressed. How well internal auditors communicate that information is critical to getting their client’s acceptance of findings and their agreement with audit recommendations.

    Quality reports require thought and effort. Auditors should consider who will read the report, what they will do with it, what level of detail is necessary, what the organization’s culture and norms call for, and if industry-specific language is necessary. Every effort should be made to ensure the report is kept at a reasonable length and conveys a balanced summary of the status of the areas audited.

    Quality of Communication says communications should be accurate, objective, clear, concise, constructive, complete, and timely – IIA Standard 2420.

    The audit report needs to be issued as soon as possible after the audit is completed. If, for any reason, it cannot be issued by the deadline set in the audit plan, an explanation for the delay should be provided to the auditee and a revised issue date established.


    Significance of Accuracy

    Inaccurate information could adversely impact the credibility of the entire audit report, so accuracy is critical. All of the numbers should be correct, the information should be factual, and documentation verifiable. There may be disagreement on what the numbers or facts mean, but there should never be an argument about their accuracy. Accuracy is enhanced by appropriate supervision of the audit engagement.

    The IIA’s International Standards for the Professional Practice of Internal Auditing requires adequate supervision of engagements, and part of that includes verification of numbers and facts. Accurate and precise information lessens the chance of a misunderstanding.

    The audit report is shared among the audit team, and with the audit organization’s management, for review of accuracy and completeness. The integrity of the audit report process is the lead auditor’s responsibility and he/she must ensure that it reflects the tone and content of the audit. The audit report is signed and dated, minimally by the lead auditor, before distribution. 



    Objectivity is the second most important quality behind accuracy. If readers feel that the report is not objective, it could undermine the confidence they have in the report. And while the report may be objective, the subtle use and placement of certain words can appear to show bias. This can be crucial to whether the reader accepts the auditor’s conclusions and recommendations.

    Objective words are precise. They speak to the facts and can be supported by evidence. The report should always mention positive actions and practices that were observed during the audit. Certainly nonconformances and non-compliances that were identified during the completion of the audit must be documented, as well as any opportunities for improvement. 

    Reports must be clear enough for readers to understand without having to refer to anything else. Language should include precise modifiers and clear technical terms.

    Attributes of an effective audit report

    Precise Modifiers - A modifier is a word or phrase that alters the meaning of another word. Generally, the modifying word should be as close as possible to the word it is modifying. Otherwise, the modifying word could attach itself to a word that was not intended to be modified. This can subtly alter the meaning of the sentence or make it ambiguous.

    Usage of clear Technical Terms - Auditors should consider spelling out acronyms, replacing technical terms with nontechnical words, and embedding definitions within the sentence.

    Documentation of nonconformities: When documenting findings, it is important to be clear and precise. What is the actual nonconformity and why is it a nonconformity? What standard has been violated? What is the objective evidence used to determine that a nonconformity exists? The statement of nonconformity needs to be well written, clear and precise with enough detail that the auditee or process owner can use it to initiate root cause analysis

    Conciseness - Readers always appreciate conciseness, but it should not mean cutting down on information. It means using fewer words to convey the same information. For example, if there are findings in three different areas regarding document control, combine them into one finding that indicates where the non-conformities were noted. Some things that impact conciseness include drawn-out verbs, overstated language, and redundant modifiers.

    Constructiveness - Constructiveness primarily refers to the audit recommendations, which should give audit clients information to correct the current problem and also address the root cause so as to mitigate future occurrences.

    Completeness - Everything the reader needs to make an informed decision should be included in the report, and no significant information should be left out. The auditor must not omit valid information because it does not support his or her points. Present all the facts and allow the reader to decide. “Communications must include the engagement’s objective, scope, and results” – Standard 2410. Audit report is not complete without the reason for the audit, the final conclusion based on the evidence reviewed, and the amount of evidence reviewed to come up with the conclusion.

    Areas of Improvement - It is permissible for auditors to make statements, or judgments, regarding the auditee’s compliance with the applicable system standards and related documentation. 

    Timeliness - Auditors should complete and issue reports as soon as possible to give the audit client a chance to address the issues timely. Timeliness may vary based on things like the audit resources needed to complete the audit, the complexity and significance of the audit, the report review process, and other factors. If serious issues need to be communicated before the report is completed the auditor should immediately issue an interim report or memo to allow the client the opportunity to address the problems as soon as possible. The interim report or memo can be referenced in the final report.

    Distribution list -  For internal audits, the audit report distribution tends to be much larger, but is typically specified in an internal procedure governed by the audit group management. 



    An audit report must be accurate and objective; flexible enough to communicate sometimes complex information to various levels of people; and able to withstand the scrutiny of peer reviews and other assessments, depending on the industry. A quality audit report aids audit client in making informed decisions, so taking the time and effort to put it together benefits the audit client and auditor

    Looking for suggestions?

    Subscribe SBS AND COMPANY LLP updates via Email!