2 Reasons Your Audit Report Fell Flat

 

The audit report is a critical part of the audit process. It, at a minimum, formally communicates to stakeholders the state of a control environment. The reporting phase is oftentimes troublesome. Many auditors spend hours arguing with clients about report content and distribution. Three major complaints i hear from auditors are that the client

1.  Is just plain difficult
2. Does not understand the risks in the environment
3. Will never change

This may truly be the auditors’ perception. However, if you carefully examine these complaints, the one thing they have in common is that all blame is attributed to the client.  What the old saying about pointing fingers.  When you point the finger at someone else, you have many more fingers also pointing at you.  Auditors are not perfect, therefore, I’d like to take a look at two ways we are causing audit reports to fall flat.

Reason #1 – Substantial Surprises

I’m constantly amazed at client reactions to reports. I recall working for one organization in which clients constantly contested audit results.  One time in particular, the lead auditor was going over the results with the client in a manner that was very direct and logical.  The evidence clearly showed there was a significant breakdown somewhere in the process.  Clearly.

The client and the lead auditor argued for about 30 minutes over the second or third issue on an audit report with about 15 items.  At this pace, we would never get through the exit meeting.  During this 30 minute exchange, I noticed that no one (the client nor the lead auditor) was discussing the actual issues on the audit report.  Sure people were talking, but each side was throwing accusations back and forth, pointing fingers and name calling.  I noticed this, however, at this point I was too young in my career to really know what to do about it.

Thankfully there was a seasoned level headed person in the room.  A senior member of the client’s management team calmed everyone down.  She then asked the audit staff to explain the issues again without interruption from her team.  After hearing the issues, she then asked her team if the facts presented were true and correct.  Her team responded…”Well, yes”.  She then inquired about the reaction to the report, especially if the issues are true.  The client team responded that it made them look bad.  Further, they said that they were not slackers and worked hard every day.  They simply could not keep up with job demands and needed additional resources to meet expectations.

Furthermore,  her team disclosed that this was the first time they had truly seen/heard the completed issues presented in this manner.

To its credit, the audit department met with management at the end of each week and discussed audit testing exceptions. And from their standpoint, the auditors believed they had effectively communicated with the client. So what really happened? The following contributed to substantial surprises in this instance.

1. A failure to provide proper perspective

Discussing individual exception items is necessary, however clients need to also be informed of the aggregate impact and how collective issues may be presented on the report. So of course the client was surprised to see the total impact of the individual issues as presented in the report.

2. A failure to acknowledge client obstacles

There were clearly issues in the client’s area that needed to be addressed.  However, client resources were extremely limited and personnel were stretched beyond their limits.  This is the cause of the control breakdown.  The auditors failed to mention this in the report.  Acknowledging the cause in no way excuses the control weakness.  But it may be the push a client needs to get the resources to resolve issues.  It also build goodwill with the client.  In this instance, the client thought the auditors truly “heard” their concerns.  They thought that the final audit report would sufficiently describe the situation.  Unfortunately, it did not.

Reason #2 – Information Overload

I remember working with one audit shop that required its reports to pass the “weight” test.  When I first heard this, I thought they were referring to passing the “weight” of management scrutiny.  I quickly learned they meant the beefier (longer, bigger) the report, the better.  This resulted in 10 page executive summaries (the operative word here is summary right?), issues that seemed to last for days when read aloud, and complex words that required a thesaurus and an interpreter.  The audit reports read like dissertations.

On the surface, I think I understand the thinking…the more evidence we provide the client that the controls are ineffective, the more likely they are to listen.  But when has this approach ever worked in any area of life.  Almost never.  Allow me to provide an example.  Suppose you had a loved one who started smoking and you really wanted them to stop.  Which of the following approaches do you think is the most effective:

1. Bombarding them morning, noon and night with literature containing statistics about diseases and death rates.

or

2. Showing them a quick and impactful snapshot of the dangers of smoking like one of the videos below.

Lengthy audit issues tend to lose your audience.  Especially when they are soooooo long that the clients cannot truly identify the risk and issue you are trying to present.  So as you’re writing your audit reports, always answer the following questions quickly and as brief as possible (one to three sentences for each question):

• What’s wrong?  Explain the issue.
• What is the impact?  How significant is this issue.
• How did it happen?  No really how.  Avoid the standard “there appears to be a breakdown in the control environment” statement
• How can it be fixed?
• Who is responsible for fixing it?

Answering these questions will help provide clarity to your reports and avoid information overload.

Substantial surprises and information overload are but 2 of many reasons internal audit reports fall flat.  What are some others?

Photo credit  sciencesque via Compfight