Better Never Than Late
Richard Chambers, CIA, CGAP, CCSA, shares his personal reflections and insights on the internal audit profession.
The iconic Larry Sawyer once observed that “few sources of friction within the audit department exceed that caused by the process of report writing.” Sawyer went on to correctly observe, “The most brilliant of analyses and the most productive of audit findings seem to be forgotten during the trauma of report writing.” In my view, these are some of the wisest comments Sawyer (or any other practitioner or academic) ever uttered about internal auditing.
After almost 36 years as an internal auditor, I am not sure that as a profession we are any more proficient in publishing timely and well-written audit reports than we were the day I first “donned my internal audit spurs.” As Sawyer noted, the reasons for committing “reportable offenses” are many:
- Internal auditors often lack fundamental writing and “storytelling” skills.
- Draft reports often portray internal auditors as the heroes and management as the villains.
- Supervisors (in large audit departments with multiple levels of supervisors) often rewrite or heavily edit the initial draft audit reports.
- The emphasis on accuracy dwarfs the emphasis on timeliness.
- Lack of coordination with management and a negative tone in the draft report creates friction that causes major push-back against the draft report.
If we are to successfully navigate the current environment in which stakeholders expect more of us despite our reduced resources, then we must tackle our inefficient processes. None are more obvious targets than report writing, where many audit departments spend more time finalizing a report than the audit took to complete. I have been evangelizing on this topic for the past 15 years. Among the effective strategies to reducing report “cycle time” that I have observed, include:
- Sharing audit results with clients “as the audit unfolds.”
- Eliminating or minimizing levels of draft report reviews.
- Deploying an editor to review draft reports early in the reporting process (for larger departments).
- Using team writing or team editing processes (a strategy I used extensively as the Deputy Inspector General of the U.S. Postal Service).
- Using “report conferencing” during the editing process, which involves management in the editing process.
- Using extract features from automated workpapers to craft the initial draft audit report.
- Streamlining the report format to eliminate extraneous or redundant information.
Granted, these “sound bite” solutions are easier said than done. However, report writing is a core internal audit process in dire need of reengineering. We cannot maintain the hard-won stature of the past decade if we ignore opportunities to deliver timely and relevant information to key stakeholders. Failure to deliver timely audit results is not an option.
As the great playwright George Bernard Shaw once observed, “Better never than late.”
Posted on Apr 18, 2011 by Richard Chambers
Share This Article:
Entries
Richard:
This is a very important topic. My observations of thousands of audit reports from scores of audit departments around the world mirror your observations and concerns noted above.
My personal view is that audit reports should not be a collection of areas where internal audit thinks controls are "deficient" or "need improvement" or even provide an opinion whether Internal audit thinks controls are "effective" or "adequate". This is the primary friction point that produces the problems you note. I believe the report should describe the current residual risk status in the areas reviewed and hi-lite areas where the level of residual risk, after considering risk treatments that the client agrees to implement, is still at a level that Internal Audit believes senior management and the board should be aware of.
I have worked from a simple premise over the years that has served me well. Work units can accept any level of residual risk that they are prepared to share with those above them, up to and including the board of directors for serious issues. This often produces friction free agreements to introduce new risk treatments. Audit's primary purpose in life should be to to ensure senior management and board of directors are aware of the company's current residual risk status. In companies where work units self-assess and share results upwards the role of IA is solely to ensure the process is producing materially reliable information on the company's residual risk status.