Local Authority Internal Audit Virtual Forum
23 November 2022
Please note:
- All Institute responses are boxed and highlighted blue
- Where the chair comments in that capacity this box is highlighted in yellow
- For confidentiality, the identities of all delegates/attendees are anonymised
Institute's welcomeGood afternoon, everybody. I am John Wood, CEO at the Chartered IIA. The topic for today is ‘Effective Communication and Reports’. A good internal audit report is one that clearly communicates the objectives, scope, and findings of an audit engagement, and in doing so, motivates its readers to take internal audit’s recommended actions. Is it that easy? The purpose of any communication, written or not, must be to persuade readers to act, or to think differently. In internal audit, these two often go together – for readers to act, they must be convinced of the benefits. However, this assumes you have a clear message to communicate. Solid audit engagement work is the foundation of all we do, and without it, there is nothing to report. After all, you cannot communicate unless you have something to communicate. Make sure you are clear exactly what the results of your engagement are. This may seem obvious, but many internal audit reports fail to convey a single clear message because the report lacks one. The team may have worked hard and documented many findings, but unless these are material and lead to a concise, overarching ‘headline’ about the governance, risk or control framework under review, they are not useful. Different teams use different techniques to explore and articulate their engagement results before committing them to a report. Storyboarding, mind-mapping, outlining – all are good ways to thrash all the elements of an engagement out to arrive at a clear, coherent conclusion. ‘Accurate, objective, clear, concise, constructive, complete and timely’ is the standard – it may not be easy to produce, especially under pressure. Understand your readers – their assumptions, values and preferred communication styles. Structure and lay out your report in a way that invites, rather than repels readers. And above all, keep it simple and to the point – you will be surprised how many readers welcome the result. Those of you that saw our speaker today, Sara I James, deliver one of the standout keynote sessions at the conference, a couple of weeks ago, will be aware how passionate she is about the importance of effective communication. Before we commence the session, I would like to provide the normal introductory comments: I am joined today by:
|
Key takeaways
Slides from the session are attached. Notes below are supplementary.
Sara I James, Independent Internal Audit, Risk and Compliance Adviser and owner of ‘Getting Words to Work’.
- We need to ensure we put ourselves in the reader’s shoes – think of yourself as a reader.
- The Standards do not stipulate that we need to write reports – we could compile a video for example – we need to compel our readers to act.
- There is a requirement particularly in the public sector to make communications accessible – use plain language.
- Accessibility is also essential internally and externally.
- Plain language isn’t about style, it’s about respect and avoiding a breach of the Disability Discrimination Act, e.g., those who may have dyslexia or visual impairments.
- Active voice starts with the ‘doer’ e.g., ‘the manager reviews the report’.
- Passive voice can look evasive and requires more text.
- Technical subjects are generally not difficult to cover using plain language, it’s the corporate speak that tends to cause a problem. For example, the repeated use of ‘stakeholder’ when it’s not clear who is being talked about or affected.
- A consistent approach, e.g., use of shorter sentences is preferable to dictating the same style to be used across a team. Avoid the more common pitfalls and a degree of variation in style is fine.
Institute's closing commentsThank you, Sara. As usual, notes, chat comments and the slides shared today will be placed on our web pages in the next day or two. Our next session is 14 December 2022 when the topic will be Internal Audit and Risk as a similar function – the challenges for a HIA when they have responsibility for risk as well as internal audit. Upcoming Events
Thank you everyone, see you in December. Thank you for attending. As always, if you have any ideas or suggestions for what we might include in future agendas, please contact Liz Sandwith. |
Q&A and chatbox comments
Q: You mentioned that a written report is not stipulated as a requirement under the Standards there are different ways this could be communicated instead. What do you think is the most effective way to communicate the findings from an audit?
A: I have read over 3000 reports so I’ve seen quite a few! I would say they’re most effective when there is a lot of communication within the internal audit team and with the audit client/first line depending on how you want to refer to them. The more you communicate the information you have early on in the internal audit engagement, the less people feel they need to over-document. Also, the better the conversations and relationships you have (so that you can be honest, it’s not about cosy), when you get to the report, it’s really just about documenting what’s been discussed and agreed. It’s about the headline – what’s your diagnosis of the overall health of the risk and control framework of the area audited? And with the findings, make sure they’re material. Just because something happened in the fieldwork, doesn’t mean it’s earned its space in the report. If you can’t tell me what the risk is, why are you wasting time with this and why did you audit it?
Q: What are your thoughts about having executive summaries for senior managers and more detailed findings for operational managers? Does this make reports too lengthy?
A: The National Audit Office for example, every time they publish a new report, they offer two downloadable versions – the summary and a detailed report. What I advise is that you have an executive summary, no more than a page, because everyone reads that. After the executive summary is where you’d have your detailed findings. It’s good not to go into too much detail -don’t revisit every single detail of testing. You should go straight to what’s not working, why do we care and what’s the root cause? I’m a big fan of annexes or appendices – what I think of as the attic to the report. People worry that the body of the report will be too bulky if they put all the detail in or if they find themselves adding extra detail to forestall objections – I think it’s a good idea to put this detail in the ‘attic’. That way you can meet requests by signposting to that annex/appendix. Think about it like this – the attic is somewhere you put things that people might find useful, but you don’t want them lying around in the hallway i.e., the executive summary.
Sara –I once worked for a group chief executive of a global bank who said if you can't tell me what I need to know in a half a sheet of A4, he considered that either you don't know or you're trying to hide something. Initially I thought he was being very harsh. And then I saw the kind of reports that his direct reports; the divisional chief executives were sending and I realised - he just asked you one question. If you don't know the answer, just say so. That's so much better than 10 pages of waffle. Very often as auditors and I think anyone in an assurance function, we get caught up in writing defensively and showing how thorough we've been in our work, how well we've researched it, how well we understand the risks and controls in a particular area. the thing is, they won't read it. The more you include in a vain attempt to try to blow them away with your acumen, the more you're just going to bore them.
Q: What would you expect report writing to look like in the future? Should we be aiming for shorter reports, and or be more flexible in how we communicate depending upon the situation/audience?
A: I would say shorter or flexible, both. Whatever you think works. A lot of people still like having what they would call a report, but if you can make it shorter, then that's great and if you think about the use of hyperlinks especially for reports with an internal readership where they can access more information if they want it. Why not exploit that? Click on this link or contact us and we'll share everything with you. It's a way of saying we're being transparent, but we don't want to overwhelm you with detail.
Q: In recent years there has been a fashion for moving away from "reporting by exception” and including positives as well as negatives. We need to manage this carefully as this will lead to a longer report but a more balanced picture.
A: I'm a reporting by exception person myself. If I don't say anything, you can assume you got it right. And I will only talk about positives if I see something that I think is so outstanding that I want to point to it and say. When people talk about balance, I think they think it means 50/50. And yes, it's good, it's bad, it's good, it's bad, it's good, it's bad. So balanced should be proportionate.
Q: Should we still talk about reporting or presenting our findings and conclusions? We use Powerpoint as the final report as a presentation tool.
A: PowerPoint is a brilliant idea for presenting findings. The Standards require us to communicate findings and how you choose to do that is entirely up to what you think you know works best in your organisation. And it might vary. You might have one set of readers who are wedded to the report, so try and make it shorter and more reader friendly. You might have others who are very open to a PowerPoint, to a video, to something else. So, explore those things and flex and be alert to what's going to work for your readers. The test is, do you have repeat findings? If you have repeat findings because they didn't understand what you were communicating, you need to find another way.
