Reporting during and after Covid: different…and maybe better?
Everything is changing right now, and not always for the better, of course. However, when forced to work differently, we have an opportunity to scrutinise some of our assumptions and habits.
Lockdown will end at some point, likely leading to a reassessment of what we do and how we do it. This piece explores some of the ways in which internal auditors can improve their reporting before the inevitable post-lockdown lessons.
Many of us are already working remotely far more than before, with meetings, presentations and training taking place virtually rather than in person. Given most people’s increased availability we may have been able to forge stronger relationships. Seeing people in their home settings, in casual dress, bookshelves visible, family members and pets audible…all of this brings a more human element to our online contact with colleagues.
Organisations across the world are rethinking not only their strategies and priorities, but also what they need to achieve them. This is a great opportunity to leave behind some of the less constructive and productive ways we used to work. Just as few people will pine for marathon meetings in a large conference room, few will look forward to receiving hefty reports written as though paid by the word.
International Standard 2420 makes clear that all internal audit communications should be – among other things – concise. Now, this is difficult to achieve, especially in anxious times when most people try to counter uncertainty with too much detail.
Recent Chartered IIA guidance on communications with stakeholders emphasised the value of brief, relevant updates, possibly delivered online or by phone. How can we take the best of what we currently have to use, and transform it into what we will choose to use?
I think this is a useful opportunity for internal audit activities everywhere to stop and review every aspect of their current reporting. First of all, using the International Standards as your guide, what do you have to report? To whom? Why?
If you start from scratch, you will probably discover that much of what you were in the habit of producing was maybe either irrelevant or not reader-friendly.
Risk-based internal audit means that every report should be the culmination of a risk assessed engagement that contributes to providing the CAE annual audit opinion. However, are there any reports in your organisation that survive from previous generations of internal audit? Are there senior managers or audit committees who insist on cyclical audits, where there isn’t a regulatory requirement for them, even if the value is minimal? This is your chance to make the case for shedding this work.
By now, the internal audit annual plan will probably look quite different from when it was agreed. It will keep changing, to adapt to a situation that few can predict. So too should the reports we produce.
Once you’ve worked out, as a team, which reporting is most useful for internal audit to provide, the next step is the medium. Most teams are in the habit of documenting their conclusions in a formal report, but this isn’t the only way.
After lockdown, many people will be comfortable communicating more online – not only via email, but also via tools such as MS Teams, WebEx, Skype and Zoom (security permitting). Given that online meeting packages often have recording functions, would it be useful to replace the draft report with a presentation? You could easily record it, thereby capturing people’s responses to findings and recommendations for the audit trail, and then share the recording with key stakeholders including the audit committee.
Where documents are necessary, can you revisit the format? This doesn’t mean having a team argument about templates and fonts. It’s about replacing a report template, with sections everyone feels obliged to complete (even when not relevant) with something more useful. This could be in the form of a memo, a slide deck people can read at their leisure, an interactive MS Power BI session, or even a pre-recorded presentation.
The latter would be a particularly time and energy-efficient way to deliver draft reports. If you ask people to view the presentation and send you questions afterwards, you can then hold a brief virtual meeting in which you address all the questions at once. This will allow people time to reflect on what they’ve seen before rushing to question it.
A draft audit report goes to a wide range of stakeholders. However, other reports may be necessary for a specific audience: a regulator or external auditor, or the audit committee. How much overlap is there between different reports your activity produces? Is there a way to streamline and be more efficient, rather than recycling the same content in different formats and templates? Has your understanding of these different parties’ needs moved on at all? Even if they had fallen into the habit of expecting updates on the same information at regular intervals, the last few months should have changed that.
This is an opportunity to step back and – first of all – engage with them. Find out what they now need and want, and in what format. It is unlikely they’ll want what they received previously. By responding to their needs, and the wider context, you’ll be proving that internal audit can adapt quickly and usefully.
Further reading
Communications with stakeholders
The following is only available if you are a member of the Chartered IIA:
International professional practices framework
