The audit has finished. Now is time to put it right in writing. And for some reason, although this step is the most important -in most cases-, auditors fail to do it right. The top mistakes detected:
a) The vocabulary is too technical, not clear or the abbreviations used are excessive. Example: “The observation is from a small scope of the NDA’s taken for the due diligence carried out by Compliance for ML” What? No wonder why people can’t understand what you are doing… and the worst: by writing like this you are limiting the value the Internal Audit area has.
The language used must be bulletproof: anyone in the company should understand you. It is of no use that you have detected important risks if no one understands how this could affect them and the company.
b) The report does not give value. Example:
OBSERVATION: The legal area is not complying with the data protection law.
RECOMMENDATION: That the legal area complies with the data protection law.
Really? I mean what kind of recommendation is that? It would be better to know why they have not complied with it. Do they know the reason? Do you as an auditor know the reason? By asking why, you can get to know the real cause, give value, and not give an obvious recommendation.
c) The report is too long…when you hear that “the report should speak by itself”, it means that every observation must have support documentation, not that it has so much detail that the reader is lost. The better it is concise and clear, the more the reader is going to understand it.
The importance of an audit report is… that it’s the only thing others will see about your work. So, put it right in writing!
Want to know more tips? Join us at 150 ways to improve your audit reports MasterClass which will be streamed ONLINE on the 15th until the 16th of February, 2021!
