COMMUNICATING AUDIT RESULTS

AND INSIGHTS

Audit Reports That Spur Action

By: Fred Oyugi B.Com, MBA,CISA, CPAK

13th June, 2018

www.theiia.org/Training
 AGENDA

 Introduction
 IA function in value creation-PWC
survey.
 IIA Standards on Communicating
Results
 Communication during the Audit
process.
 Communicating Internal Audit
Results
 Possible risks in disseminating Audit
results and how to address them.

www.theiia.org/Training
 INTRODUCTION

 Internal auditors need to communicate the

results of their engagements clearly and
concisely to all relevant recipients.
 Delivering audit findings with greater impact
is a proven way for internal audit to provide
assurance, aid governance, enhance risk
management and prompt improvements.
 It is therefore vital to write and communicate
audit reports with a high impact.

www.theiia.org/Training
 SURVEY ON THE STATE OF
INTERNAL AUDIT PROFFESSION
• PWC’s 2017- State of the Internal
Audit Profession Study: Value of
Internal Audit. The study found
that Most Internal Auditors are
slow to help their employers
prepare for and respond to major
corporate disruptions like
regulatory changes and cyber
attacks.
www.theiia.org/Training
 PWC SURVEY 2017
The stakeholders – Internal Auditors, Senior executives,
and board members surveyed reporting that Internal Audit
adds significant value has gone down since year 2014 in
2017 being the lowest with 44%.Why is this so? What
next?
2014
2015
54%
2016
48%
2017
54%
2018
44%
????

www.theiia.org/Training
A key reason that so many of the
Internal Audit function including
apparently many internal auditors
themselves-feel that internal auditors
are not adding significant value is that
they're slow to anticipate the huge
changes affecting businesses these
days, according to Mark Kristall,a PWC
partner

www.theiia.org/Training
• Such IA departments aren’t
keeping up with the pace of
change.
• They only become involved after
the disruption has already
happened and affected the
organization.
• Hence the question is what makes
IA effective and key partner in
value creation?
www.theiia.org/Training
EFFECTIVENESS OF IA FUNCTION IN VALUE
CREATION

Internal
Audit Internal Internal
Assessment
Findings Audit Audit
Tools
and delivery Resources
reporting

www.theiia.org/Training
 IIA STANDARDS ONCOMMUNICATION
 2400-Internal auditors must communicate the
results of their engagements.
 2410-Communication must include the engagement’s
objectives,scope,and results.
 2410.A1-Final communication of engagements results
must include applicable conclusions as well as
applicable recommendations and /or action plans.
 An opinion must take into account the expectations of
senior management, the board and other stakeholders
and must be supported by sufficient,reliable,relevant
and useful information.
 2410.A2-Internal Auditors must acknowledge
satisfactory performance in engagement
communications.

www.theiia.org/Training
 IIA STANDARDS ON COMMUNICATION
 1111-The Chief Audit Executive must communicate and
interact directly with the Board
 2060-Reporting Periodically to the Senior Management and
the Board on the Internal Audit activity, purpose,
authority, responsibility and performance relative to the
plan.
 2020-The Chief Audit Executive must communicate the
internal audit activity’s plans and resource requirements,
including significant interim changes, to senior management
and the board for review and approval. The CAE must also
communicate the impact of resource limitations.
 2420-Quality of Communications-Communications must be
accurate, objective, clear, concise, constructive,
complete and timely.
 2440-Disseminating Results: The Chief Audit Executive
must communicate results to the appropriate parties

www.theiia.org/Training
 STANDARD 2420: QUALITY OF
COMMUNICATION
 Accurate: Free from errors and distortions and are
faithful to the underlying facts.
 Objective: Fair, impartial, and unbiased
 Clear: Easily understood and logical
 Concise: To the point and avoids unnecessary
elaboration
 Constructive: Helpful to the engagement client and the
organization
 Complete: Lacks nothing that is essential to the target
audience include all that is significant and relevant.
 Timely: Opportune and expedient
 Free from errors and omissions standard 2421

www.theiia.org/Training
COMMUNICATION DURING AUDIT PROCESS
 Interaction and communication of the audit activities
takes place during the entire audit process
 Audit engagement Planning (2200): A successful audit
means building time in at every stage to check progress
and communicate regularly with colleagues and audit
clients.
Audit
Notification

Planning

Fieldwork

Draft
Report

Final
Report

www.theiia.org/Training
 COMMUNICATING INTERNAL AUDIT
RESULTS
 Oral Reports: Only supplement but not a
substitute to written reports. Used for reporting
findings requiring urgent action;
 Interim (Draft) Reports: Issued when the
Management has to be informed of significant
issues that require prompt action. The contents of
interim reports are eventually included in the final
report. A draft report will be provided to the
Auditee in advance of the closing meeting.
 Final Reports: This is a detailed regular report
issued at the conclusion of an audit. The form
and content may vary with different type of
assignments…..
www.theiia.org/Training
 WHAT DOES THE READER WANT TO SEE?
 The audit report needs to make a case, line
by line and sentence by sentence, for
retaining the reader’s interest.
 The longer the engagement, the broader or
more complex the scope, or the more
numerous your findings – the harder this is.
 Ensure that the audit report:
̶ Uses short sentences, make it easy to read
̶ Uses the active rather than the passive voice
̶ Avoids jargon, clichés and buzzwords
̶ Don’t inflate the risk ratings

www.theiia.org/Training
 WHAT DOES THE READER WANT TO
SEE CONT’D?
 Even though readers will not see your working
papers, well written audit documentation is
easier to discuss with the client, submit for
review and use in a report.
 Use of the right professional standards
 Include a statement of assurance

www.theiia.org/Training
 THE POWER OF PROPER LAYOUT
 Layout can make or break a report. Using a
readable, reasonably-sized font and using
enough white space makes the difference
between a report that has readers wincing and
one that invites them.

www.theiia.org/Training
 THE POWER OF LAYOUT CONT’D
 Using tables, graphs and even photographs can make
your findings much easier to understand or visualize.
 Sub-headings, while useful, can be distracting if too
numerous. If you have too many layers of information,
or crowd your document with too many graphics and
colors, you will lose your readers.

www.theiia.org/Training
 MOVING FROM FIELDWORK TO THE
BIG PICTURE
 The auditee needs to understand why, for instance,
several minor observations merit a higher-risk rating
when seen in a broader context.
 Communicating issues that audit client did not know,
identifying root causes and opportunities for
improving control design and trends in risks and
controls.

www.theiia.org/Training
• The easiest way to display audit results is
using a tabular format because: it is easy to
read and it needs less words.
• Move on from compliance. Many audits are
based on simple compliance approach whereas
the contemporary mission of internal auditing
is to “enhance and protect organizational value
by providing risk based and objective, advice
and insight”
• This leads to greater focus on operating
auditing, meaning audits shaped around the 4
E’s –efficiency,effectiveness,economy and
ethics.

www.theiia.org/Training
 RISKS IN DISSEMINATING AUDIT RESULTS
 Most of the time brilliant analysis and findings seem to
be forgotten during of report writing stage. The
reasons for this are:
i. Failing to understand the broader corporate context
ii. Focusing on minor details and low-risk instances of
ineffective control, without considering underlying
risks.
iii. The report tells us what we already know/The
report makes it sound worse than it is.

www.theiia.org/Training
 RISKS IN DISSEMINATING AUDIT RESULTS
CONT’D
iv. Anticipating opposition from readers and
recipients may lead to softening critical
messages and failing to communicate clearly
what needs addressing.

www.theiia.org/Training
 RISKS IN DISSEMINATING AUDIT
RESULTS CONT’D
v. Adopting corporate group-speak (jargon,
clichés and buzzwords).
vi. Pressures of time and workload

www.theiia.org/Training
 HOW TO ADDRESS THE RISKS
These risk can be addressed through:
i. Regular Consultation
ii. Attending high level meetings
iii. Use of Information Technology-TeamMate
audit tool, Data analysis tools etc

www.theiia.org/Training
HOW TO ADDRESS THE RISKS CONT’D
IV Engaging the auditees/audit clients at all
levels

www.theiia.org/Training
HOW TO ADDRESS THE RISKS CONT’D
V. Adoption of Enterprise Risk Management

www.theiia.org/Training
HOW TO ADDRESS THE RISKS CONT’D
VI. Proper planning

www.theiia.org/Training
 HITTING THE HOME RUN

 Five Signals That Your Last Internal Audit

Hit a Home Run
– The CEO or CFO sees you in the hallway and
stops you to talk about the audit.
– Your audit recommendations result in
significant cost savings, enhanced revenues, or
major efficiencies.
– Your internal audit reveals a major
unrecognized risk or ferrets out a major fraud.
– Operating management seeks out your advice
on related or additional issues that surfaced in
a recent audit report
{RICHARD CHAMBERS, CEO, INSTITUTE OF INTERNAL AUDITORS}

www.theiia.org/Training
hank ou!

www.theiia.org/Training