Audit Reporting Tips – How to Make an impact and prompt change

C.A. Prashant Daftary WIRC –Pune Branch

Presented on 16th November 2019

1

English is a funny language

Roko, mat jaane do Roko mat, jaane do

2

Table of Contents

3

Internal audit report – Meaning & types

Relevance

Key challenges

Common mistakes

Tips

Innovation

Internal audit report format

Elements of internal audit report

Executive summary

Question & Answer session

4

5

Document prepared as an outcome of the audit process

It is presented to the management / audit committee / owners of the organization

It contains clear written expression of significant observations and recommendations based on review of the policies, processes, risks, controls and transaction processing (Source : SIA – 4)

Audit findings and recommendations in the audit report are designed to facilitate organisation achieve financial, management and regulatory compliance objectives

Internal Audit Report

6

Detailed Report

Interim Report

Executive Summary

Flash Report

Types of Internal Audit Report

7

Final product of the internal

audit effort

Branding of firm /

professional Recall value

Recognition of work done

Generates interest in the

work done

Connection with the reader

Relevance

8

9

Key Challenges

Time management - time taken for report drafting as against over all assignment time

• E.g. – 2 weeks for execution and 2 weeks for report writing

Lack of clarity between the senior and team as regards objective, report format, flow

Vision as regards the what is the end deliverable & how should the end product look like

Client expectation not clear

Does the report communicates what we really want to communicate & whether the reader can connect with the report

Key Challenges

How to start, what should be the flow, what it should contain and what it should exclude

Reducing attention span of the reader

Does it meet readers expectation

Size of report and maintaining balance

Other issues –like grammatical errors, formatting, spelling mistakes

12

First impression is last impression

13

• People begin forming an opinion within seconds

• Difficult to reverse first opinion

Common Mistakes

14

• Identifying who is the reader

• No clarity about stakeholder expectation

Who is the stakeholders of internal audit?

15

Stakeholders

Process Owner

HOD

CFO / COO /

MD ACM

Statutory Auditor

What they want?

16

Process owner

• Genuine observation

• Process understanding

• Listen their point of view

• Practical suggestion

HOD / CFO / COO / MD

• Value addition

• Summarised format

• Overall risk assessment

• Fair presentation

• Root cause analysis

• Categorisation based on risk

• Process owner’s acceptance

• Implementation status

ACM

• Summarised format

• To the point

• Overall coverage & risk assessment

• Key issues

• Management comments

• Timeline for implementation

Statutory Auditor

• Overall coverage

• Issue which affect true and fair view of the accounts

• Statutory non-compliance

• Assurance which they can rely on

• Comfort which would help them make a proper assessment and save their time

What is stakeholder’s expectations

17

Provide assurance / comment on improvement

Sector specific acumen

Proactive

Root cause & detailed solutions

Value addition

Practical advice

Cost effective solution

Different form of communication for each stakeholder

18

Process owner

• Discussion of draft queries during the execution audit

• Draft internal audit report

• Detailed annexures, instances

HOD

• Summarise observations and discussion at exit meeting

• Draft internal audit report along with management reply given at the time of exit meeting

• Discussion of observation and take prima facie reply

CFO / COO / MD / ACM

• Executive summary

• Presentation

Statutory Auditor

• Audit report with annexures providing instances

Common Mistakes

19

Drafting errors

•Examples

•Spelling mistakes

•Wrong English

• Incomplete sentences

•Long sentences

• Incorrect use of punctuations

Flow of report

•Examples

•Starts with the most low risk points. Can lead to loss of interest of the reader

•Lack of a pattern or flow in the report. This confuses the reader

• Important point gets lost in the volume of pages

Incomplete information

•Examples

•Does not contain proper examples, sample size, extent of problem, Root cause

•Recommendation (or poorly drafted recommendation)

•Vague comments / sentences

Use of technical jargons

•Confuses the reader

•Makes report reading more painful

Report drafting is started after completion of field work

•Leads to information gaps which takes time to fill up

•Team losses grip over observation

•Risk of mis-communication increase

Common Mistakes

20

No clarity about stakeholder expectation

More focus on the transaction rather than the process or system failure

Implications or risk not being brought out clearly

Lack of practical recommendations

Common Mistakes

21

Identifying who is the reader

Focus only on negative aspects or mistakes

Projecting process owners as Villains,

Blowing up things out of proportion

Long Para’s

Ambiguous

Name of Personnel

Technical Jargon

Negative Comments

Criticisms

22

Don’ts for report writing

23

Tips

24

First three points of the report should be the strongest points

Keeps the reader interested Generates interest

Go from Macro to Micro

Helps set the tone Usually readers want to know the

overall picture Gives overall comfort or

discomfort as the case may be

Simplicity & clarity in communication

25

Characteristics of good Internal Audit Report

Simple, clear,

alive & short

Spell Check Think

before you write

Precise Use of tables,

graphs and charts

Proof reading

Authoritative words like

“Must”

Discuss observations

with client Active Voice

26

Tips for effective report writing

Treat the report like business proposal. Report should engage the audience.

Quantify the impact of the observations

Captivating headings should be used. For e.g. revenue leakage, double payment etc.

Report should be divided into sections. [Area-wise, criticality wise, category wise or conclusion wise]

Use correct grammar and punctuation

27

Tips for effective Internal Audit Report writing

Consistency in use of phrases and words.

Consistency and mention of assumptions for working of financial impacts

Full form of abbreviations to be given in the report For emphasis use bullets, sidebars and bold or italic type

Details not included in the main report should be given in annexures

Use of colors indicating whether the operating staff has accepted, partially accepted or not

accepted the findings/suggestion of the auditors

28

Tips for effective Internal Audit Report writing

Basic framework is written before start of the field work (Skeleton report)

Flesh is given during the field work

Final touches, overall analysis including additional points not considered initially are recorded after the end of the field work

29

Start writing the Internal Audit Report

Standard format to be created for common

observation

Reading other internal audit reports

Impart training on report writing

Improve grammar

Excellence

30

Solutions to improve Internal Audit Report writing

31

Innovations / Out of box thinking

32

The written content can be reduced as the picture & flow charts are self explanatory

• Can be effectively used to show stock not arranged in warehouse

• Safety lapses

• Missing signs / labels

Use of pictures

• depicting redundant processes & duplications

• AS is Vs To be

• Process gaps

Flow

Chart

Innovations / Out of box thinking

33

• Use of graphs / charts • In 20 out of 50 cases of discounts given to customer, the approval from managing director was not

obtained Or

Discount not approved as per policy

Approved Not Approved Total

34

SIA - 4 does not specify any standard report format

Different organisations will use different report formats (Word, Excel and Power Point)

Format depends on client expectation & requirements

Appropriate format should be used with consistency

Management will feel more comfortable if it becomes

accustomed to the report format and can readily turn to whatever is of interest

35

Report Format

Report Format Characteristics

Word Format - Traditional form

- Simple to use

- Reference to report page / para

Power Point Presentation - Most commonly used

- Facilitates use of risk indicators

Excel Sheet - Effective tool for grouping of

various observations

- Simple to use

36

Word, Excel & Power Point

37

Detailed Report i.e. Observations and Recommendations

Comments from Management

Date of the report

Action taken report

Restriction on report circulation

Place of sign & signature with membership no.

Title, addressee and report distribution list

Period of coverage of the report

Objectives paragraph

Opening / introductory paragraph

Executive Summary

Scope Paragraph

38

Elements of the Internal Audit Report

Opening / introductory paragraph comprises of the following :

Background of the Company

Identification of process & items of financial statements audited

Statement of responsibility of the entity’s management & responsibility of the internal auditor

39

Opening / Introductory Paragraph

Scope Paragraph should include the below mentioned points : Reference to the generally accepted audit procedures in India as

applicable

Description of the engagement background and the methodology of the internal audit

Description of the population and the sampling technique used

Limitation in scope / exclusion if any

40

Scope Paragraph

The basic attributes of audit finding are given below. The same should form part of the report.

Criteria Standards, measures or expectations used in making an evaluation

Condition The factual evidence as to what was found

Cause Reason for difference between criteria and condition [Lack of controls, circumvention of controls or external influences]

Effect Difference between condition and criteria [Impact on individual, business unit and company as a whole, quantify the impact]

Recommendation Action that must be taken to correct the cause

41

Detailed Report – Features of the observation

What is wrong

Why is it wrong

How to correct

What will be

done

Observations Root Cause Recommendations Management

Comments / Action Plan

42

Detailed Report – Observation to answer the following

Audit findings should be rated/ classified based on level of criticality

Readers of the report will understand the impact & relevance of observations

Risk rating must be based on likeliness and impact of the observations

Basis used for determining criticality should be documented

Symbols and colours can be used to classify new and carried forward observations

M

I

H

L

R

High

Medium

Low

Information

Recommendation

43

Detailed Report – Risk Rating of the observation

Reply to the observations

Time frame for taking appropriate corrective action

Personnel responsible for taking action

Resource requirements, if any, for ensuring such compliance

44

Comments from Management

45

Part of the report that is read first Provide gist of the report / key points expressed in a cryptic

manner

Provide conclusion / auditors opinion on the area under audit

46

What is Executive Summary ?

Enables the key personnel to read the report in time constrain

Macro perspective in short form

Quick reference for future use

Pick and choose – reader can decide what he wants to read

Readers judge and decide based on executive summaries to see if the rest of the report is worth reading

47

Need for Executive Summary

Should address the need of the audience

Linkage to the report

Tips for effective Executive Summary Clear and Concise

Correct and Simple Quantification

Flow – whether the same as the report or some other flow?

Usage of sentences vis-à-vis bullets

Need to be innovative, creative and attractive

48

Characteristics of good Executive Summary

Discussion Executive Summary

Along with the report All the receivers / readers of the report. Process owners and staff of the area audited

Meeting with the directors

HOD / BOD

Meeting with audit committee

Independent directors

49

Timing and Type of Executive Summary

Area

Overall Controls

High Medium Low Recommendation

Revenue Medium - 4 - -

Purchase and stores Medium - 6 - -

Expenses Medium - 3 - -

Accounts Medium - 3 3 -

Cash Medium - 1 1 -

Fixed assets Medium - 1 - 1

Insurance Medium - 2 - -

Human resources and payroll

Strong - - 3 -

Statutory compliance

Weak 6 5 - -

Total 6 25 7 1

Exhibit of overall analysis

Quick and easy communication in functioning of the Company

Reflects area wise number of observations based on risk indicators [High, Medium, Low and Recommendation]

50

Use of Overall Analysis in Executive Summary

Q & A Session

51

C.A. Prashant Daftary prashant.daftary@nashah.com

52