COMMUNICATING AUDIT RESULTS AND INSIGHTS Audit Reports That

COMMUNICATING AUDIT RESULTS AND INSIGHTS Audit Reports That Spur Action By: Fred Oyugi B. Com, MBA, CISA, CPAK 13 th June, 2018 www. theiia. org/Training

AGENDA § § § Introduction IA function in value creation. PWC survey. IIA Standards on Communicating Results Communication during the Audit process. Communicating Internal Audit Results Possible risks in disseminating Audit results and how to address them. www. theiia. org/Training

INTRODUCTION § Internal auditors need to communicate the results of their engagements clearly and concisely to all relevant recipients. § Delivering audit findings with greater impact is a proven way for internal audit to provide assurance, aid governance, enhance risk management and prompt improvements. § It is therefore vital to write and communicate audit reports with a high impact. www. theiia. org/Training

SURVEY ON THE STATE OF INTERNAL AUDIT PROFFESSION • PWC’s 2017 - State of the Internal Audit Profession Study: Value of Internal Audit. The study found that Most Internal Auditors are slow to help their employers prepare for and respond to major corporate disruptions like regulatory changes and cyber attacks. www. theiia. org/Training

PWC SURVEY 2017 The stakeholders – Internal Auditors, Senior executives, and board members surveyed reporting that Internal Audit adds significant value has gone down since year 2014 in 2017 being the lowest with 44%. Why is this so? What next? 2014 54% 2015 48% 2016 54% 2017 44% 2018 ? ? www. theiia. org/Training

A key reason that so many of the Internal Audit function including apparently many internal auditors themselves-feel that internal auditors are not adding significant value is that they're slow to anticipate the huge changes affecting businesses these days, according to Mark Kristall, a PWC partner www. theiia. org/Training

• Such IA departments aren’t keeping up with the pace of change. • They only become involved after the disruption has already happened and affected the organization. • Hence the question is what makes IA effective and key partner in value creation? www. theiia. org/Training

EFFECTIVENESS OF IA FUNCTION IN VALUE CREATION Internal Audit Findings and reporting Internal Audit delivery Assessment Tools Internal Audit Resources www. theiia. org/Training

IIA STANDARDS ONCOMMUNICATION § 2400 -Internal auditors must communicate the results of their engagements. § 2410 -Communication must include the engagement’s objectives, scope, and results. § 2410. A 1 -Final communication of engagements results must include applicable conclusions as well as applicable recommendations and /or action plans. § An opinion must take into account the expectations of senior management, the board and other stakeholders and must be supported by sufficient, reliable, relevant and useful information. § 2410. A 2 -Internal Auditors must acknowledge satisfactory performance in engagement communications. www. theiia. org/Training

IIA STANDARDS ON COMMUNICATION § 1111 -The Chief Audit Executive must communicate and interact directly with the Board § 2060 -Reporting Periodically to the Senior Management and the Board on the Internal Audit activity, purpose, authority, responsibility and performance relative to the plan. § 2020 -The Chief Audit Executive must communicate the internal audit activity’s plans and resource requirements, including significant interim changes, to senior management and the board for review and approval. The CAE must also communicate the impact of resource limitations. § 2420 -Quality of Communications-Communications must be accurate, objective, clear, concise, constructive, complete and timely. § 2440 -Disseminating Results: The Chief Audit Executive must communicate results to the appropriate parties www. theiia. org/Training

STANDARD 2420: QUALITY OF COMMUNICATION § Accurate: Free from errors and distortions and are faithful to the underlying facts. § Objective: Fair, impartial, and unbiased § Clear: Easily understood and logical § Concise: To the point and avoids unnecessary elaboration § Constructive: Helpful to the engagement client and the organization § Complete: Lacks nothing that is essential to the target audience include all that is significant and relevant. § Timely: Opportune and expedient § Free from errors and omissions standard 2421 www. theiia. org/Training

COMMUNICATION DURING AUDIT PROCESS § Interaction and communication of the audit activities takes place during the entire audit process § Audit engagement Planning (2200): A successful audit means building time in at every stage to check progress and communicate regularly with colleagues and audit clients. Audit Notification Planning Fieldwork Draft Report Final Report www. theiia. org/Training

COMMUNICATING INTERNAL AUDIT RESULTS § Oral Reports: Only supplement but not a substitute to written reports. Used for reporting findings requiring urgent action; § Interim (Draft) Reports: Issued when the Management has to be informed of significant issues that require prompt action. The contents of interim reports are eventually included in the final report. A draft report will be provided to the Auditee in advance of the closing meeting. § Final Reports: This is a detailed regular report issued at the conclusion of an audit. The form and content may vary with different type of assignments…. . www. theiia. org/Training

WHAT DOES THE READER WANT TO SEE? § The audit report needs to make a case, line by line and sentence by sentence, for retaining the reader’s interest. § The longer the engagement, the broader or more complex the scope, or the more numerous your findings – the harder this is. § Ensure that the audit report: Uses short sentences, make it easy to read Uses the active rather than the passive voice Avoids jargon, clichés and buzzwords Don’t inflate the risk ratings www. theiia. org/Training

WHAT DOES THE READER WANT TO SEE CONT’D? § § § Even though readers will not see your working papers, well written audit documentation is easier to discuss with the client, submit for review and use in a report. Use of the right professional standards Include a statement of assurance www. theiia. org/Training

THE POWER OF PROPER LAYOUT § Layout can make or break a report. Using a readable, reasonably-sized font and using enough white space makes the difference between a report that has readers wincing and one that invites them. www. theiia. org/Training

THE POWER OF LAYOUT CONT’D § Using tables, graphs and even photographs can make your findings much easier to understand or visualize. § Sub-headings, while useful, can be distracting if too numerous. If you have too many layers of information, or crowd your document with too many graphics and colors, you will lose your readers. www. theiia. org/Training

MOVING FROM FIELDWORK TO THE BIG PICTURE § The auditee needs to understand why, for instance, several minor observations merit a higher-risk rating when seen in a broader context. § Communicating issues that audit client did not know, identifying root causes and opportunities for improving control design and trends in risks and controls. www. theiia. org/Training

• The easiest way to display audit results is using a tabular format because: it is easy to read and it needs less words. • Move on from compliance. Many audits are based on simple compliance approach whereas the contemporary mission of internal auditing is to “enhance and protect organizational value by providing risk based and objective, advice and insight” • This leads to greater focus on operating auditing, meaning audits shaped around the 4 E’s –efficiency, effectiveness, economy and ethics. www. theiia. org/Training

RISKS IN DISSEMINATING AUDIT RESULTS § Most of the time brilliant analysis and findings seem to be forgotten during of report writing stage. The reasons for this are: i. Failing to understand the broader corporate context ii. Focusing on minor details and low-risk instances of ineffective control, without considering underlying risks. iii. The report tells us what we already know/The report makes it sound worse than it is. www. theiia. org/Training

RISKS IN DISSEMINATING AUDIT RESULTS CONT’D iv. Anticipating opposition from readers and recipients may lead to softening critical messages and failing to communicate clearly what needs addressing. www. theiia. org/Training

RISKS IN DISSEMINATING AUDIT RESULTS CONT’D v. Adopting corporate group-speak (jargon, clichés and buzzwords). vi. Pressures of time and workload www. theiia. org/Training

HOW TO ADDRESS THE RISKS These risk can be addressed through: i. Regular Consultation ii. Attending high level meetings iii. Use of Information Technology-Team. Mate audit tool, Data analysis tools etc www. theiia. org/Training

HOW TO ADDRESS THE RISKS CONT’D IV Engaging the auditees/audit clients at all levels www. theiia. org/Training

HOW TO ADDRESS THE RISKS CONT’D V. Adoption of Enterprise Risk Management www. theiia. org/Training

HOW TO ADDRESS THE RISKS CONT’D VI. Proper planning www. theiia. org/Training

HITTING THE HOME RUN § Five Signals That Your Last Internal Audit Hit a Home Run – The CEO or CFO sees you in the hallway and stops you to talk about the audit. – Your audit recommendations result in significant cost savings, enhanced revenues, or major efficiencies. – Your internal audit reveals a major unrecognized risk or ferrets out a major fraud. – Operating management seeks out your advice on related or additional issues that surfaced in a recent audit report {RICHARD CHAMBERS, CEO, INSTITUTE OF INTERNAL AUDITORS} www. theiia. org/Training

hank ou! www. theiia. org/Training