PRESENTATION ON INTERNAL AUDIT REPORT WRITING PART I

PRESENTATION ON INTERNAL AUDIT REPORT WRITING PART I ORGANISED BY CA ALLAHABAD BRANCH ON MAY 19, 2012 AT HOTEL KANHA SHYAM ALLAHABAD Presented by: CA Verendra Kalra

Introduction What is an Audit Report? • An audit report is a formal document where internal audit summarises its work on an audit and reports its findings and recommendations based on that work. • The Auditor's report is provided as an assurance service in order for the user to make decisions based on the results of the audit. An audit report apart from disclosing the findings about the auditee also helps the users to evaluate the performance of the auditors themselves. More often than not, the report becomes a statement of the auditor’s credibility when they are circulated, referred to and implemented. It is a major factor by which the reputation of internal audit department is established. INTERNAL AUDIT REPORT WRITING PART I 2

Introduction An Internal audit report is basically a four step process comprising of: What is wrong? • Disclosure of findings and processess involved in arriving at such finding. Why is it wrong? • Description of findings-the root cause analysis. How to correct it? • Recommendations and Suggestions. What will be done? • Auditee's views and comments. INTERNAL AUDIT REPORT WRITING PART I 3

Introduction An Internal audit report should have the following features: Present findings both favourable and Disclose unfavorable in a concise manner so that the findings: auditee is apprised of the situation in an operation/ segment. Adverse findings should be described in detail. It could be internal control weakness, gaps, Description of violations of procedures or any other audit findings: concern. Each finding must be provable. Auditor beliefs, without proper documentation will not be carried to the report. INTERNAL AUDIT REPORT WRITING PART I 4

Introduction An Internal audit report should have the following features: Suggestions The auditor should make suggestions for and prevention or correction of the deficiencies or Recommendat gaps identified. ions: The auditee may wish to provide clarifications on any of the issues reported or state the Auditee’s constraints or mitigating circumstances or what Comments: corrective action the auditee has initiated or proposes to initiate. INTERNAL AUDIT REPORT WRITING PART I 5

Compliance with relevant standards on Internal Audit issued by ICAI: • Standard on Internal Audit (SIA) 4, “Reporting” states that the internal audit report: o contains the observations and comments of the auditor, o presents the audit findings, and o discusses recommendations for improvements. • It further states that the auditor’s report should contain a clear written expression of significant observations, suggestions/recommendations based on the policies, processes, risks, controls and transaction processing taken as a whole and managements’ responses. 6 INTERNAL AUDIT REPORT WRITING PART I

Compliance with relevant standards on Internal Audit issued by ICAI: • Standard on Internal Audit (SIA) 9, “Communication with Management” states that different stages of communication and discussion should be as under: o Discussion Draft: At the conclusion of fieldwork, the auditor should draft the report and present it to the entity’s management for auditee’s comments. o Exit Meeting: The auditor should discuss with the management the findings, observations, recommendations, and text of draft and obtain their comment on the draft, achieve consensus and reach an agreement on the audit findings. 7 INTERNAL AUDIT REPORT WRITING PART I

Compliance with relevant standards on Internal Audit issued by ICAI: o Formal Draft: The auditor should prepare a formal draft, in view of the outcome of the exit meeting and other discussions. Upon review of such changes by the auditor and the management, the final report should be issued. o Final Report: The report should be submitted to the appointing authority or such members of management, as directed. INTERNAL AUDIT REPORT WRITING PART I 8

Compliance with relevant standards on Internal Audit issued by ICAI: • Standard on Internal Audit (SIA) 2, “Basic Principles Governing Internal Audit” states that: o The auditor should carefully review and assess the conclusions drawn from the audit evidence obtained, as the basis for his findings contained in his report and suggest remedial action. INTERNAL AUDIT REPORT WRITING PART I 9

Compliance with relevant standards on Internal Audit issued by ICAI: • Standard on Internal Audit (SIA) 8, “Terms of Internal Audit Engagement” states that: o Confidentiality of the Report: The engagement letter should contain a condition that the report of the auditor should not be distributed or circulated by the auditee or the auditor to any party other than that mutually agreed between the auditor and the auditee unless there is a statutory or a regulatory requirement to do so. o Limitations: The terms of engagement should specify clearly the limitations on scope, coverage and reporting requirement, if any. INTERNAL AUDIT REPORT WRITING PART I 10

Compliance with relevant standards on Internal Audit issued by ICAI: • Standard on Internal Audit (SIA) 12, Internal Control Evaluations states that: o The auditor should make management aware, as soon as practical and at an appropriate level of responsibility, of material weaknesses in the design or operation of the internal control systems, which have come to his attention. o The communication of material weaknesses to management would ordinarily be in writing, as part of the internal audit report. INTERNAL AUDIT REPORT WRITING PART I 11

Compliance with relevant standards on Internal Audit issued by ICAI: • Standard on Internal Audit (SIA) 12, Internal Control Evaluations states that: o The auditor should make management aware, as soon as practical and at an appropriate level of responsibility, of material weaknesses in the design or operation of the internal control systems, which have come to his attention. o The communication of material weaknesses to management would ordinarily be in writing, as part of the internal audit report. INTERNAL AUDIT REPORT WRITING PART I 12

Compliance with relevant standards on Internal Audit issued by ICAI: o Report should also specify that only weaknesses which have come to attention as a result of the audit have been reported and that examination has not been designed to determine the adequacy of internal control for management purposes. o The auditor in his report to the management, should provide: § A description of the significant deficiency or material weakness in internal control. His opinion on the possible effect of such weakness on the entity’s control environment. INTERNAL AUDIT REPORT WRITING PART I 13

Compliance with relevant standards on Internal Audit issued by ICAI: o Similarly If the auditor is precluded by management or those charged with governance from obtaining sufficient appropriate audit evidence to evaluate whether non-compliance that may be significant to the functioning of the entity has, or is likely to have, occurred, the auditor should report the same in accordance with SIA 4, “Reporting”. INTERNAL AUDIT REPORT WRITING PART I 14

Types of Audit report Oral Report Descriptive Audit Report Interim (Informal) Report Summary Audit Report INTERNAL AUDIT REPORT WRITING PART I 15

Types of Audit report An Internal audit report should have the following features: Oral Reports • Such reports should only be supplementary and not a substitute to written reports. • This mode might be used for reporting findings requiring emergency action; or as an oral presentation; or as a prelude to the formal written report. • As per SIA 9 the auditor should document all oral communications also recording to whom such communication was made. INTERNAL AUDIT REPORT WRITING PART I 16

Types of Audit report An Internal audit report should have the following features: • Such reports are issued when the management has to be informed of significant event or problems Interim requiring prompt action. (Informal) • Sometimes it is used to record the discussions in an Reports oral presentation. • The content of such a report is eventually included in the final report. • In most audit assignments a detailed regular report is given at the conclusion of audit. Descriptive • The form and content may vary with different type Reports of assignments, functions or as may be mandated by the auditee. INTERNAL AUDIT REPORT WRITING PART I 17

Audit report Users: Internal Users Audit reports must meet the varying information needs of its users: Addressee of report: • The Final Report should always be addressed to a person one level above the auditee or as mandated by the appointing authority. • The additional copies or CC may be marked to persons in the distribution list as finalized at the time of engagement or as mandated by the appointing authority. • Draft reports may be addressed directly to the auditee level for obtaining their response. Confidentiality: • Hard copies: The report should be marked strictly confidential, and should be circulated in sealed envelopes, only to the persons mentioned in the distribution list. INTERNAL AUDIT REPORT WRITING PART I 18

Audit report Users: Internal Users • Soft copies: To ensure transparency and visibility, a single mail should preferably be sent with CC to persons in distribution list, instead of sending individual mails to each such recipient. INTERNAL AUDIT REPORT WRITING PART I 19

Audit report Users: External Users There can be external users of the Internal Audit Report also. Standard on Internal Audit (SIA) 8, “Terms of Internal Audit Engagement” states that: “When the auditor has a specific responsibility, arising out of law or a regulation or a professional standard applicable to the auditor, to communicate directly to an appropriate authority……. or a regulator, the terms of engagement should contain a clear mention of such responsibility. ” INTERNAL AUDIT REPORT WRITING PART I 20

Essentials of a Report The report should be Accurate Free from errors and distortions and faithful to the underlying facts. Objective Fair, impartial, and unbiased and is a result of a fair minded and balanced assessment of all relevant facts and circumstances. Clear Easily understood and logical, avoiding unnecessary technical language and providing all significant and relevant information. Concise To the point, avoid unnecessary elaboration, superfluous detail, redundancy, repetitiveness and wordiness. INTERNAL AUDIT REPORT WRITING PART I 21

Essentials of a Report Constructive Helpful to the engagement client and the organization and leads to improvements where needed. Complete Lacking nothing that is essential to the target audience and includes all significant and relevant information and observations to support recommendations and conclusions. Timely Opportune and expedient, depending on the significance of the issue, allowing management to take appropriate corrective action. INTERNAL AUDIT REPORT WRITING PART I 22

Stages in Report Writing The audit report is a process in itself, which starts with: Identification of audit findings Preparation of first draft report Discussions draft Exit meeting & Formal Draft Final Report INTERNAL AUDIT REPORT WRITING PART I 23

Planning Revising Drafting Begin with the end in mind. ” Analyse the audience Who will be the most important reader of the report? How much do they know about the subject? How do they plan on using the report? How interested are they in the report? What’s their reaction going to be to the report’s message. INTERNAL AUDIT REPORT WRITING PART I 24

Planning Revising Drafting Use a Top Down Approch Use a heading that would accurately summarise the report’s message. Write a summary paragraph that summarises the report’s key points. INTERNAL AUDIT REPORT WRITING PART I 25

Write paragraphs that explain and provide evidence for the statements made in the summary paragraph. INTERNAL AUDIT REPORT WRITING PART I 26

Stages in Report Writing: Drafting Writing an effective audit reports will require that the report should be attention-getting, readable and credible. The art of report writing can be segregated into three major sections : Report Design Writing Style Report Content Effective Report design has two components: Visual Appeal Reading Efficiency There is always a competition for reader’s attention and time. Once attention is captured, writing style and content should be able to maintain this attention. Writing Style generally consists of the following: Tone Vocabulary Syntax Grammer For audit report purposes, style is defined as the manner in which the content is written. INTERNAL AUDIT REPORT WRITING PART I 27

Stages in Report Writing: Drafting Visual Appeal Reading Efficiency Design Techniques Format Report should look professional; be easy to read and develop a positive feeling. Report should not appear long, dull and tedious. Give special attention to type size & style; Line length when drafting. Use standard format, bullets, white space, Page Nos. , headers and footers. Fonts and formatting can vary from organisation to organisation, but it must be consistent within the organisation. INTERNAL AUDIT REPORT WRITING PART I 28

Stages in Report Writing: Drafting Tone Avoid biased and emotionally charged, subjective language. Always maintain objectivity. Terminology Use consistent terminology, avoid interchangeable terms (e. g. objective and goal). Sentence In editing reports, try to look closely at sentences Length with more than 20 words. Eliminate Empty words; Overstated Language; Filler phrases; Repetitions. Active Voice Use the active voice because it clearly identifies who is responsible. Stereotypes Avoid referring to men and women, the principles of equality must be used. INTERNAL AUDIT REPORT WRITING PART I 29

Stages in Report Writing: Drafting Quotation Grammar Use when possible briefly, in parentheses, or more completely, in a footnote. Adequate care must be taking to avoid common grammatical errors. INTERNAL AUDIT REPORT WRITING PART I 30

Stages in Report Writing: Revising Report Level : Is the central message of the report clear and does the report have: • An appropriate length (Is it too short or too long)? • A clear summary of the report up front? • Sufficient and clear headings? • Suitable graphics such as tables, charts pictures etc. ? Paragraph Level : Does the paragraph contain • A topic sentence that accurately conveys the paragraph’s central idea? • Enough information to support the idea expressed in the topic sentence? • Too much information so that it will overwhelm the reader? INTERNAL AUDIT REPORT WRITING PART I 31

Stages in Report Writing: Revising • Ideas presented in the sentences flow logically (i. e. , are they in the correct order)? Sentence Level : Are all the words in my sentences necessary? Are my sentences easy to understand? Do the sentences contain action verbs and actors (active vs. passive construction)? INTERNAL AUDIT REPORT WRITING PART I 32

Audit report structure Title • Title should be brief and definitive and clearly express the nature of report. • It is desirable to have a covering letter written Covering and signed by the partner and made a part of Letter the audit report. It should be as brief as possible. INTERNAL AUDIT REPORT WRITING PART I 33

Audit report structure • Report should always be addressed to person one level above the auditee. Addressee • Draft report however should always be addressed to the auditee at the operational level or to the person responsible for providing auditee comments. INTERNAL AUDIT REPORT WRITING PART I 34

Audit report structure • Report should list and mention the "intended Report Distribution List recipients" of the report. • This list will be initially defined in the engagement letter and may subsequently be updated on the basis of input provided by the management. Restriction on • Report should state that it is to be used for Use intended purpose only. INTERNAL AUDIT REPORT WRITING PART I 35

Audit report structure • There should be clear mention of "period Period/timing of Coverage covered" under audit. • It should mention when the audit was performed and also the locations visited. INTERNAL AUDIT REPORT WRITING PART I 36

Audit Report Structure Procedures • Audit procedures performed to arrive at findings should be mentioned. • The procedures used to arrive at audit findings and conclusions may be explained in brief or descriptive (in case some special procedures have been adopted). INTERNAL AUDIT REPORT WRITING PART I 37

Audit Report Structure Staff Deployed & Skills • Report should contain the details of the staff involved in carrying out the audit. • The professional qualification and specialization should also be mentioned. • The number of man hours (or time) spent by each in the audit should be given. INTERNAL AUDIT REPORT WRITING PART I 38

Audit Report Structure Dates timeline • The auditor should mention in the Report, the dates of : ⁻ Discussion draft, ⁻ Exit meeting, ⁻ Formal draft and ⁻ Final report. INTERNAL AUDIT REPORT WRITING PART I 39

Nature of audit Assignment Audit report structure • Report should identify the type of engagement (i. e. regular, special etc. ). • Report may provide background information necessary about systems, processes and the functions audited. Objectives • Objectives should be clear and concise and should correspond to audit conclusions. • Objectives stated in the report should be same as those appearing in the detailed audit programme. INTERNAL AUDIT REPORT WRITING PART I 40

Scope Audit report structure • The scope should be communicated clearly. This section should describe the depth and coverage of audit work conducted to accomplish the audit's objectives. • It should include any significant information that the reader would need to know, such as a departure from procedures, data limitations, scope impairments or clarification of work performed. INTERNAL AUDIT REPORT WRITING PART I 41

Audit report structure Limitation • When there is a limitation on the scope, the report should describe the limitation INTERNAL AUDIT REPORT WRITING PART I 42

Executive Summary Audit report structure • This section should contain summary of key findings, observations and recommendations for the benefit of the top management. Observations, • The report should clearly mention the process name; Findings significant observation and findings with respect to the Recommenda criteria; analysis of the consequences of the findings; tions and recommendations of the auditor. • Each observation should be supported by a set of facts. • Always give management a business reason for implementing recommendations. INTERNAL AUDIT REPORT WRITING PART I 43

Audit report structure Auditee’s response Auditor’s Comments • All recommendations should be followed by the auditee's response. • Responses should be included verbatim. • These comments are used as necessary to further evaluate the adequacy of the auditee's written responses. INTERNAL AUDIT REPORT WRITING PART I 44

Audit report structure General • This section is reserved for points of interest that are Comments of lesser magnitude than findings, but of interest to operational management. • Written responses from the auditee are not required for general items. INTERNAL AUDIT REPORT WRITING PART I 45

Audit report structure Follow up • This section contains the status of corrective action taken or proposed corrective actions and or compliance of previous internal audit observations already taken or being taken, also action not taken and reasons thereof. • Revised timelines of open items and fixation of responsibility of concerned persons INTERNAL AUDIT REPORT WRITING PART I 46

Audit report structure Date & Place of signing • It should contain the date on which the auditor signs the report expressing his comments and observations. • Specify location (generally the city where report is signed). Internal Auditor's Signature • Report should be signed in personal name and membership number also to be mentioned. INTERNAL AUDIT REPORT WRITING PART I 47

5 Cs in Report Writing The five primary components of an audit observation are: Criteria Corrective Action plans Consequence Conditions Causes INTERNAL AUDIT REPORT WRITING PART I 48

5 Cs in Report Writing • Observations and Recommendations in report writing emerge by a process of comparing criteria (the correct state) with condition (the current state). The report should specify the following: Criteria These are the standards or measures used in making an evaluation and/or verification (The correct state). Conditi It is the factual evidence that the auditor found in the on course of the examination (The current state). Causes The reasons for difference between expected and actual conditions. INTERNAL AUDIT REPORT WRITING PART I 49

5 Cs in Report Writing • Observations and Recommendations in report writing emerge by a process of comparing criteria (the correct state) with condition (the current state). Conseque The risk or exposure the organization and/or others nce encounter because the condition is not consistent with the criteria (the impact of the difference). Corrective It refers to action recommended/suggested to Action correct existing conditions or improve operations and may include suggestion for correcting or enhancing performance as a guide for management INTERNAL AUDIT REPORT WRITING PART I 50

5 Cs in Report Writing: Case Study Criteria Variation in stock on physical verification with the balance as reflected in the stock register should be NIL. Condition The stock physically verified was short by 2 units as against the balance shown in the stock register. Causes Issues made during the night shift were not recorded. Consequence The stock position in the books is overstated and possibility of stock pilferage is high due to lack of control. Corrective Night shift stock keeper needs to be appointed. Alternatively, the requirement of Action stock for the night shift should be issued at day end as per the requisition of the production in charge for the night shift. The consumption during night shift is verified by counting in the morning the balance stock left out of the lot issued to the floor during the previous days close. INTERNAL AUDIT REPORT WRITING PART I 51

Providing Assurances • An opinion is best expressed when using a defined criteria and evaluation structure. • There are two different types of opinions, positive assurance and negative assurance. • Positive assurance implies a lot of responsibility and should be used with caution and consideration. A positive assurance opinion requires the highest level of evidence. • A positive assurance should not be given unless the auditor has been mandated to do so and the auditor’s scope encompasses such assurance. Such assurance is supported by adequate, competent evidence in accordance with prescribed standards. • Increased precision in the information provided in an opinion increases the amount of evidence needed to support the opinion. INTERNAL AUDIT REPORT WRITING PART I 52

Use of grades/ rating in providing assurances • Variations in expressing a positive assurance opinion may include the use of grade such as: Color coding (such as red yellow green) Grading scale (such as 1 to 4) • Use of ratings is generally done for individual audit assignment at micro level and the rating process is applied in relation to individual audit findings. • Grades used should be agreed-upon and commonly understood within the organization. INTERNAL AUDIT REPORT WRITING PART I 53

Use of grades/ rating in providing assurances • Ideally, prior recommendations should also be included. When using a grading system to communicate a positive assurance opinion, care must be taken with wording, particularly with when using words such as adequate or inadequate. • Wording should be clear and appropriately defined for the reader. Avoid using general terms such as satisfactory, effective, or unsatisfactory unless appropriately defined. INTERNAL AUDIT REPORT WRITING PART I 54

Use of grades and rating in providing assurances • The organization needs to have a clear, common understanding of these terms and what constitutes an acceptable level of performance, all of which require a frame of reference. • For example, the term “effective” refers to controls being effective both in design and in operation. The opinion needs to indicate whether both meanings are included. • In preparing the report ensure that all technical terms (e. g. , material weakness) are clearly defined for the reader. Use of a grading scale requires a well-defined evaluation structure. INTERNAL AUDIT REPORT WRITING PART I 55

Use of grades and rating in providing assurances • Grading sysytem should have the quality of consistency and sustainability. Gradings that change too frequently can be confusing to stakeholders and may impact comparability and clarity of reporting across the organization. • Care should also be taken not to form opinions based on isolated instances but to identify a pattern of repeated instances even if of insignificant value. INTERNAL AUDIT REPORT WRITING PART I 56

Use of grades and rating in providing assurances • 4 Tier Grading System ( An illustration): Grade Used Remarks Effective Controls evaluated are adequate, appropriate, and effective to provide reasonable assurance that risks are being managed and objectives should be met. Some A few specific control weaknesses were noted; Improvement However, controls evaluated are adequate, Needed appropriate, and effective to provide reasonable assurance that risks are being managed and objectives should be met. INTERNAL AUDIT REPORT WRITING PART I 57

Use of grades and rating in providing assurances • 4 Tier Grading System ( An illustration): Grade Used Remarks Major Numerous specific control weaknesses were Improvement noted. Needed Controls evaluated are unlikely to provide reasonable assurance that risks are being managed and objectives should be met. INTERNAL AUDIT REPORT WRITING PART I 58

Use of grades and rating in providing assurances • 4 Tier Grading System ( An illustration): Grade Used Remarks Unsatisfactory Controls evaluated are not adequate, appropriate, or effective to provide reasonable assurance that risks are being managed and objectives should be met. INTERNAL AUDIT REPORT WRITING PART I 59

Use of grades and rating in providing assurances • Risk Rating Opinion: Deficiency Risk Rating in Relation to Audit Findings (Micro Level) Risk Rate Used High Immediate management attention is required. This is Priority a serious internal control or risk management issue Risk that if not mitigated, may, with a high degree of certainty, lead to: Substantial losses; Serious violation of corporate strategies, policies, or values; Significant adverse INTERNAL AUDIT REPORT WRITING PART I 60

Use of grades and rating in providing assurances • Risk Rating Opinion: Deficiency Risk Rating in Relation to Audit Findings (Micro Level) Risk Rate Used Substantial losses; Serious violation of corporate strategies, policies, or values; Significant adverse regulatory impact, such as loss of operating licenses/material fines. INTERNAL AUDIT REPORT WRITING PART I 61

Use of grades and rating in providing assurances • Risk Rating Opinion: Deficiency Risk Rating in Relation to Audit Findings (Micro Level) Risk Rate Used Medium As this is a medium-priority issue, timely management Risk attention is warranted. This is an internal control or risk management issue that could lead to: Loss of controls; Reputation damage; Adverse regulatory impact such as immaterial fines. INTERNAL AUDIT REPORT WRITING PART I 62

Use of grades and rating in providing assurances • Risk Rating Opinion: Deficiency Risk Rating in Relation to Audit Findings (Micro Level) Risk Rate Used Low Risk As this is a low priority issue, routine management attention is warranted. This is an internal control or risk management issue, the solution to which may lead to improvement in the quality and/or efficiency of the organizational entity or process being audited. Risks are limited. INTERNAL AUDIT REPORT WRITING PART I 63

Follow Up • Once a final report has been issued , the auditor should schedule a follow up review to ensure that needed actions based on the audit recommendations have been taken. • Standard on Internal Audit (SIA) 3, Documentation, states that: o The internal audit documentation should cover all important aspects of an engagement such as review of the findings, communication and reporting and follow up. o The internal audit documentation would, therefore, generally, include records as to the follow up on the recommendations/ findings. INTERNAL AUDIT REPORT WRITING PART I 64

Follow Up • Follow up’s nature, timing, and extent should to be based on the scope of engagement. • Though such a follow up is desireable it often falls on a line of conflict raising question as to whether such a follow up will convert the role of the internal auditor into a policeman from that of a local management partner. • Thus it is suggested that the auditor should play only a limited specific role after the final audit report has been issued. INTERNAL AUDIT REPORT WRITING PART I 65

Concluding Remarks The success of audit reporting is determined largely by the attitude and approach with which internal auditor carries out his duties. As auditors, we should aspire to be the agents of positive change in the organization, and strive to be viewed and accepted as valued insiders. Internal audit is not an isolated technical exercise but is an integral part of the corporate governance process and the report which is the culmination of the audit process has far reaching consequences in changing the way the business is done and risks are managed. The internal auditor has to not only possess adequate knowledge of the business he is auditing but also internalise that he is part of the management and his audit objective is aligned to the business objective and goals. INTERNAL AUDIT REPORT WRITING PART I 66

Concluding Remarks A report is a reflection of the auditor’s mindset and is only as good as the approach with which the audit has been done. No amount of add ons by way of style and presentation can mask the inadequacy of the auditor’s performance. INTERNAL AUDIT REPORT WRITING PART I 67

Questions INTERNAL AUDIT REPORT WRITING PART I 68

Thank You INTERNAL AUDIT REPORT WRITING PART I 69