Audit ReportsACT3642

1/2009

A.Phassawan S.

Agenda Audit reports for effective IA Communication Purposes and types of audit reports Published audit reports Audit reporting cycle

Audit Reports for Effective Communication An audit report is a formal document where internal

audit summarizes its work on an audit project and reports its findings and recommendations based on that work.

Effective audit reports must be supported by high-quality audit fieldwork, but that same audit fieldwork can be nullified by poorly written or prepared reports.

Audit Reports for Effective Communication Preparation of clear and effective reports is a major

concern for internal auditors at all level, from CAE to staff members.

All members of internal audit organization must be effective communication in their writing.

Agenda Audit reports for effective IA Communication

Purposes and types of audit reports Published audit reports Audit reporting cycle

Purposes & Types of Audit Reports Internal audit reports should always have four basic

objectives.

1) Disclosure of findings The audit report should summarize and outline the

conditions observed or found, both good and bad.

It can be viewed as a source of information to management concerning the operations of some segment of the organization.

Purposes & Types of Audit Reports

2) Description of findings The audit report should describe what, if anything is

wrong with the condition found, as well as why it is wrong.

The term “wrong” here includes internal control weaknesses, violation of company procedures, and any of a wide variety of other internal audit concerns.

Purposes & Types of Audit Reports

3) Suggestions for corrections Audit reports should include recommendations,

based on the findings, to serve as a framework for action for correcting the conditions and their causes.

The objective of these report suggestions is to improve operations.

Purposes & Types of Audit Reports

4) Documentation of plans and clarification of views of audittee

The audittee may wish to provide a clarification of issues for any reported matters in disagreement.

This is also a place where the audittee can formally state plans for corrective actions in response to the audit findings and recommendations.

Purposes & Types of Audit Reports

This four-step process - (1) what is wrong? (2) why is it wrong? (3) what should be done to correct the matter? (4) what will be done? – forms the basis of all audit reports.

IA should always keep these four steps in mind when drafting audit reports and the separate audit findings that provide the basis of them.

Agenda Audit reports for effective IA Communication Purposes and types of audit reports

Published audit reports Audit reporting cycle

Published Audit Reports

There are four main concerns to publish audit reports Approaches to published audit reports Elements of an audit report findings Balanced audit report presentation guidelines Alternative audit report formats

Published Audit Reports

a) Approaches to published audit reports The form and content of internal audit reports can

vary widely. An audit report covering a review of internal controls

may appear different from one on the adequacy of business continuity controls or one on fraud investigation procedures.

But, the formal audit reports should always cover a similar general format, starting with (i) a cover page, (ii) a description of the work performed, and (iii) findings and recommendations.

Published Audit Reports

a) Approaches to published audit reports An audit report should begin with an introductory

page containing 6 main elements. (See Exhibit 17.1)1) Report addressees and carbonees

2) Title of report and objectives of review

3) Audit scope and date of the fieldwork

4) Locations visited and timing of audit

5) Audit procedures performed

6) Auditor’s opinion based on the results of the review

Published Audit Reports

b) Elements of an audit report findings Auditors will encounter a large number and variety

of these exceptions in the course of almost any review. Some exceptions may be relatively important- such as

lack of authorized signature in purchasing order.

Others may be relative minor-such as the discovery of an employee reporting $25.50 for meal expenses when policy requires that such expenses must be < $25.00.

Published Audit Reports

b) Elements of an audit report findings Senior management may not be too interested in an

audit report that is filled with these minor infractions.

Such smaller internal control exceptions should be documented and discussed with management at the conclusion of fieldwork.

They may not necessarily be the type of issues to report to senior management through a formal audit report.

Published Audit Reports

b) Elements of an audit report findings Audit report findings presented in a common format

allow the report reader to understand the audit issues easily.

No matter what the nature of the audit work or the findings, readers should be able to scan an audit finding and quickly decide what is wrong and what needs to be corrected.

Published Audit Reports

b) Elements of an audit report findings Good audit report findings should contain the

following:1) Statement of condition

2) What was found?

3) IA’s criteria for presenting the finding

4) Effect of the reported finding

5) Cause or reason for the audit deviation

6) Internal audit’s recommendation

Published Audit Reports

1) Statement of condition The first sentence in a report finding should

usually summarize the results of IA’s review of the area of concern.

It can give a comparison of “what is” with “what should be.” The “what is” summarizes the condition made by IA

based on the facts disclosed in the review.

The purpose is to capture the reader’s attention.

Published Audit Reports

1) Statement of Condition Examples of findings statements of condition

include:

I. “Obsolete production equipment is being sold at bargain rates and in a manner that does not follow fixed asset disposition policies.”

II. “The backup and contingency plan for the new customer billing system has not been tested and does not follow security standards.”

Published Audit Reports

2) What was found? The findings should discuss both the procedures

and the results of those procedures.

Depending on its complexity, the finding can be summarized in little more than one sentence or may require an extensive discussion describing the audit procedures.

E.g., “Based on a sample of employee expense reports filed for fourth quarter 20XX, the preferred organization rental car agency was not used in over 65% of the expense reports reviewed.”

Published Audit Reports

3) IA’s criteria for presenting the finding The finding should always have a criterion, or a

statement of “what should be” to be used in judging the statement of condition.

Without strong criteria there cannot be an audit finding.

Criteria may be the policies, procedures, and standards of an organization.

Published Audit Reports

4) Effect of the reported finding IA should always consider the question of “how

important?” when deciding whether to include an item in the audit report.

IA must consider materiality-if the finding is of no significance, it may not be a finding at all.

Once the decision has been made to include it as a finding in the audit report, the effect of the reported condition should be communicated.

Published Audit Reports

5) Cause or reason for the audit deviation The answer to the question “why?” is specially

important to management when reading an audit report.

The reasons for a deviation from requirements, standards, or policies should be explained as well as possible.

Identifying a cause for the condition gives a basis for taking needed management action.

Published Audit Reports

6) Internal audit’s recommendation Audit report findings should conclude by

recommending appropriate corrective actions.

This is the audit finding’s conclusion of “what should be done?”

Published Audit Reports

c) Balanced audit report presentation guidelines IA has a responsibility to disclose both satisfactory

and unsatisfactory conditions found during an audit.

IA should encourage management to take needed corrective action and to produce results by minimizing the description of audit findings in totally negative terms.

Published Audit Reports

c) Balanced audit report presentation guidelines IA should adopt a positive reporting style;

that is balanced with a mixture of favorable and appropriate unfavorable comments,

that always present matters, and emphasize constructive rather than just negative comments.

IA must sort through the various positive/negative data and make comments relating to the firm’s ability or inability in timely manner and ignore other unrelated issues.

Published Audit Reports

c) Balanced audit report presentation guidelinesImproving audit report tonal quality

The use of positive and constructive words and ideas rather than negative and condemning language will give a positive tone to the report. (see exhibit 17.4)

Unless “deserved”, audit reports should avoid phrases indicating that the audittee “failed to accomplish,” “did not perform,” or “was not adequate” and should state audit report ideas in a positive and constructive manner.

Published Audit Reports

d) Alternative audit report formats IA can use other approaches to describe the results

of their audit findings and recommendations such as:

Oral reports Interim or informal memo reports Questionnaire-type audit reports Regular descriptive audit reports Summary audit reports

Agenda Audit reports for effective IA Communication Purposes and types of audit reports Published audit reports

Audit reporting cycle

Audit Reporting Cycle Exhibit 17.6 outlines in detail the critical phrases and

action steps for the preparation of an audit report. However, these steps can be altered to fit the needs.

Outline audit findings

Prepare auditreport first draft

Discuss withmanagement

Prepare final audit report draft

Audit report closingreference

Issuance of finalreport

Audit Reporting Cycle

Conclusions IA has a responsibility to produce audit reports

that are readable, understandable, and persuasive.

The objective is: to issue reports that will command the attention of the

managers who have the responsibilities for the various activities, and

to induce them to take appropriate corrective action.

Audit Reporting Cycle

Conclusions The reports become a statement of IA’s

creditability when reports are subsequently circulated, referred to, and implemented.

Audit reports are usually the major factor by which the reputation of an internal audit department is established.

IA’s formal audit reports and their supporting workpapers are important documents supporting IA’s activities.

Audit Reporting Cycle

Conclusions Procedures should be implemented to retain the

records for each audit performed as part of regular corporate records storage procedures.

While we often think of stored IA records as paper binders of workpaper files and other supporting materials, most IA work today should be developed in computer records.

This material should be scanned or copies and then downloaded to a secure storage media.

QUESTIONS