11/18/2018
1
TALLAHASSEE CHAPTER
Internal Audit Management
Communicating Results
November 27, 2018
Tiffany Hurst, CIA
Director of Audit
Florida Department of Education
Office of Inspector General
TALLAHASSEE CHAPTER
Standard 2400 – Communicating
Results
• 2410 Criteria for Communicating
• 2420 Quality of Communications
• 2421 Errors and Omissions
• 2430 Conformance Statement
• 2431 Disclosure of Nonconformance
• 2440 Disseminating of Results
• 2450 Overall Opinions
TALLAHASSEE CHAPTER
Sawyer’s Wisdom
“The entire success of the audit project hangs largely on the report. It should be faultless. The critic will be severely criticized for any statement that is incorrect or out of perspective, or for any typographical or other error that is not corrected before the report goes out to its recipients.”
11/18/2018
2
TALLAHASSEE CHAPTER
Sawyer’s Wisdom
“For that reason, it should be crafted carefully and reviewed meticulously.”
TALLAHASSEE CHAPTER
Purpose of Engagement
Communications
• Inform
• Report on objectives
• Persuade
• Obtain Results
What do they do?
TALLAHASSEE CHAPTER
Purpose of Engagement
Communications
1. Explain the auditor’s observations, conclusions and recommendations
2. Attempt to convince the recipients of their value and validity
3. Promote beneficial change
11/18/2018
3
TALLAHASSEE CHAPTER
When to Communicate?
– Throughout the audit (Preliminary through Follow up)
– Start with Preliminary: Notify client management about the timing of the audit, the reason, scope, and resources needed.
– Interim: Progress communication provides a means of communicating a situation that requires immediate action.
• Use Interim Reports (oral or written)
TALLAHASSEE CHAPTER
Why Communicate?
• Adherence to the standards
• To alert management of your results
• Avoid surprises!
• Request explanations and additional documentation
• Find the root cause
TALLAHASSEE CHAPTER
Open Communication
“…success occurs when [the IG] office
has full and open communications with
every level of the department.” • * Anonymous Federal IG, Grant Thornton Public Sector – “Walking the Line”
11/18/2018
4
TALLAHASSEE CHAPTER
Communication Format
Orally
Written E-mail
Memorandum
Report
TALLAHASSEE CHAPTER
Oral Communication
Positives
Immediate
Face-to-face
Reveals attitudes and convictions
Counter argue
Improve rapport
NegativesLack of documentationLack factsMay not be open to all parties
TALLAHASSEE CHAPTER
Written Communication
Positives
Permanent
Precise
Explicit
Readily available
Negatives
Timeliness
Misinterpretation
Feedback not immediate
11/18/2018
5
TALLAHASSEE CHAPTER
Communication -
Relationships
“The relationship should never be “us versus them” and it never has to be a “gotcha” type of relationship….”
* Anonymous Federal IG, Grant Thornton Public Sector – “Walking the Line”
TALLAHASSEE CHAPTER
Communication Example
Bad Communication:
https://www.youtube.com/watch?v=jsLUid
iYm0w
TALLAHASSEE CHAPTER
Reporting Process
11/18/2018
6
TALLAHASSEE CHAPTER
Written Report – Common
Elements
• Executive Summary
• Background
• Scope
• Objectives
• Results
– Findings and Recommendations
• Statement of Conformance
TALLAHASSEE CHAPTER
Results - Finding Elements
TALLAHASSEE CHAPTER
Criteria
• “The way it should be.” – The correct state.
• Statutes, Policies, Rules, Procedures
• Benchmarks, Best Practices
11/18/2018
7
TALLAHASSEE CHAPTER
Condition
• “The way it is.” – The current state
• The factual evidence that the auditor found.
– Based on observation, questions, analysis, verification, testing
TALLAHASSEE CHAPTER
Cause
• The reason for the difference between the expected and actual conditions.
• Identify the root cause
– Gather and analyze facts
– Dig Deep, Not just on the surface
TALLAHASSEE CHAPTER
Root Cause
• Why did the issue occur?• Issue – error, instance of noncompliance, missed
opportunity
• Trace back to a decisions, actions, or inactions
• Management “Failed to”•Plan, Organize, Staff, Direct, Monitor
• Seek to understand why people make bad or inadequate decisions.
11/18/2018
8
TALLAHASSEE CHAPTER
Root Cause
• Identifying the underlying cause –• Provides insight for management
• Could Prevent reoccurrence
• Takes longer
• Ask the 5 whys
TALLAHASSEE CHAPTER
Effect• “So What”
• The impact of the difference
• The risk or exposure the organization or others will encounter
• What are the consequences?
• Harm to self or others
• Cost - $$$$$
• Effectiveness
• Efficiency• Goals
• Negative Public Reaction
TALLAHASSEE CHAPTER
Recommendations
• Must be convincing or it will not be implemented.
• Must address the basic/root cause of the deficiency
• Identify an action official
• Specific
• Significant
• Feasible
• Cost Effective
• Positive Tone and Content
• Give credit for actions already taken
11/18/2018
9
TALLAHASSEE CHAPTER
Conformance Statement
Indicating that engagements are “conducted in conformance with the International Standards for the Professional Practice of Internal Auditing” is appropriate only if supported by the results of the quality assurance and improvement program.
Why does it matter? This statement builds the internal audit’s credibility.
TALLAHASSEE CHAPTER
Disclosure of Non
Conformance
Communication of the results MUST disclose:
• Principle or rule with which full conformance was not achieved
• Reason for the nonconformance
• Impact of the nonconformance
TALLAHASSEE CHAPTER
Standard “Musts”
11/18/2018
10
TALLAHASSEE CHAPTER
Criteria for Communicating
Internal auditors MUST:
• Communicate the results of engagements.
Include:
• Engagement Objectives, Scope
• Applicable conclusions, recommendations, and action plans
TALLAHASSEE CHAPTER
Quality of Communications
Communications MUST be:
•Accurate
•Free from errors and distortions
•Faithful to underlying facts
•Objective
•Fair, impartial, and unbiased
•Fair-minded and balanced assessment of all relevant facts and circumstances.
TALLAHASSEE CHAPTER
Quality of Communications
Communications MUST be:
•Clear
•easily understood and logical,
•consistent with terminology used in the industry
•avoiding unnecessary technical language
•providing all significant and relevant information.
11/18/2018
11
TALLAHASSEE CHAPTER
Quality of Communications
Communications MUST be:
•Concise
• to the point
•avoid redundancy and exclude information that is unnecessary, insignificant, or unrelated to the engagement.
TALLAHASSEE CHAPTER
Quality of Communications
Communications MUST be:
•Complete
• lack nothing that is essential
• include all significant and relevant information and observations to support recommendations and conclusions.
•Enable the reader to reach the same conclusion as the internal audit activity did.
TALLAHASSEE CHAPTER
Quality of Communications
Communications MUST be:
•Constructive
•helpful to the engagement client and the organization
• lead to improvements where needed
•Timely
•opportune and expedient
•allowing management to take appropriate corrective action.
11/18/2018
12
TALLAHASSEE CHAPTER
Reviewing the Report
• Did the report answer the objective(s)
• Was it performed in accordance with applicable audit standards?
• Is the message clear?
TALLAHASSEE CHAPTER
Reviewing the Report
• Is the Overall Tone Appropriate
• Is the report the Appropriate Length?
• Is the Executive Summary truly a summary?
• Does it have a good Focus and Flow?
• Are Graphics clear & relevant?
TALLAHASSEE CHAPTER
Report Review - Elements
• Criteria
– Clearly Stated?
– Quotations vs. Summarizing
• Condition
– Strongly Supported?
11/18/2018
13
TALLAHASSEE CHAPTER
Report Review - Elements
• Cause
– Identified the root cause?
• Effect
– Fully known?
– Reasonable?
TALLAHASSEE CHAPTER
Report Review - Elements
• Recommendation
– Actionable?
– Management Buy-In?
TALLAHASSEE CHAPTER
Reviewing the Report -
Consistency
Is the report consistent?
• Date format (1/5/18 vs. January 5, 2018)
• Number format
• Fonts
• Acronyms (DOE vs. FDOE)
– Are they defined the first time?
11/18/2018
14
TALLAHASSEE CHAPTER
Reviewing the Report -
Consistency
• Language vs. symbols (Number vs. #)
• Sentence Structure
– Active vs. Passive structure
• Passive: Feedback was provided by the Audit Director.
• Active: The Audit Director provided feedback.
• Writing style (Ex. Chicago)
TALLAHASSEE CHAPTER
Reviewing the Report –
Avoid
• Never, Always, Some• Charged Words, i.e. “Management Failed”
• Technical Jargon and Buzzwords
TALLAHASSEE CHAPTER
Reviewing the Report –
Conformance
• Does the report conform to the IIA standards?
– Yes?
• Add the conformance Statement
– No?
• Disclose the reason why
11/18/2018
15
TALLAHASSEE CHAPTER
Proofread
“Proofread carefully to see if you any words out.”
~Author Unknown
TALLAHASSEE CHAPTER
Disseminating Results
• Verbally or in writing
• Electronic
• Hard Copy
• Maintain a list of the recipients
• Consider sensitive information
TALLAHASSEE CHAPTER
Errors and Omissions
Determining Significance: Ask these questions:
• Would the error or omission change the results of the engagement?
• Would the error or omission change someone’s mind about the severity of the findings?
• Would the error or omission change an opinion?
• Would the error or omission change a recommended action?
If final communication contains a significant error or omission, the chief audit executive MUST communicate corrected information to all parties who received the original communication
11/18/2018
16
TALLAHASSEE CHAPTER
Overall Opinions
Overall opinions differ from conclusions in that at conclusion is drawn from one engagement and an overall opinion is drawn from multiple engagements.
• Communicated separately from individual engagement communications
• Must be supported by sufficient, reliable, relevant, and useful information.