Audit Reporting at the Speed of Risk: 4 Strategies for Success

News last week of improvement in the U.S. jobless situation brought a glimmer of hope that, perhaps, the very worst may be behind us. At least for now. But disruption continues to engulf our personal and professional lives, as the twin impacts of the coronavirus COVID-19 — health and economic — reach ever deeper into virtually every organization on the planet. Internal auditors are wrestling with risks that continue to emerge at warp speed and myriad challenges from working remotely, exasperated by a lack of crucial face-to-face communications.

However, by all accounts, the profession is demonstrating agility and proving its resilience.

Much has been said and written about how internal auditors are adapting: how we are using technology, how we are auditing remotely, and even how we are providing assurance and advice related to health and safety risks. But one topic has been conspicuously absent in conversations about how internal auditors are innovating: how we are reporting our audit results. 

COVID-19 has taught us a lot about the impact on modern organizations when disruption is so swift and complete. The shelf life of critical information for timely decision-making has been reduced dramatically. Even in the best of times, our audit reports often take too long, diminishing their value. The average turnaround time for internal audits in many organizations is six weeks or longer. Just finalizing and publishing a report can consume as much as a third of an internal audit’s cycle time. Imagine how out-of-date an internal audit started six weeks ago would be today. There is likely no excuse, especially if supporting data was collected and analyzed more than two weeks ago!

I have been advocating for swifter audit reporting for more than 20 years. I even dedicated three chapters in my book, The Speed of Risk, to timelier auditing. But there has never been a time other than now when reporting audit results swiftly has been more critical. As I noted in my book:

Given the speed at which risks emerge and can wreak havoc, internal audit departments should have zero tolerance for slow reporting processes. Failure to deliver a final report after it’s too late for the results to avoid further impact is not an option. That’s not even protecting organizational value, much less enhancing it.

So, what advice would I offer for more timely report results? I offer four strategies.

1. Share the results as the audit unfolds.One of the most frustrating delays in finalizing an audit report is negotiating with the client on the wording and tone of our observations and conclusions. Clients often push back intensely against an audit report when they are seeing all of the results at once. Providing results incrementally can help mitigate the shock. Once the internal audit team gets to a point in the engagement when it is satisfied there is a reportable condition or something management needs to address, share the information right then with the client — either informally or through a written, interim update. Regular communication during the audit not only reduces the potential for friction at the end, but more importantly it enables timelier corrective measures.
2. Reduce or even eliminate levels of review for draft results.The larger an internal audit department, the more levels of review reports often must undergo. Multiple levels of review within the internal audit department are often a major source of delays in audit reporting. Streamlining the review process and reducing the number of reviewers inevitably accelerates the reporting process.
3. Collaborate to expedite. Bringing the audit team together with all of those who will edit or review the draft report for a single editing session also can reduce a report’s cycle time dramatically. This allows the internal audit team and the department’s upper-level supervisors to discuss the draft and propose changes without the endless back and forth of the usual editing process. I used this “team editing” approach with great success in internal audit departments I led in the past.
4. Reimagine reporting.This is the 21^st century, yet our reports can look and feel as if we banged them out on a Selectric typewriter. We live in the era of tweets and text messages, yet we still write reports that look and feel like college term papers. Get creative with the objective of conveying the information as swiftly and concisely as possible. Yes, we must document the results of our audits, but a typical internal audit report goes far beyond conveying results. Streamline the report down to bare essentials, and measure performance on the timely impact the report has — not the number of words or findings contained within.

I could write on about the timeliness of internal audits, but that wouldn’t be a good use of our time. I hope some of my ideas are helpful as you ponder the future of your audit processes.

As always, I look forward to your thoughts.