I have known my friend Hal Garyn for a long time. He is a gentleman for whom I have great respect and we usually are in full agreement on topics of mutual interest.
But I am only in partial agreement with his recent article, Death of the Audit Report: It’s Time to Reconsider How to Convey Internal Audit Findings.
As usual, I will point to some of his excellent comments:
- …why do we issue audit reports? Are we required to do so? And are there other options? Does the return on investment outweigh the time spent drafting, editing, reviewing, and issuing traditional internal audit reports? We’ll explore these questions in depth, but the short answer is a resounding “no!”
- When most internal auditors consider why they issue audit reports, far too many say it is because “the Standards require us to.” Well, that is not true at all. The Institute of Internal Auditors’ Standards for the Professional Practice of Internal Auditing states the following regarding reporting the results of internal audit work:
“Internal auditors must communicate the results of engagements.” – IIA Performance Standard 2400.
- So, if the Standards do not say, “you must issue an audit report,” why do we do it? Another common response to the “why” question, beyond erroneously thinking that we need to, is: “Because…
