I have seen several recent posts with guidance on writing effective audit reports, so I thought I would add my two cents.
It starts with understanding that we need to tell our customers, both in management and on the board, only and all that they need to know, when they need to know it, in a way that is easily consumed and actionable.
Telling them less than what they need to know is obviously unacceptable.
But so is telling them more than they need to know! It makes our communications harder (and longer) to read (if they are willing to take the time out of their busy day), and makes our customers work: they have to sift through the morass of information in hope of finding something of value to them. For example, why do we need to write about our scope and objectives when the focus of the audit is captured by the report title? We don’t. Why do we need to inform the board or its audit committee that we “found” low or even medium risk deficiencies? We don’t. They can leave that to middle management.
It starts by understanding that we may not even need to write audit reports! We don’t need to tell them what we have done just so we can justify our existence. (I saw some are starting to send video reports, which I suspect will take more of management and board time than written ones.)
We only need to…
