This is a topic I have covered a few times, not least to express my view that internal audit is value adding in its own right, without any consultancy or other value added activities on top of audit. I was reminded of what is of value by an experience I had this weekend.
I was at a coffee shop for lunch and the whole experience was poor. Poor welcome, long wait, dirty table, weak menu, and finally a very poor lunch. The bill did not relate to the value of the offering. What I could not explain or understand, even more than the general systematic faults in the coffee shop’s systems, was how a substandard, thrown together plate of food, could be despatched.
As a CAE the equivalent is the sending out of a substandard audit report. When am I under the most pressure to do this? Well, if an auditor has not given me enough time to review a report, or in a period before an audit committee when reports need to be delivered, or if the fieldwork was done badly and it is embarrassing or expensive to supplement or repeat it.
Now my view is that a CAE should never send out a substandard ‘dish of food’. For just as in the case of a restaurant the bad food will be remembered longer than the slight wait or even bad service. I would never go back to a restaurant with bad food even if the place, service, timing, cleanliness etc was excellent. I think this is the same with audit and audit reports. So in my view the audit report is all important.
But what adds value in an audit report? I have been on a lean auditing course and this seemed to suggest that the smallest, fewest, simplest, report should be issued. Focus only on what the customer wants. I think this is flawed, as internal audit is a professional service and the customer views are important, but there are cases when the message needed, not wanted, needs to be given. For me the key point of value in an internal audit report is the veracity of the opinion. Being ‘right’ (or as right as one can in a social science setting – see the previous posts on research assumptions) is important. No one will remember the slight delay in issuing the opinion if the resulting report is well-written with the right opinion.
Conversely, I suspect all CAEs are risk averse. A CAE incurs greater risk from issuing a wrong opinion than issuing the correct one; no matter how difficult the opinion is for the client organisation to deal with. You can be sure that if something goes wrong and it has been audited previously, the first call is ‘where was internal audit?’.
What other items are of value in internal audit reports? Clarity, a good executive summary (by that I mean something that summarises complex messages, required actions, without over simplifying or making them two dimensional), a clear risk based opinion and a sense of proportion.
Report writing is the biggest challenge I have faced as a CAE. It is an art, not a science. It is one I wrestle with constantly and one I always learn new things about. Writing a good report takes time, effort and practice, but in my view it is well worth the effort.