, , ,


So when I moved my internal audit thinking into a risk based mode, I imagined the difficulties would be around how to do enough high quality work to see and understand the world in the complexity of its reality. I also thought it would be difficult to train compliance-educated internal auditors to think laterally, to act more like consultants, to consider the wider, deeper and more complex picture. Yet none of these have, surprisingly been that difficult (though not without challenge).

The real challenge has been creating reporting narratives. That is, moving audit reports from a colour block or standard wording grade, to something more meaningful. In other words, creating the narrative of the report. I call these bridging because they bridge between the findings and data in a report and formal opinion.

Consultants, professional services firms and others struggle with this too, they struggle because their narrative is external to the organisation, so lacks the anthropological totems that the organisation holds dear. These can be language, jargon, narrative styles, accepted descriptors or an accepted way of understanding the world. External professional services reports are, therefore, always open to the criticism of ‘you don’t understand us’, even if the points are intellectually and technically sound. Actually one of the reasons for the commission of consultants and professional services firms is exactly because of this external ‘cold’ and objective view. It can be extremely powerful and shake organisations away from their own myopia.

Yet I always considered internal audit to be in the best place to resolve these issues. To provide both. Both the independence and objectivity, but also the dependence and contextual understanding of the organisation to provide a challenging but also recognisable narrative to the points being made. This has not proved simple in practice. This has been the hardest element to train auditors to write. Telling a story is challenging and difficult. Considering the diverse audiences for most audit reports it is difficult to play to all of the audiences’ requirements. It has provided challenging to summarise complex risk items into a short enough narrative to have enough brevity for an executive and yet enough detail to make those close to the area to be audited to feel fairly, and objectively, evaluated.

Yet the real challenge is that actually providing a storyline, a control and risk narrative, puts the auditor’s view into a published and public domain in a way that is really difficult for both the auditor and auditee to evade. It seems to be this, the few short paragraphs of the executive summary that has proven most challenging to craft and get right.

So what have I learned about doing these? First that uncomfortable news will remain uncomfortable and that no paragraph, no matter how carefully crafted, is likely to satisfy. In this case the best thing to do is to sit with the auditee and co-craft something and at some point, agree to narrow down the disagreement to the genuinely disagreed elements. In reality these tend to be quite small in my experience, but the overall feeling and impression left with the auditee is often much larger.

Second that there are genuine choices when you pull these narrative summaries together. Choices between whether to provide little detail and summarise headline themes only, or whether to summarise the more detailed content of the report more fully. I would say, as a general lesson, the more you summarise the more carefully you need to craft the narrative.

Third, a good summary narrative should be more than just a list of points, it should say something, make an argument, state something about the work done. Otherwise the risk based opinion is not really being supported.

Fourth, I would say that whatever you do will be deemed ‘wrong’, ‘uncontextual’  and ‘internal audit don’t understand’ on occasions. Sometimes this will be by design – in the manner of consultants who purposefully are there to challenge the status quo (as internal audit is on occasion). Sometimes this will be because a narrative is uncomfortable and this will take open, joint and reflexive audit closeout procedures to ensure that these are fully explored. Sometimes the narrative will simply be difficult to get right because of the complexity or nature of the audit material or scope of work that has been audited.

My overall view is that narratives in audit reports are hard to sustain because organisations are not used to them. They are used to boxes, colours and statements of fact, rather than risk-based opinions. This goes back to internal audit’s origins in financial statements audits, where a body of rules provided the ‘right’ and the ‘wrong’ and thus opinions were, simply, more factual.

Yet do I think internal audit should make an effort to sustain and persevere with risk based opinions? Yes. I believe in the transformative power of internal audit’s unique position of objective independence and yet contextual understanding of its clients (if it is an in-house service). I think this makes internal audit a very different proposition and its work potentially powerful. So if you can stay the course with your clients, and work through the issues of how to deliver audit reports with a risk based opinion, I think it is worth the effort. How should one do this? With an open mind; a real commitment to support and work with clients; an openness to sustaining a no win, no loss, approach to the narrative; a genuine no fear or favour approach to audit; the complete removal of any agenda by internal audit (I personally believe this is the key to winning trust); and finally a strong sense of working across management layers (understanding all elements of the management team’s views – these vary markedly within organisations and ‘management’ should not be taken as homogenous).

So the final point I wanted to make is, the task of writing a bridging narrative between the audit findings and a report opinion is tough enough in an assignment level report. It is much more so in the annual report. For there, as CAE, I need to take a step back, to oversee the whole picture and to counter balance positive and negative data to aggregate this into an opinion.

This is an area I am still working on, so if you have any good thoughts and ideas, please feel free to share in the comments below.