How To Write Effective

Internal Audit Reports

Presented by
Lal Balkaran
Toronto
February 2020
 Presenter’s Profile

Lal Balkaran, MBA, FCPA, FCGA, FCMA, CGMA, CIA is an audit consultant with
over 30 years of experience obtained in a range of industries including the Big Four. Lal
is a prolific writer, having authored and co-authored several reference books on business
and on his native Guyana in addition to well over fifty articles published widely across
the globe including a dozen times in the prestigious Internal Auditor magazine. He has
also done several presentations, seminars, and workshops at regional, national, and
international conferences. Mr. Balkaran has been a long-time member of the Institute of
Internal Auditors (IIA) and was twice elected President of the IIA-Toronto where he is
now an honourary member. He currently sits on the Internal Auditor magazine and
EDPACS Editorial Advisory Boards as well as on the IIA-Canada’s Thought Leadership
Committee. He was a member of the Internal Audit Advisory Board set up by the
Treasury Board Secretariat in Ottawa in 2005 to establish internal audit functions in
federal agencies of the Government of Canada. Lal also established the IIA-Guyana in
January 2000 and introduced the IIA certification programs in that country.

He is the only recipient of all three of IIA Canada’s Awards – the 2010 Arthur J.
Child’s Distinguished Service in Canada Award; the 2012 Contribution to the
Profession Award; and the 2018 Lifetime Achievement Award.
2
 Contents
❖ Importance of the Audit Report
❖ The IIA Standards on communicating results
❖ Typical structure of an effective internal audit report
❖ 10 steps to successful audit report writing
❖ Writing starts with the audit findings
❖ Use of Jargons
❖ Long-winded Writing
❖ Clichés to avoid
❖ How to cultivate and maintain good writing skills
❖ That First Sentence
❖ Words to look out for – Positive Words and Negative Words
❖ Writing informatively and persuasively
❖ Characteristics of a quality internal audit report
❖ Guidelines for editing
❖ English as a funny language
❖ Foreign words and phrases
❖ References

Lal Balkaran – February 2020 3

 Goals of This Session
❖ Be aware of the IIA Standards on communicating results.
❖ Understand the importance of internal audit reports.
❖ Improve your writing style.
❖ Broaden your writing horizons.
❖ Understand documentation standards.
❖ Enable you to write an internal audit report that sells.
❖ Instill in you that writing is a learned skill.
❖ Be aware of reference resources on writing.

Lal Balkaran – February 2020 4

 Importance of the Internal Audit Report
An internal audit report:
➢ Is the most important visible product after days of interviews, reviews,
analyses, and discussions.
➢ Enhances the image of internal audit if properly written.
➢ Diminishes the value of the internal audit effort and damages audit’s
reputation if poorly written.
➢ Is the primary means of communicating audit results.
➢ Acts as a catalyst for positive change in an organization.
➢ Provides critical information to clients about the area audited.
➢ Provides details about significant issues to be addressed.
➢ Aids clients in making informed decisions.
➢ Helps an organization improve its performance when corrective action
is taken on recommendations made.

Lal Balkaran – February 2020 5

 IIA Standards
2400 – Communicating Results
Internal auditors must communicate the results of engagements.
2410 – Criteria for Communicating
Communications must include the engagement’s objectives, scope, and results.
2410.A1 – Final communication of engagement results must include applicable conclusions, as well as applicable
recommendations and/or action plans. Where appropriate, the internal auditors’ opinion should be provided.
An opinion must take into account the expectations of senior management, the board, and other
stakeholders and must be supported by sufficient, reliable, relevant, and useful information.
2410.A2 – Internal auditors are encouraged to acknowledge satisfactory performance in engagement
communications.
2410.A3 – When releasing engagement results to parties outside the organization, the communication must
include limitations on distribution and use of the results.
2410.C1 – Communication of the progress and results of consulting engagements will vary in form and content
depending upon the nature of the engagement and the needs of the client.
2420 – Quality of Communications
Communications must be accurate, objective, clear, concise, constructive, complete, and timely.
2421 – Errors and Omissions
If a final communication contains a significant error or omission, the chief audit executive
must communicate corrected information to all parties who received the original communication.

(Source: Institute of Internal Auditors. 2017. International Professional Practices Framework. Lake Mary: IIA Inc.)

Lal Balkaran – February 2020 6

 Suggested Report Structure
There is no standardized format for an internal audit report. Each is different in structure and
content depending on the nature of the audit engagement. However, a typical structure should
comprise the following:

✓ Title Page – Audit Project; Distribution; Auditors involved; Report Date.

✓ Table of Contents – Report contents; Appendices.
✓ Background Information – Brief background on subject or department; when last
audited; reasons for the audit.
✓ Objectives and Scope – what does the audit hope to achieve or prove; boundaries;
period covered; nature and extent of auditing procedures; related activities not covered.
✓ Statistics – when last audited; departmental budget; employees; turnover; revenues
generated; other relevant metrics to put items in context.
✓ Audit Opinion – Overall written conclusion after consideration of all audit evidence.
Should be balanced and should reflect those positive aspects of the audited unit.
✓ Executive Summary –A one-page summary of all the audit findings in the report.
✓ Detailed Audit Findings – The condition, standard, effect, cause, recommendation and
management response for each audit finding. Not all findings make it to the audit report.
Judgement is required.
✓ Risk Control Matrix – For each activity, the risks, existence of controls to mitigate these
risks, and the impact of the audit findings on these risks.

Lal Balkaran – February 2020 7

 10 Steps to Successful Report Writing
➢ Prepare audit findings using the standard format.
➢ Do not state audit procedures.
➢ Write constructively and not critically.
➢ Be accurate, objective, concise, clear and logical.
➢ Link your audit planning memo to your audit findings.
➢ Organize the issues in order of importance.
➢ Write the first draft of the report.
➢ Circulate among your peers for their review and comment.
➢ Edit and send for management response.
➢ Finalize, distribute and follow-up.

Lal Balkaran – February 2020 8

 Writing Starts with the Findings
➢ Condition –
➢ A statement of fact. What is the problem? What evidence is there to
support this?
➢ Criteria –
➢ What standard, policy, or procedure should be applied against which the
condition is measured?
➢ Cause –
➢ Why does the condition exist? What weaknesses triggered it?
➢ Effect or Impact –
➢ Actual or potential consequences of the variance between the standard and
the condition. Consider cost, quality, timeliness, exposure, compliance, etc.
What is the benefit of making a change?
➢ Recommendation –
➢ What should be done to improve the situation?
Lal Balkaran – February 2020 9
 Use of Jargons
➢ A jargon is a highly technical slang unique to an occupational
group. E.g., in a capital markets audit, phrases like bull market,
in-the-money, out-of-the-money, wallflower, and wallpaper are
common jargons used.
➢ If the readership of the audit report is entirely members of the
capital markets group, then the jargons mentioned above will
make the audience comfortable.
➢ Avoid jargons where the entire audience of audit reports ranges
from the audit committee to senior management and line
managers.
➢ Instead, replace jargons with nontechnical terms.

Lal Balkaran – February 2020 10

 Long-winded writing

Avoid extraneous verbiage and long-winded prose. For example,

Overstated Replace with

Due to the fact… Because…
In order to… To…
During the course of the audit… During the audit…
The reason why the payment The delayed payment was due
was delayed was because of a to a computer problem.
computer problem.

Lal Balkaran – February 2020 11

 Clichés to avoid
A cliché is an expression that has been used for so long that it is
no longer fresh. It is stale and boring. For example:
➢ The following exceptions were noted.

➢ Some weaknesses exist in loan documentation.

➢ We identified the following deficiencies.

➢ Vendor documentation needs improvement.

➢ Accounting records are not properly controlled.

➢ Controls are not adequate over processing.

➢ The process is not functioning effectively.

➢ During our review, it was noted that.

➢ Several deficiencies were noted in the operation.

➢ Assets should be adequately safeguarded.

Lal Balkaran – February 2020 12

 Clichés to avoid (contd.)
Underlined words are clichés that add no value to the paragraph. E.g:

Our new computer system will have a positive impact on the company as a
whole. It will keep us abreast of the times and make our competition
green with envy. The committee deserves a pat on the back for its
herculean efforts in convincing management that it was the thing to do.
I’m sure that their untiring efforts will not go unrewarded.

Change to:
Our new computer system will have a positive impact throughout the
company. It will keep operations current and make our competition
envious. The committee deserves credit for their efforts in convincing
management of the need for the computer. I’m sure that the value of their
efforts will be recognized.
Lal Balkaran – February 2020 13
 Cultivating Good Writing Skills
➢ Writing is a learned skill that takes practice and feedback to become better.
➢ Read widely – journals, books, newspapers, white papers, encyclopedia, etc.
➢ Try make it a habit of improving your word power on a daily basis.
➢ Practise writing by asking someone to review what you have written.
➢ Use the active voice as it is far stronger and conveys information more directly.
E.g.,
Passive sentences Active sentences
The invoices were approved. The manager approved the invoices.
The accounts were not reconciled. The department did not reconcile the accounts.

➢ Replace negative with positive writing.

➢ Eliminate clichés and trite language.
➢ Use informative and persuasive writing in their proper context.
➢ Organize your thought coherently and chronologically.
➢ Write clearly and logically using simple words.

Lal Balkaran – February 2020 14

 The first sentence is critical
The first sentence in an audit finding should state the problem and grab the interest
of the reader to whet his/her appetite to read on for more. This critical sentence
states the central idea of a paragraph. When properly worded, it serves as the glue
that binds the sentences that follow.
➢ Security Policy
XYZ currently does not have a written security policy in place. A written security
policy is the basis for developing standards to safeguard computer equipment and
data assets. It promotes uniformity and conformity across an organization. Without
such a policy, the responsibility to control or to mitigate the risk of unauthorized
access and misuse may be neglected.
➢ Price Quotes
Optimal prices are not always obtained resulting in almost $11 million in lost
savings. A sample of 100 purchases made amounting to $30 million for the 2016-
2017 fiscal year indicated that savings of $2.5 million could have been secured had
three or more suppliers been sourced and the best price selected. When extended
over the total purchases made, the company suffered almost $11 million in lost
savings.
Lal Balkaran – February 2020 15
 Words To Look Out For
Positive Words
Most people like these words:

Accurate; appreciate; care; controlled; cooperation; correct;

effective; efficient; enthusiasm; fine; good; important;
independent; innovative; joint; leadership; managed; model;
motivate; objective; partner; persuade; positive; proactive;
professional; progress; proper; protected; quality; reliable; right;
saved; secure; solid; strong; support; timely; useful; valuable; well
informed.

Lal Balkaran – February 2020 16

 Words to Look Out For (contd.)
Do not write to impress. Use simple and politically correct words and avoid difficult
and technical terms that are likely to confuse readers.

Negative Words
Most people dislike these words:
Abandoned; abuse; affected; alibi; allege; apology; bankrupt; beware; biased;
blame; calamity; cheap; collapse; collusion; commonplace; complaint; crisis;
crooked; deadlock; decline; desert; disaster; discredit; disgusting; dispute; evict;
exaggerate; extravagant; failure; fault; fear; flagrant; flimsy; fraud; gloss over;
hardship; harp upon; hazy; ignorant; illiterate; imitation; immature; implicate;
impossible; improvident; insolvent; in vain; liable; long-winded; meager; misfortune;
muddle; negligence; obstinate; opinionated; oversight; plausible; precipitate;
prejudiced; premature; pretentious; retrench; rude; ruin; shirk; shrink; sketchy;
slack; smattering; split hairs; squander; stagnant; standstill; straggling; stunted;
superficial; tamper; tardy; timid; tolerable; unfair; unfortunate; unsuccessful;
untimely; waste; weak; worry; wrong

Lal Balkaran – February 2020 17

 Writing Informatively
➢ The focus is to give information and explanation and not opinion.
➢ Watch your first sentence which should capture the reader’s attention. See slide 15.
➢ Write concretely and descriptively.
➢ Use simple words and information of the greatest impact to your reader.

Example:
Here’s an ambiguous and wordy piece of writing:
Regulation 23 requires that proper documentation be accumulated in employee loan files.
During the course of our audit exercise, we decided to sample 100 out of 15,000 such
files. For 25 of them, there were no insurance documents e.g., life insurance. For assets
to be sold in case of loan default, 18 did not contain these. More alarming, loan
applications were not signed by the persons receiving the loans and the persons
approving the loans.
Now look at its improvement using informative writing technique:
Employee loan documentation is incomplete. Twenty-five percent of the 100 files
reviewed were missing insurance documents, 18% were lacking collateral information,
and 12% did not have all required signatures.

Lal Balkaran – February 2020 18

 Writing Persuasively
Convince the reader to accept your audit recommendation and take corrective action by:
➢ Describing audit conclusion directly and concretely.
➢ Offering factual evidence.
➢ Stating the facts as they appear in audit findings.
➢ Describing causes and quantify the problem.
Examples:
Weak Persuasive
Of the 20 largest overdrafts open on the Overdrafts totalling $320,000 and
audit date, eight had been opened an unusually representing 60% of all overdrafts
overlong period of time. $5000 had been opened for more
than 15 days as of March 1.

None of the items failed to pass the audit test. All items were in compliance.

Documentation exceptions existed in purchasing. Fifty-five purchase orders,

representing a half-million dollars in
merchandise bought, did not list the
price.

Lal Balkaran – February 2020 19

 Characteristics of a Quality Audit Report
➢ Aligns issues and recommendations with the IIA’s International Standards
for the Professional Practice of Internal Auditing (IIA Standards).
➢ Effective – Addresses the audit scope and objectives.
➢ Direct – Straightforward and factual presentation of issues.
➢ Succinct – Brief statements capturing key ideas.
➢ Appropriate – Tone and strategy appropriate to the significance of
information presented.
➢ Persuasive – Convincing support for audit findings.
➢ Constructive – Addresses causes of problems; balance; and credit for
management actions.
➢ Results-Oriented – Emphasize results and recommend solutions.
➢ Inviting – Must be inviting to read.
➢ Timely – Must be issued in good time after the audit.

Lal Balkaran – February 2020 20

 Guidelines for Editing
➢ Look for proper language and style.
➢ Ensure reports can be easily understood.
➢ Make sure the audit report reflects the audit scope and objectives and
is in conformity with corporate culture and strategic thinking.
➢ Review for grammatical accuracy.
➢ Review for proper punctuation, spelling, abbreviation, capital letters
and acronyms.
➢ Look for proper documentation style.
➢ Review for substance, content and tone.
➢ Organize and arrange items in a report in order of importance.
➢ Ensure report sells and motivates management to act.
➢ Finally, ensure there are proper deadlines for management responses
and follow up.

Lal Balkaran – February 2020 21

 English as a funny language
Take a look at the underlined words below, though spelt the same, have different
meanings and, in some instances, are pronounced quite differently.
➢ The bandage was wound around the wound.
➢ It took him a minute to review the minute details.
➢ We must polish the Polish furniture.
➢ Anna decided to desert her dessert in the desert.
➢ The farm was used to produce produce.
➢ The insurance was invalid for the invalid.
➢ There was a row among the oarsmen about how to row.
➢ They were too close to the door to close it.
➢ Upon seeing the tear in the painting I shed a tear.
➢ How can I intimate this to my most intimate friend?
➢ My number was called and after the injection my jaw got number.
➢ I had to subject the subject to a number of tests.
➢ The wind was too strong to wind the sail.
➢ The dump was so full that it had to refuse more refuse.
Lal Balkaran – February 2020 22
 Foreign Words and Phrases
English, the language of business and commerce, grows by adopting foreign
words and phrases that give support for colourful and precise expressions.
E.g., Arabic – falafel, hummus, kebab; French – croissant, bureaucrat;
Italian – pizza, ballerina, soprano; Spanish – adios, siesta, mesa, sierra, café,
savannah; Hindi – mantra, yoga, guru, khaki, jungle, loot; etc.
➢ We still meet in camera, bid one another adieu, adios, arrivederci, ciao,
hasta la vista.
➢ We go to yoga practices, then have a latté or a cappuccino in a café.
➢ People eager to do a task are gung ho about it.
➢ Since the collapse of the USSR, we now talk about corporate glasnost and
corporate perestroika.
➢ Technology has had its impact - we google, email, text. And do not forget
phishing, ransomware, blogging, malware, spam, crowdsourcing, etc.
➢ Even Indian languages throughout the Americas have had their influence –
Caribbean, barbecue, cannibal, cocoa, cocaine, hammock, vanilla, etc.

Lal Balkaran – February 2020 23

 References
Some Helpful Books on Writing Effective Audit Reports

1. Brusaw, Charles T., Alred, G.J., and Oliu, W.E. 2011.The Business
Writer’s Handbook, 10th ed. New York: St. Martin’s Press.
2. Cook, Claire K. 1985. The MLA’s Line by Line: How to Edit Your Own
Writing. Boston: Houghton Mifflin Company.
3. Cutler, Sally F. 2017. Clarity, Impact, Speed: Delivering Audit Reports
That Matter. Lake Mary: IIA Inc.
4. Cutler, Sally F. 2001. Designing and Writing Message-Based Audit
Reports. Lake Mary: IIA Inc.
5. Maniak, Angela J. 1990. Report Writing for Internal Auditors (Bankers
Publishing Company: Chicago, 1990).
6. Switzer, Susan M. 2007. Internal Audit Reports Post Sarbanes-Oxley: A
Guide to Process-Driven Reporting. Lake Mary: IIA Inc.
7. University of Chicago. 2017. The Chicago Manual of Style, 17th ed.
Chicago: University of Chicago.

Lal Balkaran – February 2020 24

 References (contd.)
And Some Helpful Articles

1. Adams, Barbara L. and Winstead, Ann S. “Write Smart: Internal

auditors can use a specific communication technique to create value-
added reports,” Internal Auditor, April 2008.
2. De La Rosa, S. “ERM-based Audit Reports,” Internal Auditor, December
2005.
3. González, F. “Effective Report Writing: With the right approach,
practitioners can make sure their audit reports are informative and
well-received,” Internal Auditor, June 2008.
4. Hubbard. Larry D. “Audit Reporting 101,” Internal Auditor, December
2001.
5. Keitu, Jonnie T. “Producing Quality Audit Reports,” Internal Auditor,
August 2018.
6. Lynch, D.H. and Golen, S. “10 Steps to writing documents,” Internal
Auditor, February 2003
Lal Balkaran – February 2020 25
 Questions, Discussions, and Socializing

Note: Send me an email for a sample internal

audit report that complies with this
presentation.

Lal Balkaran
MBA, FCPA, FCGA, FCMA, CGMA, CIA

416-451-6075
Email: lalbalkaran@rogers.com

Lal Balkaran – February 2020 26