a) The vocabulary is too technical, not clear or the abbreviations used are excessive. Example: “The observation is from a small scope of the NDA’s taken for the due diligence carried out by Compliance for ML” What? No wonder why people can’t understand what you are doing… and the worst: by writing like this you are limiting the value the Internal Audit area has.

The language used must be bulletproof: anyone in the company should understand you. It is of no use that you have detected important risks if no one understands how this could affect them and the company.

b) The report does not give value. Example:

OBSERVATION: The legal area is not complying with the data protection law.

RECOMMENDATION: That the legal area complies with the data protection law.

Really? I mean what kind of recommendation is that? It would be better to know why they have not complied with it. Do they know the reason? Do you as an auditor know the reason? By asking why, you can get to know the real cause, give value, and not give an obvious recommendation.

c) The report is too long…when you hear that “the report should speak by itself”, it means that every observation must have support documentation, not that it has so much detail that the reader is lost. The better it is concise and clear, the more the reader is going to understand it.

The importance of an audit report is… that it’s the only thing others will see about your work. So, put it right in writing!

Do you want to seize more about Auditing? Join us at the Auditing Major Project Online Masterclass on 11th & 12th May, 2022.

Also check our Agile Audit & Assurance In-house Training for train your employees to gain more knowledge about auditing.