Is most internal audit report the right length? For many consumers of audit reports in the executive suite and boardroom, the answer is probably that they’re “too long!”

Audit reports may run to extraordinary lengths these days. For example, I recently talked to one organization where they could easily extend over a hundred pages. One hundred pages are clearly too long for anybody to rationally expect our stakeholders in top management and on the board to want to read them. When are there 100 pages of value, actionable information, in an audit report?

So, is the answer ten or twenty pages? Is it two or three? Let’s tackle the question in a different way.

Audit reports are a communication vehicle. The IIA Standards do not require that we write an audit report. Instead, they require that we communicate the results of our work to our stakeholders. So, a better question is: What should we communicate?

When is Will It Stop Hurting?
When you visit the dentist because you have a toothache, do you want even a three-page report? Probably not. You want to know: (a) Can he or she stop the pain? (b) When will that be done? (c) Is there a serious problem? And (d) What is this going to cost me? You don’t want to be asked to read a recap of your dental history, the status of recommendations from your last visit, or a report on the depth of your gums. You want to receive the information you need, concisely and clearly written, without wasting a minute of your time.

What about your executives and board members? What information do they want to get from you? They want to know:

• Is there a problem that is serious enough to potentially affect the organization and the achievement of its objectives in a material way? Is there a problem I need to worry about at my level?
• Are the right actions being taken?
• Is there anything I need to do personally?
• Is there anything I need to make sure others are doing?

So why do we include more? Is it because we feel a need to justify our existence? I know of chief audit executives who insist that every audit report has at least one finding and recommendation. Why? If you have this need, this irrational compulsion, stop!

Is it because the report is a form of documentation, or because it is really being written for a regulator rather than the executive readers? Both are equally wrong.

The Elevator Version
Imagine this. You enter the elevator at your company’s head office and are greeted by your CEO. She asks you about the audit your team recently performed of the Treasury function, saying that she is interested in the results. Do you tell her about the background of the audit? How about your scope and objectives? Do you list all the medium and low issues? Or do you just tell her whether there were major issues that merit her attention, whether management is taking the right corrective actions and any other insights that would be of value to her?

So why do we put more than these essentials in a written audit report? Why hide valuable, actionable information in a haystack of unnecessary detail? The length of the audit report, if one is even needed, should be just enough to tell the consumers of the report what they need to know—and no more.

Ah, I can hear you saying that the report has to include all the findings so you can make sure management owns the issues and will take necessary corrective actions. But do the executives and board members need to see that level of detail in the report? Weren’t these all discussed and agreed upon at your closing meeting (and if not, why not)?

Send a note to those present at the meeting, confirming the discussion and the corrective action details (who will do what by when, and other details). And then keep what you send to the executives and the board limited to what they need to read and no more.

Make it easy for them to pick up your reports promptly, digest the actionable information, and take whatever actions are needed—now when they are needed. Make it easy and not hard for them to read, understand, and take any necessary actions.

If you don’t waste their time with trivia when you have something to say they are far more likely to listen.

What say you? Can we cut most audit reports back to half a page? Let’s hear your thoughts in the comment section below.