“Says who?” and “So what?”

Most audit reports are too long

Most of the internal audit reports I have read in my life have one thing in common. They are just too long. Sometimes I get the feeling that internal auditors need to motivate their existence by the sheer amount of paper we produce. Because I am guilty of this as well. I sometimes still slip up when it comes to writing concise audit reports.

Now, in our defense, we tend to get the executive summary right, but when it comes to the detailed report, we still over-motivate our work or provide too much context. And with board members having other things to do than just reading our audit reports, we need to be as concrete as possible but without oversimplifying.

A lesson from an old manager and mentor

Whenever I read one of our own draft reports that is just too long and I want to improve it, I use a technique I have been taught a long time ago by one of my former managers and mentors. It goes something like this:

Of every section, paragraph and even sentence in your report, you need to ask yourself the following two basic yet essential questions:

• “Says who?”
• “So what?”

Says who?

This may appear weird, but let’s look at this in a bit more detail. When asking yourself that first question: “So what?” you are actually testing two of four traditional quality criteria on audit evidence underlying the position you are taking or the argument you are making in the audit report.

First, “Says who?” asks whether the evidence can be considered to be sufficient. Sawyer’s Guide to Internal Auditing, 6the edition defines sufficient as “factual, adequate and convincing so that a prudent, informed person would reach the same conclusions as the auditor.”

In addition, this apparently simple question also queries whether the evidence is reliable. The same source argues that in order to be reliable, the evidence needs to be the best attainable information through the use of appropriate engagement techniques.

So, by asking a very simple question, you do some quality testing on the information in your report. But what if the answers indicate that the evidence is not sufficient nor reliable? Well, then that position should not be in your audit report, because it is not adequately supported by the evidence. Ideally, you need to go back and get more sufficient, more reliable evidence. If that is not an option, the point needs to be removed from the audit report. Your working papers need to show why it has been removed.

So what?

When asking yourself that second question: “So what?” you are testing the other two of four evidence quality criteria.

First, by asking “So what?” you assess the relevance of your position and thus of the underlying audit evidence in the overall context of the report. Fundamentally, you want to know whether that point really matters. Is it material, will it contribute to the overall quality of the report, its findings and its recommendations or is it just page filler that may well be removed without impacting the cohesion of the report? Sawyer defines relevant evidence as evidence that supports the engagement objectives and recommendations and is consistent with the audit’s objectives.

Additionally, “so what?” also questions the usefulness of the statements and the related audit evidence in the report. Does the finding, the position, the recommendation contribute, as Sawyer states, to the goal of the organization? Will working on this make a difference?

Tthe moment there is any doubt about the answer to these questions, the evidence is not relevant or not useful. That means we need to either revisit the audit subject matter or we need to abandon the point.

In conclusion

Asking these two simple but powerful questions of the content of our audit reports will have two effects: first, they are likely to get significantly shorter, because information in audit reports can sometimes be pure inference by the auditor or based on evidence that is just not adequate. And even if it is, using a lot of words does not mean you have something to say. They should also turn out to be a bit more relevant.

And which director or board member can say no to shorter, more relevant reports?