Internal Audit Reports Post Sarbanes-Oxley: A Guide to Process-Driven Reporting

SECTION TWO

GOING WITH THE FLOW

The only important distinction is between good writing and bad writing. Good writing is good writing, whatever form it takes and whatever we call it.

William Zinsser, On Writing Well

The form audit reports take is changing. Long narratives are out, tables and dashboards that condense complex data are in, and fully automated reports are coming on strong. The act of writing—by which we mean ordering words and symbols and inscribing them somewhere in such a way that a message is conveyed—is still required. But written reports look dramatically different than they did in the old days—a year ago!

Chapter 4 offers examples of templates and a hot-off-the-computer format for producing internal audit reports. But many formats are possible and, as the demand for compact, easily accessible, and attestable reports increases, internal auditors, managers, CAEs, and audit committees need to pool their collective wisdom and agree on the most practical technological tools to use. Formatting is not necessarily a one-size-fits-all operation, and any template should be tailored to specific needs. “Process-driven” means open to circumstances as they occur.

As the physical appearance of reports is altered, effective spoken communication throughout the audit process takes on greater importance. Assuming that everyone will notice what is significant in a new format and respond accordingly is not a good idea; discussing what works, what doesn't, and what's different is ...