Poorly documented or disconnected observations. Lack of alignment. Version-control issues. Wacky formatting. Endless iterations, with the CAE’s red-pen edits looking like something out of Scarface. Hours spent on reporting that should’ve been spent planning the next audit. 

All that, and your hard-won audit report STILL ends up misunderstood, undervalued, or even unread.

Audit reporting can be a pain, but it’s also an evergreen opportunity to do better. So when I learned that Internal Audit Collective member Charlie Page, Senior Director of Internal Audit for a Fortune 50 company, had led a successful effort to rebuild their audit report from scratch, I asked him to share his story with COMMAND, the Collective’s 16-hour Internal Audit manager program. Charlie’s changes are simple but revolutionary, so I’m thrilled to share some of them in today’s newsletter.

1. Write For Your Audience — Not Yourself 

To have an impact, your audit report needs to get its message across. 

So it’s vital to think about how the message is being delivered — its length, detail level, focus areas, format, context, framing, and language — and consider the needs/preferences of the people reading it. 

Traditional audit reports aren’t great at this.

• Most are long, verbose, highly granular, and overly technical. Very few people are jazzed to read a 20-page audit report packed with auditor-speak.
• Detail-oriented auditors tend to include everything AND the kitchen sink, giving exhaustive background and observations before finally arriving at the “so what” of risks/impacts. Busy execs lack the time/patience to read all of it, so key messages end up muddled or missed. 
• Ratings often lack differentiation and context. They don’t help execs understand how their controls are performing relative to other controls or show clear links to enterprise risks/themes. 
• Action plans also tend to be too granular. Execs really only need a summary view that helps them understand what’s being done, when, and who’s accountable for doing it.

So why not give them a truly digestible report they’re willing to read immediately — one that puts key messages up front, includes only critical context, and makes it easy to understand importance/severity?

Charlie’s remaining tips explain how. 

2. Lead With the Risk/Impact 

Audit reports should immediately answer the question, “So what?” 

Your audience needs to quickly understand what’s at stake, why it matters, and how severe it is. 

Then, they’ll be more likely to read the full report — and respond with prompt action.

In a simple but revolutionary change, Charlie’s reimagined audit reports consistently begin by highlighting the specific business risks and their potential impacts. 

Then, after the impact statement, each observation — starts with two key items:

• A “bold statement” identifying the finding in one simple-to-understand sentence. 
• Three lines or less describing the risk and impact, including data indicating risk magnitude. 

And then, they include only one to two sentences of background detail. Anything more is captured in a separate document (available upon request). 

If you only implement one of Charlie’s ideas, make it this one: Clearly state what the issue is and why it matters BEFORE saying anything else. 

As Charlie said, “It’s not like the risk is the afterthought, right? It prioritizes conversations on the ‘so what’.”

3. Make Ratings Mean Something

If you’re giving ratings, make them meaningful.

Charlie’s team was using “Satisfactory,” “Opportunities for Improvement,” and “Inadequate.” But well over 95% were “opportunities for improvement,” which didn’t provide real perspective or differentiation. 

Also, “Satisfactory” isn’t exactly an accolade, and “Inadequate” has such negative connotations they rarely used it. 

So they changed their rating system.

• “Effective” replaced “Satisfactory,” providing an actual badge of honor: an “Effective” process.
• They retained “Inadequate” and “Opportunities for Improvement,” but added a new category: “Needs Significant Improvement.” 

Now, they’re achieving meaningful bifurcation within that 95% bucket, driving new conversations with the business and providing better visibility on issues needing significant attention.

4. Use a Limited Set of Themes to Add Context

Audit observations are more valuable when they help the business connect the dots across audits. 

Assigning observations to standard themes can help surface insights around any enterprise-wide patterns, trends, and changes over time. 

• Review past observations and identify common themes (e.g., system gaps, insufficient training/awareness, inadequate governance/oversight). Which themes matter most?
• Boil them down to a manageable number (Charlie’s team identified nine), agreeing on clear definitions.
• Link each observation to no more than three themes. 

The themes also help Charlie’s team sharpen their messaging. He explained, “When you read through the themes, it allows you a moment to challenge: Is that theme coming across in my observation?”

5. Lock Down Consistency to Drive Discipline

Agree upon a format and lock it down in a template. 

Explained Charlie, “We wanted to streamline our readers’ ability to know exactly where to look for what’s important to them.” Accordingly, all of their audit reports now use the same format.

While their previous Google Docs format made collaboration easy, no two reports looked alike. Their new Google Slides format enables them to:

• Lock in a consistent look, feel, flow, and user experience.
• Dedicate — and limit — spaces highlighting the most important details.
• Instill greater discipline in ensuring concise, clear messaging.

Said Charlie, “It all comes back to your audience. Why do you think your audience needs two pages for you to explain this? Try harder to simplify your message.”

6. Use AI 

Lastly, take advantage of Gen AI to improve your content and process. 

Want to make your sentence crisper, clearer, or more hard-hitting? Ensure alignment with framework X or Y? Articulate a risk using terms/context they’ll understand? Write a first draft? Review for bias?

Try asking AI. And download these 20 ready-to-deploy use cases, authored and quality-checked by the Internal Audit Collective.  

THE LAST WORD: Small Changes Can Deliver Big Results

Auditors often talk about the importance of “no surprises.” 

Charlie’s revamped reports make the platitude real, ensuring that key messages make it across and all parties are aligned on what’s at stake, why, and what happens next.

The new reports are also accelerating conversations with the business — and not just around reporting. 

In other words: Audit reporting doesn’t have to be painful. As Charlie’s success story proves, small changes in your process can make a massive difference in the value your reporting provides. 

Want more ideas for improving audit reporting? Learn how Jan Murry and Matt Kohls’ team used the Kaizen process to reduce their reporting lag from 99 to 40 days, explore these strategies for handling last-minute changes to the audit plan, and see how teams avoid common challenges in planning audits from scratch. 

‍