Internal Audit Tales - Communicating Audit Findings That Gets Results Part 2

By Ralph Villanueva CISA CISM CIA CFE

Introduction

Last week, we discussed the three step method for effectively communicating internal audit findings – an executive summary, a bulleted set of important audit findings and the body of the report with exhibits and analyses. In this article, I will point out four additional tips for effectively communicating audit findings that will get you the results you want, and a very important takeaway. I learned this from a decade of doing internal audit work – and would like to share that decade long investment with you for free.

Communicating Audit Findings That Gets Results

Show and Tell with Graphs and Charts

Most audit reports present findings in cold hard text. While I have nothing against a solid block of words that highlight a trending internal control weaknesses, a supporting graph or chart can more readily communicate the trend and is the powerful equivalent of a thousand words.

For instance, you are an internal auditor for a grocery chain. You want to highlight the consequence of not having enough warehouse staff to process defective merchandise which was returned by customers. The returned merchandise needs to be sent back to the vendor at a certain date for it to either be replaced by good merchandise or for your company to be given a refund. If it is returned beyond a certain allowable period of time, the defective merchandise will not be accepted by the vendor, and your company eats the loss. You can mention the statistics of the number of warehouse staff versus delayed processing of sales returns, as follows:

January 2023 – shortage of 100 warehouse staff resulted in $1,000,000 in returns rejected by the vendor

February 2023 – shortage of 50 warehouse staff resulted in $500,000 in returns rejected by the vendor

March 2023-shortage of 200 warehouse staff resulted in $2,000,000 in returns rejected by the vendor

April 2023 – shortage of 30 warehouse staff resulted in $300,000 in returns rejected by the vendor

Or you can support this with a graph correlating the insufficient warehouse staff to the dollar value of returned merchandise which was not sent back to the vendor on time (and therefore rejected by the vendor) as follows:

Any reader can see the importance of having enough warehouse staff to process defective merchandise returns.

A Photo is Worth a Thousand Words

Using the same example above, you want to show how those returned merchandise are deteriorating in your company’s warehouse. It leaks and smells and starting to make life miserable for the remaining warehouse staff, not to mention the risk of contamination of good merchandise. You can describe it the way I wrote here, or you can use a photo to drive home the message that all returns should be processed promptly. Here’s a sample stock photo:

Let the Numbers Scream

Some internal audit reports I’ve read merely states in a cold and logical way the audit findings – and that is ok, because audit findings should be presented in a cold and logical manner. Using the same example from above, the heading of the paragraph on returned merchandise will probably state “Warehouse staff shortage results in merchandise returns rejected by vendor”. Why not tweak it a little bit and put the number to read:

Vendor rejected merchandise losses due to warehouse staff shortage - $3,800,000

Quantifying the dollar amount of the loss will not in any way deviate from presenting the audit findings in a cold and logical way, but it will nevertheless grab the attention of whoever is reading the report – and will likely lead to proactive action on your audit recommendation. Of course, you know who will look great at the end of the day.

Correlate and Put Context

So you have your graph, your photo and your attention grabbing heading. What else do we need to make this an internal audit report that gets results? Why not put some correlation and context in your internal audit report? You uncovered losses for the sample period of January to April 2023 of $3.8 million due to a warehouse staff shortage of an average of 95 workers per month. Why not dig deeper to correlate and add context? For instance, you also found out that there were zero losses from returns rejected by vendors for the past year, because there were enough warehouse workers. Then you learned that for the sample audit period, the same 95 workers were assigned to work at the order fulfillment warehouse because the automated conveyor and order fulfillment system broke down – hence the manual labor needed in lieu of an automated process. Moreover, the third party who installed and maintains this system is supposed to repair it within one month but never did, in violation of their MSA or managed services agreement with your company. Don’t you think this should be in your internal audit report as well?

Key Takeaway

Always wrap up your internal audit engagement with a call to action. All great internal audit findings will end up as shelf ware if there is no call to action. The auditee will always state in their response that they will be proactive about your audit findings. This is where the six helpers of great auditors come in. No, it’s not the set of internal controls or company policies or even the audit charter. It’s the same helpers that have guided mankind through the ages – why, what, when, where, who and how.

For the sake of continuity, let’s use the example from the previous paragraphs. Let’s start with the first helper – why. Why is this finding important? It is worth $3.8 Million, material for a medium – sized company with annual net profits of $10 Million.

The next helper- what. What should be done? Bring back the 95 workers and compel the vendor to live up to their MSA and fix the order fulfillment system.

The third helper – when. When do we need it done? The auditee must provide a time line of action.

Then comes the fourth helper – where. Where should this be done? Both the order fulfillment and returns warehouses.

Who – probably the entire warehouse operations management team, but specifically the warehouse managers, warehouse technicians and Legal (for the MSA if legal action is needed).

Finally – how. I’m sure the answer is pretty obvious by now.

It is always important to send those six helpers to your auditees, and make sure they return with concrete and definite responses.

In my next set of articles, and in honor of the Internal Audit Month of May, I will share some insights on how to lead projects and teams to greater heights of internal audit fame and glory. And yes, me gusta escribir articulos sobre auditorio interno en Espanol tambien, para los profesionales de auditorio en paises se hablan Espanol.

Ralph Villanueva is currently an IT security and compliance professional for a publicly – listed global vacation ownership company, and has relevant professional certifications earned from over ten years protecting his stakeholders from IT security and compliance risks. In his previous professional life, he was an internal auditor for a decade, earned relevant certifications as well, and has protected his employers from fraud and financial risks due to weak internal controls and weaker company leaders. He also recovered tens of thousands of dollars through his audits. Though he is happy where he is right now, he is nevertheless waiting for the day when he can fuse these two magnificent professions into something that can generate enormous value to whoever makes it happen. Think Taylor Swift’s Eras and Beyoncé’s Renaissance tours, Oppenheimer and Barbie, Predator and Alien, Godzilla and King Kong, Freddy and Jason or Batman and Superman (sorry Robin). Yes, these are extreme analogies, but I’m sure you get the message. ? Ralph Villanueva. All rights reserved.??