There is a line that our audit department had in every single audit report. (The following may not be verbatim, but it is close enough for our purposes.) "In our opinion, controls over [insert area being reviewed here] are [insert opinion, e.g., effective, ineffective, etc.]"
A good old fashioned opinion statement. It does its job, and it did its job in our internal audit reports for at least 20 years. I'm guessing you have a similar sentence, an opinion statement that has stood the test of time as it is used over and over again.
So, why pick this sentence for review? To begin with, it is an important sentence since, for a lot of readers, the opinion statement is the only sentence in the report they care about. In fact, sometimes it is the only sentence they read.
Also, as already noted, it is a sentence we have all used for a long time, trusting in it to withstand the test of time. Accordingly, it may deserve to be taken down a peg or two.
Why look closely at what has worked before? Here's a story I've told before, but you'll just have to sit through again. When I joined the Farmers Insurance audit team, there was a standard paragraph we wrote related to claims reserves — a paragraph we wrote many times since we reviewed at least one claims office per month. Within that paragraph we would write that inappropriate reserve setting [the amount set aside in expectation of a future payment of a claim] would result in those funds being "trapped in the system." After about a year, the home office QA team visited and one of the first things they asked was what "trapped in the system" meant. We had no answer. It was just what we wrote. And it had always worked in the past, so it must be relevant for all time. It promptly disappeared and the experience reminded us we needed to think about what we were writing.
The need to constantly review assumptions you assume to be perfect.
So, because the opinion statement is the primary focus for most of our readers, and because it is a sentence we seldom inspect closely, let's dissect its effectiveness in driving action and building excitement.
"In our opinion…" While this would seem to fit perfectly into what we are trying to say, in actuality it is not a good start. In our department, we had a section of the report titled "Opinion." And the only sentence in it was this opinion statement. Accordingly, this verbiage seems a bit redundant. While some might argue the phrase provides value by reemphasizing why the sentence exists, there is just as strong an argument that is it only cluttering the communication with redundancy.
Further, I would argue that it is evident that what follows is the internal audit department's opinion. It is our report, so it is our opinion. An argument might be made that everything else in the report represents the reporting of facts; so, since this is opinion, it might be good to reemphasize that fact. Could be. But that gets to the point of this exercise. There are no right and wrong answers when asking these questions. Instead, we are looking closely at the words and making personal/departmental decisions about what really supports the purpose of the report – what should stay and what should be changed.
Let's keep going.
"…controls over [insert area being reviewed here] …" Let's start with the last part — the part where you fill in the name of the area being reviewed. Do we need to restate the department/process that has been reviewed? It is in the background, it is in the title, it permeates everything else. Do we need to say it again?
Since this may be the only part of the report some people read, it could be argued that repeating the title is a good thing. However, it also represents another redundancy. As a profession, we seem to enjoy redundantly repeating ourselves in the name of clarity, and all it does is obscure what is important. We need to be watchful of the symptoms of redundisease.
But let's go back to the beginning of this phrase and the problematic word "controls". We use it like we all know what it means. But do your clients really understand what a control is — its purpose, its structure, its lot in life — and, to be honest, do we even know what it means?
That is not to say the word should not be used in the context of an opinion statement. This is our opinion on the controls. However, this emphasizes the need to ensure there is a shared nomenclature between ourselves and the client — that everyone involved knows exactly what is being said and the meaning of words that are being used.
"…are [insert opinion — e.g., effective, ineffective, etc.]" Good news. I'm not going to dissect the word "are". However, the terms we use — effective, ineffective, needs improvement, needs some improvement, needs lots of improvement, needs improvement but not really a lot of improvement, needs to see someone about that cough — are very powerful. They are the Sword of Damocles hanging over every reader's head. They drive the action. They cause the need to take action.
In our organization, we used effective, needs improvement, and ineffective. However, over time we found that over 80% of reports were showing controls needed improvement. In other words, the terms were almost meaningless and they did not drive to action.
While we may not have had that part right (and we took various steps to do something about it) we did get one other thing right. We had an appendix in every audit report that laid out exactly what we meant by each of the opinions. So, unlike the word "control" which could get lost in obfuscation, the opinions themselves were well defined.
So, we come to the end of our dissection. What comes from all this? Well, first, you should have a better idea of what the sentence is trying to accomplish. But I'll also throw out a suggestion. How about if each report has a section titled "Opinion" or "Internal Audit's Opinion," allowing for the elimination of that introductory statement. Then let's also assume the reader already knows what process/department is under review. The section then contains only one sentence. "Controls are [insert opinion — e.g., effective, ineffective, etc.]"
Too abrupt? Not enough information?
Let me throw another one at you. We know that the main thing people care about is the opinion. So how about, after the title of the audit report, the very first sentence is "Controls are [insert opinion — e.g., effective, ineffective, etc.]"
Too soon? Too scary?
Okay, time to wrap this up. We've just gone through a lot of work for one 8- to 12-word sentence. And this is probably more exercise than you want to do on every sentence of every audit report. But every sentence deserves some scrutiny. And, once you've done it a few times you'll see that the analysis becomes second nature. The dross will disappear and the call to action will remain.
Note that I normally write these posts by talking about the general — the way things are in the real world — and work toward the specific — why internal audit should care. But, in this case, I'm going to take a second to come at it the other way because every part of what I've written in these two blog posts also relates to every word you write – memos, emails, letters, postcards, tweets, anything. What is the purpose of what you are writing? And is what you are writing actually communicating that purpose?
Practice these concepts in life and it will make your writing better, even when you write audit reports.
Now, you might think this is where our discussion comes to an end. But I have a confession. I don't agree with a basic premise I have used in both of these posts. Next time, my thoughts on why we write audit reports, and why our reasons may lead us down the primrose path.