In audit report writing, we’re all pretty well tethered to writing the 5C’s of an audit issue, namely the criteria, condition, cause, consequence, and corrective action. Today, we’ll focus in on criteria.
By strict definition, criterion is “a rule or principle for testing something.” With regards to an internal audit report, criterion is typically the guideline or control that an auditor tests. When this guideline or control isn’t followed, internal audit calls this a finding. When the finding presents a risk to the company, an audit issue results. This audit issue gets written into an audit report, and the rest is history.
For this installment of Audit Writer’s Hub, let’s look at three ways criteria can add some oomph to the audit issue.
Get in and get out
Sometimes, audit report writers can get stuck in the criteria section of an issue. I’ve seen the first entire paragraph (over 100 words) devoted to explaining criteria in great detail. The criterion is so verbose that the rest of the audit issue is pithy in comparison, even missing important parts like solid evidence or strong conclusions or complete root cause analysis.
However, readers didn’t come to an audit report looking for a list of guidelines or a company history. They came looking for issues to solve.
If you spend too many words on criteria, then you will lose your reader. So give yourself a word or sentence limit to your background section. For example, set the criteria section to less than two sentences and less than 25 words per sentence. This way your criteria won’t hog the rest of the issue.
Auditor tip: Underline the criteria or background information in an audit issue. Then determine what percentage of the issue is spent detailing the criteria. Shorten the sentence into a single sentence under 20 words.
Paraphrase long guidelines
Keep criteria short and specific to the issue. No need for a long, drawn-out excerpt from a boring manual. For example,
✗ Criteria: Guideline 4a stipulates that, “Once a purchase request has been placed, the team must send the request for approval within five (5) business days. The Evaluation Committee must review and approve the purchase within 10 business days.” (37 words)
The above example commits one of my favorite (or least favorite) atrocities: quoting an entire paragraph from a manual. Most people don’t even read a manual, much less a long guideline in quotes. We see “guidelines states” and quotation marks and we just completely space out and skip over that entire quoted sentence – as if it never existed. We figure that the next few sentences will catch us up on that jargon-filled whatever it was.
So if you do state a guideline, save yourself the words (and your reader’s confusion) and summarize the guideline into plain English instead. For example, an updated criteria sentence would read,
✓Criteria: The manual stipulates that the Evaluation Committee must review and approve purchase requests within 10 business days. (17 words)
By paraphrasing, we simplified the criteria as well – 17 words instead of 37 words. Now that’s a little more palatable.
Auditor tip: To shorten lengthy criteria information, determine what the audit issue is about and write only the information that pertains to the issue. The example above only required a portion of the guideline.
Sometimes criteria is about more than compliance
Depending on the layout of an audit issue, some reports will actually use the word Criteria as a subheading within the audit issue. This section is reserved for the specific rule or guideline being tested. This subheading can be a solid format for compliance reports, where the auditor is measuring whether or not the business is compliant with the guideline.
However, in many other reports (e.g., general audit reports, fraud investigations, consulting engagements, and other reports), adhering strictly to criteria might needlessly focus the reader on the guideline rather than the real issue.
Taking the criteria example above, let’s add the rest of the issue to it. Once you read the rest of the issue, ask yourself whether the criteria is still suitable to the issue:
Criteria: The manual stipulates that the Evaluation Committee must review and approve purchase requests within 10 business days.
Issue Body: However, the country office takes on average 30 business days to review and approve purchase requests. The office uses an outdated manual that stipulates 30 days as a guideline instead of 10 days. However, the new manual – released by global in April – has shortened the procurement approval time.
In this example, compliance is secondary to the problem that the country office doesn’t have an updated manual. Although the original finding may have been that the country office had a longer approval time, the criteria sentence should focus more on the outdated manual instead of the exact guideline.
In this case, the criteria morphs from a strict compliance guideline to setting a background for the reader:
✓ Background: In April, the global business released an updated procurement manual.
This background sentence frames the reader’s expectation that the issue will be about receiving updated materials. The rest of the issue should go down the path of how the country office uses an outdated manual, instead of the path that the business doesn’t follow the rule.
Issue Body: However, the country office continues to use an outdated procurement manual. As a result, the country office takes 30 days to approve purchase requests rather than the 10 days as updated in the new manual.
Auditor tip: Writing an audit issue is an organic process. Although criterion might go first in the written audit issue, it might be the last sentence you create. In other words, write your evidence and conclusions first, and then write the information necessary for understanding the issue.
No one came to read a long, lengthy paragraph on criteria information. Readers want to know what’s wrong and how to fix the issues. In this way, criteria should be succinct and focus on guiding the reader straight to the heart of the issue. When the criteria is crisp and clear, it can add just the oomph the reader needs.
Be sure to attend Sarah's upcoming workshop titled Better, Faster, Stronger: Improving Audit Report Writing at the upcoming SuperStrategies Conference & Expo.