Be Short

You want credibility? You want to be relevant? You want your audit function to be asked to the "Big Table."

Be short.

And, by this I mean deliver audit reports that are brief. In my last post on audit report writing, I talked about being succinct. Brevity and succinctness are related, but are not the same thing.

The fact that I used to write 100+ page reports for colleges and universities notwithstanding, I believe an audit report should be no more than 10 pages.

That includes executive summary, grade (if you have one), and all major findings. It can't be done, you say. It must be done, I say.

And, here are three principles to help you.

Aggregate - Find ways to roll multiple findings into one. You do this based on identifying a common factor, usually the Cause statement. If you have more than one finding with the same root cause, they are candidates for aggregation. You can also aggregate based on Recommendation. If the thing you propose as a solution will fix several issues, roll them into one. It should come as no surprise that the two easiest aggregating factors are Cause and Reco. As I pointed out in my post "Cause and the Last Why" they are linked like tires and rims.

Seriousness Ratings - I've seen a number of approaches to this. For example, Material Weakness, Significant, Important. Also, Critical, Major, and Minor. These, and a hundred others, are ways of classifying issues so that senior folks can tell the wheat from the chaff. There are usually definitions of the level of risk of the issue, but in the end it is a pretty judgemental rating. If you make a policy decision to report only the most serious findings and provide separate documentation on the minor stuff, your reports will get shorter and become more impactful.

Of course, there is a risk. The minor stuff might still be important and the tendency is for bits not in the report to disappear from radar. To combat this, let the client know that you are tracking all issues in your tracking database, but only reporting the serious ones. Not foolproof, but it helps.

Write Fewer Words - Yes, I am as serious as an overturned Greek ferry. I know it sounds obvious and simple, but it usually isn't. This principle has alot to do with being succinct, but I consider it a more direct prescription. But, how to accomplish this simple, yet monumental task?

In the first place, put a little angel or devil (you choose which) on your shoulder as you are writing. Their job is to gripe in your ear the whole time you are typing, saying mostly, "stop writing so much stuff." Then, when you are done writing, edit out 1/3 of what you wrote and revisit it. Try again until it hurts, then try one more time. Your reports will get shorter and, if you do it well, they will get more effective.

Of course, there is another way to drive fewer words. Turn your audit report into a table or powerpoint, so you can't fit anymore words in the boxes or slides. More on this in a later post.

-- Prescott Coleman, CIA, CISA