When I began training auditors to write high-quality reports more than 20 years ago, the senior team member approached me with a smug smile. "Teach us something we don't know" he said loudly enough for his teammates to hear. "We already know the Big Four points of an audit report are the criterion, condition, cause, and effect."
I answered, "Should we talk about the other 17 points?" The auditor's upturned lips descended into a puzzled frown. "I'm all ears," he said, returning to his seat. Once I covered the 21 points of an audit report, I found the less experienced auditors offering a twenty-second or twenty-third legitimate point.
By the end of the day, the senior auditor to his credit said, "I guess our boss made us take this seminar because auditors need a checklist. Not one written in stone, but a flexible one that works as a starting off point to ensure we are writing a complete report."
"That's right," I said. "Maybe you'll need only 17 of those points, and maybe you'll need 26. That depends on the audit type, the auditee, and your firm's preferences. But use the checklist!"
Here are the 21 points of an audit report:
- Point – What policy or procedure is being audited?
- Authorization – What law, policy, or group requires the audit?
- Objective – What is the goal of the audit?
- Business – What is the nature of the auditee’s business
- History – What relevant events preceded the audit point?
- Method – How was the audit performed?
- Scope – What areas did the audit cover?
- Limitations – What restrictions prevented a complete audit?
- Finding – What is the judgment about the audit point?
- Criterion – By what measure was the finding assessed?
- Condition – What situation did the audit reveal?
- Cause – Why does the condition exist?
- Effect – What is the business impact of the condition?
- Conclusion – What does the condition imply about best practices?
- Recommendation – What should be done to fix the condition?
- Benefit – What advantage will be gained by fixing the condition?
- Response – What is the auditee’s required next step?
- Follow-through – What is the auditor’s planned next step?
Other reports in this series: