The proof of the pudding is in the eating
An audit report is nothing more than a piece of management information. A piece of information for the benefit of management that will hopefully help them to make the right decisions in the future, mainly concerning about priorities for action and the allocation of resources.
As an auditor we want our reports to be useful. We want them to add value and we want them to be used. Whether or not the reports are used depends on two important things;
- Whether the audit was a good one or not
- Whether we have been able to express ourselves clearly in the written report
A good audit can be ruined by a badly constructed report, and many are, so we need to take care in the final stages of this process. Too many audit reports are rushed off in a bid by the auditor to get finished and move on to other things. You must make enough time available in your plan to do a decent job of it.
There are ways that we can express ourselves that can make people receptive to our findings, even the negative aspects of it, and there are ways that we can express ourselves that will encourage defensive behaviour. Too many auditors think that the only important items for the report are the problems. Whilst these are important, and we should never chicken out of reporting problem areas, they will only ever, at best, be half the story. Management need to know about the strengths of the system. They need to know what is working, so they can hold the gains in those areas. It also helps with the allocation and reallocation of resources.
Based on the assumption that there will always be some positives to report, it is usually a good idea to highlight those early in the report and in the closing meeting. This is not a case of “softening up” management for the bad news, it just gives an early message that the report will be fair and credit will be given where credit is due. Once management have formed the opinion that the auditor will be fair with them, they will be more inclined to accept the findings that relate to problem areas
Care must be taken, however, when we are giving positive feedback that we don’t go too far. There are a few things to watch out for
- Don’t use subjective positive terminology such as “marvellous” or “excellent” – stick to objective terms such as “high level of conformance”
- Don’t over-sugar the pill. If the system is, on the whole, pretty poor, don’t feel obliged to give a 50/50 split to positive and negative findings as this will distort the true message relating to the overall health of the system
- Try to follow a similar discipline when reporting positives, as you would with non-conformances. All your findings should be supported by evidence and examples. Try to avoid vague and general positive statements as these have little use as pieces of management information
An audit report, ultimately, is just management information. They will ultimately do with it what they will. All the auditor can do is keep it relevant, keep it accurate and make sure it can be understood. After that it’s over to them …