11/18/2018

1

TALLAHASSEE CHAPTER

Internal Audit Management

Communicating Results

November 27, 2018

Tiffany Hurst, CIA

Director of Audit

Florida Department of Education

Office of Inspector General

TALLAHASSEE CHAPTER

Standard 2400 – Communicating

Results

• 2410 Criteria for Communicating

• 2420 Quality of Communications

• 2421 Errors and Omissions

• 2430 Conformance Statement

• 2431 Disclosure of Nonconformance

• 2440 Disseminating of Results

• 2450 Overall Opinions

TALLAHASSEE CHAPTER

Sawyer’s Wisdom

“The entire success of the audit project hangs largely on the report. It should be faultless. The critic will be severely criticized for any statement that is incorrect or out of perspective, or for any typographical or other error that is not corrected before the report goes out to its recipients.”

11/18/2018

2

TALLAHASSEE CHAPTER

Sawyer’s Wisdom

“For that reason, it should be crafted carefully and reviewed meticulously.”

TALLAHASSEE CHAPTER

Purpose of Engagement

Communications

• Inform

• Report on objectives

• Persuade

• Obtain Results

What do they do?

TALLAHASSEE CHAPTER

Purpose of Engagement

Communications

1. Explain the auditor’s observations, conclusions and recommendations

2. Attempt to convince the recipients of their value and validity

3. Promote beneficial change

11/18/2018

3

TALLAHASSEE CHAPTER

When to Communicate?

– Throughout the audit (Preliminary through Follow up)

– Start with Preliminary: Notify client management about the timing of the audit, the reason, scope, and resources needed.

– Interim: Progress communication provides a means of communicating a situation that requires immediate action.

• Use Interim Reports (oral or written)

TALLAHASSEE CHAPTER

Why Communicate?

• Adherence to the standards

• To alert management of your results

• Avoid surprises!

• Request explanations and additional documentation

• Find the root cause

TALLAHASSEE CHAPTER

Open Communication

“…success occurs when [the IG] office

has full and open communications with

every level of the department.” • * Anonymous Federal IG, Grant Thornton Public Sector – “Walking the Line”

11/18/2018

4

TALLAHASSEE CHAPTER

Communication Format

Orally

Written E-mail

Memorandum

Report

TALLAHASSEE CHAPTER

Oral Communication

Positives

Immediate

Face-to-face

Reveals attitudes and convictions

Counter argue

Improve rapport

NegativesLack of documentationLack factsMay not be open to all parties

TALLAHASSEE CHAPTER

Written Communication

Positives

Permanent

Precise

Explicit

Readily available

Negatives

Timeliness

Misinterpretation

Feedback not immediate

11/18/2018

5

TALLAHASSEE CHAPTER

Communication -

Relationships

“The relationship should never be “us versus them” and it never has to be a “gotcha” type of relationship….”

* Anonymous Federal IG, Grant Thornton Public Sector – “Walking the Line”

TALLAHASSEE CHAPTER

Communication Example

Bad Communication:

https://www.youtube.com/watch?v=jsLUid

iYm0w

TALLAHASSEE CHAPTER

Reporting Process

11/18/2018

6

TALLAHASSEE CHAPTER

Written Report – Common

Elements

• Executive Summary

• Background

• Scope

• Objectives

• Results

– Findings and Recommendations

• Statement of Conformance

TALLAHASSEE CHAPTER

Results - Finding Elements

TALLAHASSEE CHAPTER

Criteria

• “The way it should be.” – The correct state.

• Statutes, Policies, Rules, Procedures

• Benchmarks, Best Practices

11/18/2018

7

TALLAHASSEE CHAPTER

Condition

• “The way it is.” – The current state

• The factual evidence that the auditor found.

– Based on observation, questions, analysis, verification, testing

TALLAHASSEE CHAPTER

Cause

• The reason for the difference between the expected and actual conditions.

• Identify the root cause

– Gather and analyze facts

– Dig Deep, Not just on the surface

TALLAHASSEE CHAPTER

Root Cause

• Why did the issue occur?• Issue – error, instance of noncompliance, missed

opportunity

• Trace back to a decisions, actions, or inactions

• Management “Failed to”•Plan, Organize, Staff, Direct, Monitor

• Seek to understand why people make bad or inadequate decisions.

11/18/2018

8

TALLAHASSEE CHAPTER

Root Cause

• Identifying the underlying cause –• Provides insight for management

• Could Prevent reoccurrence

• Takes longer

• Ask the 5 whys

TALLAHASSEE CHAPTER

Effect• “So What”

• The impact of the difference

• The risk or exposure the organization or others will encounter

• What are the consequences?

• Harm to self or others

• Cost - $$$$$

• Effectiveness

• Efficiency• Goals

• Negative Public Reaction

TALLAHASSEE CHAPTER

Recommendations

• Must be convincing or it will not be implemented.

• Must address the basic/root cause of the deficiency

• Identify an action official

• Specific

• Significant

• Feasible

• Cost Effective

• Positive Tone and Content

• Give credit for actions already taken

11/18/2018

9

TALLAHASSEE CHAPTER

Conformance Statement

Indicating that engagements are “conducted in conformance with the International Standards for the Professional Practice of Internal Auditing” is appropriate only if supported by the results of the quality assurance and improvement program.

Why does it matter? This statement builds the internal audit’s credibility.

TALLAHASSEE CHAPTER

Disclosure of Non

Conformance

Communication of the results MUST disclose:

• Principle or rule with which full conformance was not achieved

• Reason for the nonconformance

• Impact of the nonconformance

TALLAHASSEE CHAPTER

Standard “Musts”

11/18/2018

10

TALLAHASSEE CHAPTER

Criteria for Communicating

Internal auditors MUST:

• Communicate the results of engagements.

Include:

• Engagement Objectives, Scope

• Applicable conclusions, recommendations, and action plans

TALLAHASSEE CHAPTER

Quality of Communications

Communications MUST be:

•Accurate

•Free from errors and distortions

•Faithful to underlying facts

•Objective

•Fair, impartial, and unbiased

•Fair-minded and balanced assessment of all relevant facts and circumstances.

TALLAHASSEE CHAPTER

Quality of Communications

Communications MUST be:

•Clear

•easily understood and logical,

•consistent with terminology used in the industry

•avoiding unnecessary technical language

•providing all significant and relevant information.

11/18/2018

11

TALLAHASSEE CHAPTER

Quality of Communications

Communications MUST be:

•Concise

• to the point

•avoid redundancy and exclude information that is unnecessary, insignificant, or unrelated to the engagement.

TALLAHASSEE CHAPTER

Quality of Communications

Communications MUST be:

•Complete

• lack nothing that is essential

• include all significant and relevant information and observations to support recommendations and conclusions.

•Enable the reader to reach the same conclusion as the internal audit activity did.

TALLAHASSEE CHAPTER

Quality of Communications

Communications MUST be:

•Constructive

•helpful to the engagement client and the organization

• lead to improvements where needed

•Timely

•opportune and expedient

•allowing management to take appropriate corrective action.

11/18/2018

12

TALLAHASSEE CHAPTER

Reviewing the Report

• Did the report answer the objective(s)

• Was it performed in accordance with applicable audit standards?

• Is the message clear?

TALLAHASSEE CHAPTER

Reviewing the Report

• Is the Overall Tone Appropriate

• Is the report the Appropriate Length?

• Is the Executive Summary truly a summary?

• Does it have a good Focus and Flow?

• Are Graphics clear & relevant?

TALLAHASSEE CHAPTER

Report Review - Elements

• Criteria

– Clearly Stated?

– Quotations vs. Summarizing

• Condition

– Strongly Supported?

11/18/2018

13

TALLAHASSEE CHAPTER

Report Review - Elements

• Cause

– Identified the root cause?

• Effect

– Fully known?

– Reasonable?

TALLAHASSEE CHAPTER

Report Review - Elements

• Recommendation

– Actionable?

– Management Buy-In?

TALLAHASSEE CHAPTER

Reviewing the Report -

Consistency

Is the report consistent?

• Date format (1/5/18 vs. January 5, 2018)

• Number format

• Fonts

• Acronyms (DOE vs. FDOE)

– Are they defined the first time?

11/18/2018

14

TALLAHASSEE CHAPTER

Reviewing the Report -

Consistency

• Language vs. symbols (Number vs. #)

• Sentence Structure

– Active vs. Passive structure

• Passive: Feedback was provided by the Audit Director.

• Active: The Audit Director provided feedback.

• Writing style (Ex. Chicago)

TALLAHASSEE CHAPTER

Reviewing the Report –

Avoid

• Never, Always, Some• Charged Words, i.e. “Management Failed”

• Technical Jargon and Buzzwords

TALLAHASSEE CHAPTER

Reviewing the Report –

Conformance

• Does the report conform to the IIA standards?

– Yes?

• Add the conformance Statement

– No?

• Disclose the reason why

11/18/2018

15

TALLAHASSEE CHAPTER

Proofread

“Proofread carefully to see if you any words out.”

~Author Unknown

TALLAHASSEE CHAPTER

Disseminating Results

• Verbally or in writing

• Electronic

• Hard Copy

• Maintain a list of the recipients

• Consider sensitive information

TALLAHASSEE CHAPTER

Errors and Omissions

Determining Significance: Ask these questions:

• Would the error or omission change the results of the engagement?

• Would the error or omission change someone’s mind about the severity of the findings?

• Would the error or omission change an opinion?

• Would the error or omission change a recommended action?

If final communication contains a significant error or omission, the chief audit executive MUST communicate corrected information to all parties who received the original communication

11/18/2018

16

TALLAHASSEE CHAPTER

Overall Opinions

Overall opinions differ from conclusions in that at conclusion is drawn from one engagement and an overall opinion is drawn from multiple engagements.

• Communicated separately from individual engagement communications

• Must be supported by sufficient, reliable, relevant, and useful information.