The Grandfather Dialogues
What is an Internal Audit Report, Grandfather?
by Larry Sawyer
IIA 1974

"You report what you think management needs to know in order to do its managing job.
And you report when you think the information will help management the most."

What is an Internal Audit Report, Grandfather? (Chapter Fifteen)

What is an internal audit report, Grandfather?

It's a true story, Randy.

What does that mean?

Just what it says. It's a story that tells the truth about what the internal auditor did and found.

You really mean a written story of what the auditor did and found, don't you?

Not necessarily. It could be an oral story too. Sometimes they're the best kind.


Because you can see the person you're telling the story to and get his reaction. He has a chance to ask questions, and you have a chance to expand on the items of particular interest to him. Besides, you can get oral reports out a lot faster than written ones.

When do you make the audit report?


You mean at the end of the audit, don't you?

Not necessarily. You can report at the beginning, the middle or the end of the audit. And in some audits you might do all three.

You've really got me confused, Grandfather. You're telling me that reports can be written or oral and that reports can be made at any time. It just doesn't make sense.

On the contrary, it makes good sense. Let me ask you something.

Go ahead, Grandfather, but just don't confuse me any more than you have already.

Fair enough. Here goes. Whenever you set out to do something, what must you keep constantly in the forefront of your mind? Remember what I've taught you.

I know. The objective.

Great. Always determine what your real objective is. Then make sure that you don't go off on some tangent. Now, what would you think is the objective of the audit report?

To tell management what you found.

Everything you found?

I guess not. That might take too long and be awfully boring.

Excellent, Randy. So what's the real objective?

Maybe it's to tell the managers what they should know.

Much better. To tell them what they should know so that they can do a better job of managing. With that in mind, how should you report and when?

I think I'm beginning to see. You report what you think management needs to know in order to do its managing job. And you report when you think the information will help management the most.

I couldn't have said it better myself.

So maybe the word "reporting" isn't the best word, Grandfather.

Why not?

I think of a report as something in writing that's done after you've finished your work. That's what I do in school. I do my reading and researching, and then I write my report.

Good thinking. What would you say if we called it "keeping management informed"?

That's better. You can inform management any time and in any way. That really makes sense. But I've got another question.

Fire away.

If you're telling management what it needs to know, do you tell them only about what needs to be fixed, you know, just the deficiencies?

Some auditors do that. They feel that this is all that management needs to know or wants to know. I personally don't agree with that.

Why not? If managers are so busy, why take up their time with what doesn't need fixing?

For several reasons. First of all, managers are concerned about everything that goes on in the company. They have to know what needs fixing, of course. But they like to be assured that other things of importance are going along fine. They don't want to guess about those things - they'd like to be told. Second of all, they'd like to be told by the person they really trust: the internal auditor.

Doesn't that take up a lot of their valuable time?

It won't take up too much time if the reporting is done properly.

I guess you're talking about the written report now.

Yes, you're right. It's important to give both sides of an audit, but the bright side can usually wait for the final written report.

But how can you satisfy management about the good things without taking up too much of their time?

One way is by just listing the activities you covered and those you didn't.

What do you mean?

Well, let's say Mr. O'Malley asks you, an experienced internal auditor, to make an audit of the operations of his Dodger Stadium and wants it done by next Tuesday. So you can't cover everything - just those you think are most important. Now, come next Tuesday, you tell Mr. O'Malley you looked at (1) ticket-taking and control of cash, (2) the beer and hot dog stands, and (3) the storeroom where bats, balls, gloves, uniforms, and the like are kept. You also tell him that you did not look at the floodlights, the locker rooms, the grounds, the batting cage, and the seats. Since the time element wouldn't let you look at everything, you left out those things where defects would be out in the open. That's what's known as defining the purpose and scope of the audit.

Is that important, Grandfather?

It's not only important, it's essential. Anybody who gets your report - oral or written - should know what you covered and what you didn't cover. Mr. O'Malley shouldn't have to wonder whether or not you looked at the locker rooms. You told him. Then if he thinks he has a locker room problem, he can ask you to look at the locker room.

What else should I tell him?

Well, let's start at the beginning. You should give him some background.

What's that?

Information about what you're auditing. You don't have to tell him that Dodger Stadium is used for baseball games. I've got a notion he knows that. But he might be interested in attendance for the season, how much the hot dog stands took in, and what the equipment in the storeroom is worth.

What else?

Whenever you tell people what you set out to do, you should always tell them how you made out.

How do you do that?

Two ways: Your opinion and your findings.

What's the difference between them?

Maybe you can tell me. Suppose you met Mr. O'Malley in the stands just as you finished your audit and he said to you, "Hi, Randy. How do things look?" You might say to him: "Overall, things look pretty good. The ticket-taking and the cash are handled very well. The beer and hot dog stands are also well managed. It's just that the storeroom isn't being run too well." Would you say you were expressing opinions or stating findings?

Sounds more like opinions. But what's so great about opinions?

From the ordinary person, not much. An ordinary person's opinion is just his own belief of what is true. And he may be biased or uninformed. But an auditor's opinion is something else.


Because an auditor is a professional, just like a doctor or a lawyer. A professional opinion is a valuable
thing. It represents a judgment that is based on study, training, experience, and an intelligent weighing of the facts.

I'm not sure I understand.

Very well, look at it this way. When you, an experienced internal auditor, said that the cash was being handled well, it meant a lot more than if anybody coming down the street said it. It meant more because you had done a lot of reading and studying on how cash should be handled. You've been trained to know what to look for in a cash operation. You've handled many cash audits, and you know the signs that indicate poor handling. Finally, you've just checked the cash operation yourself - so this particular opinion is based on your own findings at Dodger Stadium.

Now I see.

So the auditor's opinion is as valuable in its way as the doctor's or the lawyer's. And people are willing to pay for it, like they pay for a doctor's or a lawyer's opinion. And, as a professional man, the auditor must make sure he's giving an opinion on only what he knows - on what he looked at and verified. That's why it is so important to let everyone know what he did examine and what he didn't examine.

What's a finding, then?

A finding is a determination of fact. It is based on evidence - not on inference or conclusions. It is what actually happened and what can be proved.

What's the difference between that and an opinion?

There's a big difference. Let's take your examination of the storeroom. Let's say you took a sample of 30 records - records of bats, balls, and other things. Those records say there should be 100 bats, 450 balls, 85 uniforms, 120 gloves - just to talk about 4 of the 30 records. Now you check them out and find that there were 99 bats, 449 balls, 85 uniforms, and 120 gloves. Those are your findings. Those are the facts.

What's my opinion?

You tell me, Randy.

I'd say it's a bad scene. The records and the equipment aren't the same.

I don't think a practicing auditor would agree with you. Based on his experience he knows there are bound to be little differences just so long as people are people and they keep making mistakes. So the differences you found - in items that aren't all that expensive - don't amount to much. I think his opinion in this case would be that things are going along pretty well. He is applying his audit experience and judgment to the facts.

But suppose, Grandfather, that I only found 49 out of 100 bats and 360 out of 450 balls, and 60 out of 85 uniforms and 75 out of 120 gloves. What then?

That's obvious. The professional auditor would express an unsatisfactory opinion. But what else would he do? Remember what I've taught you, now.

He'd try to find out why it happened.

Splendid. What else?

He'd try to suggest some way of fixing it.

You're doing fine. Now let's say that the very first thing you did on this audit was to check the storeroom. Then you found that terrible situation you just spoke about. You haven't yet checked on the ticket taking or the hot dog stands. What would you do?

I'd go straight to Mr. O'Malley - after talking to whomever was responsible for the storeroom.

Would you wait to prepare a written report?

I don't think so. Things are in an awful mess.

And what would you do when you got to see Mr. O'Malley?

I'd report what I - Hey, Grandfather, I'd be making an oral report!

But it would still be a report, wouldn't it?

Yes, indeed. And it wouldn't wait until the end of my audit either.

Why not?

Because it is something that Mr. O'Malley needs to know ... and things are so bad that he needs to know it right away.

Excellent. So what is an audit report?

It is informing management about what they need to know - when they need to know it.


Is that all there is to audit reports, Grandfather?

Goodness, no. We've just scratched the surface.

Can we talk some more about them later?

You bet, Randy.

Audit Wisdom