Home > Risk > How long is an audit report?

How long is an audit report?

For many consumers of audit reports in the executive suite and boardroom, the answer is probably “too long!”

Audit reports may run to extraordinary lengths; recently, I talked to one organization where they could easily be over a hundred pages.

100 pages is clearly too long for anybody to rationally expect our stakeholders in top management and on the board to want to read them.

When is there 100 pages of value, actionable information, in an audit report?

So, is the answer ten or twenty pages? Is it two or three?

Let’s tackle the question a different way.


Audit reports are a communication vehicle.

The IIA Standards do not require that we write an audit report. Instead, they require that we communicate the results of our work to our stakeholders.


What should we communicate?


When you visit the dentist because you have a toothache, do you want even a three-page report?

You want to know:

(a) can he or she stop the pain?

(b) when will that be done?

(c) is there a serious problem? and

(d) what is this going to cost me?

You don’t want to be asked to read:

  • a recap of your dental history
  • the status of recommendations from your last visit
  • a report on the depth of your gums
  • and so on.


If you take your car for a routine service, you want to know:

(a) is everything all right?

(b) is there something that needs to be done today? and

(c) what is this going to cost me?

You don’t want to know the car’s history or the dates of the last service.


In both cases, you want to receive the information you need, concisely and clearly written, without wasting a minute of your time.


What about your executives and board members?

What information do they want to get from you?

They want to know:

  • Is there a problem that is serious enough to potentially affect the organization and the achievement of its objectives in a material way? Is there a problem I need to worry about at my level?
  • Are the right actions being taken?
  • Is there anything I need to do personally?
  • Is there anything I need to make sure others are doing?


So why do we include more?

Is it because we feel a need to justify our existence? I know of CAEs who insist that every audit report has at least one finding and recommendation.

Why or why? If you have this need, this irrational compulsion, stop!

Is it because the report is a form of documentation, or because it is really being written for a regulator rather than the executive readers?

That is equally wrong.


Imagine this.

You enter the elevator at your company’s head office and are greeted by your CEO. She asks you about the audit your team recently performed of the Treasury function, saying that she is interested in the results.

Do you tell her about the background to the audit?

How about your scope and objectives?

Do you list all the medium and low issues?

Or do you just tell her whether there were major issues that merit her attention, whether management is taking the right corrective actions, and any other insights that would be of value to her?


So why do we put more than these essentials in a written audit report?

Why hide valuable, actionable information in a haystack of unnecessary detail?


The length of the audit report, if one is even needed (see my other posts and books), should be just enough to tell the consumers of the report what they need to know – and no more.


Ah, I can hear you saying that the report has to include all the findings so you can make sure management owns the issues and will take necessary corrective actions.

But do the executives and board members need to see that level of detail in the report?

Weren’t these all discussed and agreed upon at your closing meeting (and if not, why not)?

Send a note to those present at the meeting, confirming the discussion and the corrective action details (who will do what by when, etc.)


Keep what you send to the executives and the board limited to what they need to read and no more.

Make it easy for them to pick up your reports promptly, digest the actionable information, and take whatever actions are needed – now, when they are needed.


Make it easy and not hard for them to read, understand, and take any necessary actions.


If you don’t waste their time with trivia, when you have something to say they are far more likely to listen.


What say you?

Can we cut most audit reports back to half a page?

  1. April 11, 2021 at 11:35 AM

    Excellent post.

  2. April 11, 2021 at 1:07 PM

    Great suggestions to think about. It’s important to ask our clients what they want from us. I’ve used the traditional audit report format, one page memos for audits with few minor issues, and power-point formats where more graphics are involved or the client prefers it.

    Board: I don’t share audit reports with board members; I have used a one page table to explain the top issues and action plans that merit their attention and that I think should be discussed with management periodically. While I haven’t done it, I think picking one or two great audit reports each year and sharing them is probably a good marketing idea and motivating to team members.

    CEO and direct reports: I encourage them to read a short 1-2 page executive summary that starts the report, not the body of the report unless it’s their area (in which case they likely would have been in the closing meeting).

    I like a format I saw recently that uses a template structure for each audit issue in the report body, essentially splitting the 5 C’s into separate sections and separate fields for owners, due dates, priority, etc. It breaks up the monotony of word paragraphs.

    I think 10 pages is probably a reasonable maximum length of a report. Projects that are finding tons of important issues probably should be split up into multiple reports.

  3. Norman Marks
    April 11, 2021 at 1:19 PM

    David, do you need all the five C’s? Do you provide an opinion and isn’t that far more important, especially if all the issues are being addressed? In fact, if they are being addressed, do the execs need to know?

    Challenge every word.
    Every word costs time and money.

  4. Anonymous
    April 11, 2021 at 6:25 PM

    Norman, what a great post. It re-confirms a lot of my views of audit reports.

    I think the same insights can be applied to ‘dashboard’ reports.

    When i see either a dashboard or an audit report, my first question is ‘What’s the answer?” and i want to see that in the first paragraph, or executive summary. The answer is binary, e.g.
    1. Are we or Aren’t we (e.g. compliant / meeting our obligations / on track etc), or

    2. is it or isn’t it (e.g. efficient, effective, fit-for-purpose etc)

    Dashboards in particular are a pet annoyance – they present lots of graphs, pie charts etc, If the answer is not clear at first glance, then it has missed the mark.

  5. Bill Spoehr
    April 12, 2021 at 7:29 AM

    “Brevity” – Winston Churchill, 1940.

  6. April 12, 2021 at 10:42 AM

    Norman – great post and a blindingly obvious question I for one never asked. Here are a couple of topics I’d like to see in a report.
    1. Why was audit entity selected for an audit?
    2. How much did the audit cost (staff time and expenses)

    • Norman Marks
      April 12, 2021 at 10:44 AM

      Bruce, I suggest that the first was covered in the review of the audit plan. Information on the second can be available on request.

  7. Mark Williams
    April 26, 2021 at 10:56 PM

    Great post. I also see the benefit of sharing the report as you go rather than at the end. That way there’s no surprises for the stakeholders and it simply does not need so quite much explanation. Similarly, if reviewer, oversight and management can be involved throughout the audit rather than at the end this also enables a more concise report to be produced. You’ve not mentioned another trait of many auditors: a fondness for wordsmithing. A shorter and more concise report might also reduce the sheer amount of wordsmithing that goes on?

  1. April 11, 2021 at 10:09 AM
  2. April 13, 2021 at 12:37 AM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: