How much info is too much?.

Reporting the right amount of detail to the right people for internal audit action tracking in an innovative way.

Reporting on open audit actions (I.e action tracking), can take many different forms. Firstly, we need to understand the audience and who exactly we are reporting to. We then need to understand why we are reporting to them. And lastly, we need to determine how often we should be reporting to them.

Each group we report to will have extremely different reasons on why we need to report to them and the frequency, yet internal audit doesn’t have endless hours to constantly prepare open audit action reports.

In this post, we’re going to discuss the groups which need frequent open action item reporting, why they need this reporting, what level of detail they need, and lastly, innovative ways which we can provide this information, yet save ourselves within audit extremely valuable time.

Action Owners and Direct Line Managers

These are the guys who are responsible for implementing recommendations and actions arising from audit reports, so there is a strong argument here that we should not need to provide these people with any reports. Afterall, they would have signed their name agreeing to the action, so should be well aware of what’s required from them. However, as we all know, this isn’t necessarily the case.

Why they need this reporting

Action Owners need to be reminded of what actions they are required to complete, and most importantly, what is overdue. If they don’t know, or in some cases – are not reminded, of what they need to do, then there is a good chance it won’t be done.

Level of detail required

Only the basics are required. Action Owners should be aware of:

• Finding
• Action
• Due Date
• Days Overdue

How often they need this reporting

Reporting should be provided monthly. This helps eliminate the excuse that they were not reminded or notified of their required actions. There are opportunities to automate this process, reducing the burden on Internal Audit.

Department / Entity Heads / Senior Executives

Department Heads should be aware of what is going on within their teams. As often in Audit, we need to put ourselves in the shoes of those on ‘the other side of the fence’, and this is exactly one of those situations. Audit teams should think “what would I want to know” if they were a Department Head.

Why they need this reporting
Department Heads should be aware of what is going on within their departments, and particularly what audit actions are well overdue. Ensuring they are aware and up to date will also help their relationship with Internal Audit.

Level of detail required
Department Head’s likely do not need all the detail. Simply the audit finding, action required, due date, owner and status would be sufficient. Should they want more detail, they should speak to the relevant action owner in the first instance.

How often they need this reporting
Reporting should be provided either monthly or quarterly. If monthly reporting is provided, the same report provided to the action owners can also be provided to the Department Head’s thus saving time.

Audit Committee

Why they need this reporting
The Internal Audit Standards require that the audit committee is well informed and aware of what is happening within the business. As such, regular and sufficient reporting is required.

Level of detail required
The audit committee does not need to see the detail of every single audit recommendation. For businesses with a good track record of implementing open audit actions, a summary of actions per business unit, statistics on the number overdue, and a reconciliation of actions open and completed within the period is all that would be required at a minimum. For businesses with a poor track record of implementing open actions, it may be necessary to included the details of overdue or open high risk findings. How often they need this reporting

Generally, this reporting is only provided each audit committee, however the audit committee can request additional information as and when needed.

Being innovate in action tracking reporting

We already have a handy tool which helps you manage your internal audit actions. You can purchase a copy of the tool here. Our tool will help you to record and automatically update each audit finding.

Using our tool, audit teams can:

• Upload the template to a Microsoft Teams page or SharePoint. By doing this, anyone is then able to access and see the information in real time. Be aware, you may want to consider office politics at the same time here. Certain teams may not appreciate other teams seeing all their audit findings. Owners can then enter their own updates directly into the spreadsheet when necessary also.
• Automate the process. Using macros and RPA’s, audit teams can automate the follow up process. For instance, emails can be auto generated to send our reminder update emails. Furthermore, macros or RPA’s can also be used to generate the dashboard reporting.

Action item reporting is a fine line to tread to ensure we drive the right behaviours. Sufficient detail should be provided to allow people to complete the actions, however audit should not be spoon feeding instructions as owners need to be held accountable. Additionally, Senior Management should be responsible for ensuring actions are completed, and as such, should be provided with the information to help them do this, but not such much information that it becomes an overload and they ignore it.

Reporting is evolving and should always be adapted to suit the business.