Writing an audit report: structure, phrasing findings and an example

Who are you writing an audit report for?

An audit report has three readers with three questions. The audited department wants to know exactly what was seen and what is expected of it. Management wants to know whether the system works and where to adjust. A customer or external auditor wants to see that you look critically at yourself and really follow up on deviations.

So write clearly enough that someone who was not at the audit understands what is going on. A report that only the auditor understands will not be read, and so will not lead to improvement. Leave out jargon and abbreviations unless everyone knows them.

Which parts should an audit report have?

A fixed structure makes reports comparable, even when several auditors write them. Keep the core to one or two pages and put detail in an appendix. Start with a short summary, because many readers never get past the first paragraph.

• Header details: department or process, date, auditor, people interviewed and the audit programme the audit belongs to
• Scope, objective and criteria: what you examined, why and what you tested against
• Summary and conclusion: in a few sentences, whether the area examined does what it should
• Findings: deviations, observations and strengths, each with evidence
• Agreements: what happens with each deviation, by whom and when
• Limitations: what you could not check, for example because of sampling or absence

How do you phrase a finding?

A finding has four parts that you always note in the same order. The fact: what did you see or read, with numbers and period. The evidence: which document, record or conversation shows it. The criterion: what you compare it with, such as your own procedure, a customer requirement or a legal requirement. The effect: what the deviation means for the customer, safety or control.

Write precisely enough that someone else could repeat the check. "The order confirmation was missing for 3 of the 10 orders checked" is usable, "the administration is not in order" is an opinion. Name roles or processes instead of people: it is about the system, not about blame.

Do not dictate the solution in the finding. The auditor establishes what deviates, the process owner decides how it is fixed. That keeps the measure with the department itself and makes it fit better with how the work really runs.

How do you decide how serious a finding is?

Choose a simple scale and use it the same way every time. Many organisations work with strength, observation, minor deviation and major deviation. The classification decides how fast and how heavy the follow-up is, so a fixed yardstick prevents arguments afterwards.

Let auditors compare their reports side by side now and then, so the same situation is not called minor by one and major by another. Audited people notice such a difference quickly and then lose trust in the outcome. Questions that help you decide the class:

• Is it a one-off mistake or a structural gap in the system?
• Does it affect the customer, safety, the environment or a legal requirement?
• Has it been seen before, in a previous audit or in a complaint?
• How much of the sample deviates, and how large was the sample?

A worked example finding

Say you audit the purchasing process of an installation company. Fact: for 4 of the 12 orders checked from the past quarter, the goods-receipt check had not been filled in. Evidence: the receipt forms of those orders and the conversation with the warehouse employee. Criterion: your own procedure for purchasing and receiving.

Effect: material may have been used without a check, so a defect only shows up at the customer. Class: minor deviation, because the other orders were checked. Agreement: the warehouse supervisor builds the check into the receipt slip and tests this in two months with ten new orders.

Do not forget the strengths

A report with only deviations feels like a reckoning and puts the audited people on the defensive. So also say what goes well, with the same kind of evidence: "All ten work instructions checked were current and available at the machine." That way the department knows what to keep, and other departments can learn from it.

Do be honest, though. Do not force a compliment to soften a harsh conclusion, because audited people sense it. A strength should be supported as well as a deviation is, with a fact, evidence and a criterion.

Common mistakes in an audit report

Most reports that achieve little fail on the same points. They are rarely big mistakes of substance, but small habits that make the report less useful. Run through this list before you send the report.

• Opinions and guesses instead of facts and evidence
• Findings without a criterion, so nobody knows where the requirement comes from
• Vague action points such as "more attention to" without an owner or date
• A twenty-page report without a summary
• Surprises: the audited person sees the finding for the first time in the final report

What happens after the report?

Discuss the draft with the audited person before you make it final. That way you correct factual errors and build support for the actions. Then record an owner, a measure and a deadline for each deviation, and send the report within the period you agreed in the audit programme.

You only close a deviation when the measure has been carried out and its effect checked. Include the same points again in the next audit. Summarise the year's outcomes for the management review: which themes keep returning, which actions are behind and what does management decide?

How BrydgeOne supports this

In the Audits module you plan internal audits and log findings. You follow up the measures in Actions, so every deviation keeps an owner and a deadline. The Audit-ready check shows per part of the standard what is still missing, and Management review compiles the management review from live data.