7030 Drafting the Audit Report

Dec-2022

What the CSAE 3001 means for drafting the audit report

The CSAE 3001 lists several requirements for the assurance report. One of these requirements is to produce a report in writing, which includes a conclusion that shall be clearly separated from other information in the report. The following elements are also required to be included in the audit report:

Purpose of the audit report

The OAG’s role, as external auditor of government, is to assist Parliament in its oversight of government spending and performance. Performance audit and special examination reports set out audit findings and recommendations for improvement in a way that is intended to be useful for the audited entities. The reports are also what the media and the public see of the work of the OAG. Thus, the reputation and credibility of the OAG depend to a great extent on the quality of the reports it issues. Audit reports must be written in a fair and factual manner so that they reflect the objectivity with which the audit was carried out.

In addition to meeting reporting requirements in CSAE 3001 audit reports must conform to the OAG’s standards for content, style, and accuracy. Audit reports use plain language, avoid jargon, define technical terms, organize ideas logically, and clearly distinguish descriptions of entity processes from audit findings. Substantiation of statements in the report is prepared by linking them to evidence and audit documentation. (OAG Audit 7060 Substantiation). Audit reports go through many versions to achieve these high standards. At the same time, audit teams must meet strict production deadlines.

The results of performance audits are reported to Parliament and the territorial legislative assemblies.

The main audience of a special examination report is Parliament, even though the report is addressed to the board of directors and made public by the Crown corporation. After the special examination reports have been made public by the Crown corporations, they are reproduced in the next set of reports of the Auditor General.

Structuring the audit report

The audit team structures the report based on what it considers to be of significance to Parliament. This may be different from the order of topics in the audit logic matrix (OAG Audit 4044 Developing the audit strategy: audit logic matrix).

Audit teams may choose to use a report mapping approach to structure the performance audit report. Report mapping is an optional step in report development that is done with the assistance of Editorial Services through a meeting (“report mapping session”) designed to help teams organize the information gathered during the examination phase and to identify and effectively convey the key findings of the audit as well as potential key messages.

In the second stage, the audit team moves from a summary of findings to drafting its report using the report template to ensure a consistent OAG format.

Audit teams consult the Editorial Services team and the Report Communications team for guidance and assistance with structuring the report. Teams must use the standard report template. If audit teams are making any changes to this template, Audit Services approval is needed.

The following are the elements of a report.

Report title. The report title is determined by the Communications team in consultation with the audit team. It is not subject to approval by the entity. The title reflects the main issue or activity covered by the audit, without any subtitles, and does not provide an indication of audit conclusions. Single entities are named in the title, but multiple entities are not.

Introduction. The introduction provides context to engage readers and help them understand the issues, without unnecessary detail. The introduction includes a description of the entity’s roles and responsibilities, as well as a statement of entity management’s responsibilities for the subject matter under audit, as set out in the audit plan summary (OAG Audit 4090 Audit plan summary for performance audits). The budgets of programs being audited, the overall entity budget, the historical context, the operational environment, the nature of business, and any exhibits such as relevant timelines, processes, or photographs may be included.

Findings. The audit teams should use the completed audit programs (OAG Audit 4070 Audit programs) as the starting point for drafting the findings. The team will have communicated findings orally to the entity as part of ongoing communications (OAG Audit 2030 Communication with the entity: initial and ongoing). Before issuing the principal’s (PX) draft report (OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft), the team debriefs the entity to verify the facts to be reported in the report.

The discussion in the report on each finding addresses the following questions:

• What was the criterion (required or desired state of affairs)?

• Why is it important?

• What was examined?

• What we found (both positive and negative)? Quantitative measures should be used where possible.

• What are the consequences (so whats)? Auditors should discuss the impact or potential impact of the difference between the situation found and the required or desired state set out in the criteria. The “so what” of an observed deficiency should explicitly state the impact of the criterion not having been met (e.g., “Without adequate cost information, National Defence cannot plan to have sufficient funds available for long-term operation and support of the helicopters”). This increases the attention that will be paid to the report and the chances that corrective action will be taken.

• What are the underlying causal factors that explain observed deficiencies? By identifying the “why so,” the OAG informs Parliament by making more meaningful recommendations.

Recommendations. Audits should include recommendations to point to the direction in which positive changes can be made for the most serious deficiencies reported. Recommendations should relate to strategic issues, address areas where there are significant risks to the entity, and prompt corrective action. Only serious weaknesses and significant deficiencies, and not necessarily each audit finding, should be addressed as recommendations. All recommendations should be action-oriented and guide the corrective action needed to fix the problems identified in the finding (OAG Audit 8020 Recommendations and entity responses).

To develop action-oriented and practical recommendations, the audit team should start drafting recommendations early and seek management’s views. Recommendations should be fully supported by and flow from the findings, and they should be aimed at correcting the underlying cause of the deficiency (OAG Audit 8020 Recommendations and entity responses).

Conclusion. In forming a conclusion, the auditor assesses the significance of the findings in relation to the audit objective. The conclusion should not be a summary of findings, but rather be a clear conclusion against the audit objective.

There are essentially four different types of conclusions that can be considered for an audit: clean conclusions (“yes”), qualified conclusions (“yes, but” or “no, but”), adverse conclusions (“no”), and denial conclusions (when the audit team is unable to conclude). Auditors need to clearly communicate the type of conclusion that is used. They also need to use judgment in forming a conclusion.

The conclusion is not a summary of the findings. For more details, refer to OAG Audit 7040 Audit conclusion.

For special examinations, the conclusion is worded to include an opinion statement, as required by the Financial Administration Act (FAA), on whether there are significant deficiencies in the systems and practices that we examined. The section also concludes explicitly against the audit objective, as set in the FAA, which is to determine whether the systems and practices we selected for examination at the Crown corporation are providing it with reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively as required by section 138 of the Financial Administration Act.

The wording of the conclusion (opinion) in a special examination is similar from one audit to another. The special examination report template provides the standard wording to be used.

If the work of an expert (internal or external) is mentioned in the audit report, the wording must not imply that the engagement leader’s responsibility for the conclusion is reduced because of the involvement of that expert (OAG Audit 2070 Use of experts).

Subsequent events. In the case of subsequent events, the engagement leader must ensure that a preliminary assessment of the impact of subsequent events on findings and conclusion is done, and where needed, that relevant information is included in the report (see OAG Audit 8030 Subsequent events).

About the Audit. This section describes clearly and concisely the design and execution of the audit in enough detail to give readers confidence that the audit findings are based on clear, well-defined questions, appropriate methodology, and adequate data sources. The components of About the Audit are as follows:

• the statement of the professional standards followed (standard text in the report template);

• a statement that, as part of our standard audit process, the audited entity

  • acknowledges responsibility for the underlying subject matter (as described in OAG Audit 4090 Audit plan summary for performance audits, or in OAG Audit 2030 Communication with the audit entity: initial and ongoing);

  • has reviewed and acknowledged the suitability of the criteria (as described in OAG Audit 4090 Audit plan summary for performance audits, or in OAG Audit 4100 Special examination plan);

  • provided written confirmation that it provided the audit team with all information of which the entity is aware that has been requested or that could significantly affect the findings or the conclusion of the assurance report (as described in OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft); and

  • acknowledges that the draft report is factually accurate (as described in OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft);

• the audit objective;

• a brief, yet informative, description of the scope and approach;

• the audit criteria and their sources for performance audits or for special examinations, the sources of criteria for special examinations;

• the period covered by the audit—the period to which the audit conclusion applies;

• the date of the report (see OAG Audit 8017 Report content approval and date of the report); and

• the audit team.

If one or more of the entities’ written confirmations (that is, of management’s responsibility for the subject matter, of suitability of criteria, that all information requested has been received; or of validity of facts and final responses to recommendations) are not received, the audit team must consider the impact, if any, on the audit work, audit report, and conclusion. Teams must disclose the nature of any unresolved difference in the audit report. Some options to consider are a description of the disagreement in the body of the report, or a modification of the standard wording in the About the Audit section to state that the requested acknowledgement has not been obtained and to explain why.

Exhibits. The preparation of exhibits and other graphic elements normally begins during the initial drafting of the report and continues through to the final printing. There may be several iterations of an exhibit before it is finalized. The successful use of graphics is improved by integrating them into early drafts of the report. Exhibits from government and other sources may be subject to copyright and audit team should contact Legal Services for assistance in obtaining permission to reproduce the original.

Follow-up performance audit work

The Auditor General regularly tables reports which include elements of follow-up audit work. These reports report on progress made by the government in responding to recommendations contained in previous performance audit reports and in addressing the underlying findings, but they may include new audit work as well. When concluding on the audit objective(s), the follow-up elements should be distinguished from the new audit elements. The report structure for follow-up audit work is similar to that for other performance audit reports, with some exceptions:

• finding—at the end of each finding, there is a rating of satisfactory or unsatisfactory for the way the entity has either implemented the original recommendation or resolved the issues related to the original recommendation or significant findings;

• conclusion—in addition to concluding against the audit objective based on the evidence collected during the examination phase, for follow-up work, the conclusion indicates whether the entity has fully implemented the previous recommendations and, if not, whether satisfactory progress has been made toward implementing them.

Role of the Office’s Editorial Services team

Producing audit reports that meet the OAG’s quality standards is a team effort, involving not only the responsible audit team, but also other groups within the Office. The Editorial Services team holds primary responsibility for ensuring that OAG audit reports are written in language that is easy to read and understand. Since the Official Languages Act requires reports from the Auditor General to be tabled in both official languages, the Editorial Services team is responsible for providing accurate translations.

In addition, the Editorial Services team contributes to ensuring that messages are clear, unambiguous, and easy to interpret.

Next steps

When the internal draft is complete, the audit team seeks input from the internal specialists and external advisers (OAG Audit 2050 Advisory committee meetings). The team should plan enough time to allow for these levels of review. Following these reviews and the required revisions, the team sends the principal’s (PX) draft to the entity (OAG Audit 8019 Submitting the principal’s (PX) draft and transmission draft).