I. Introduction

Imagine an Audit Committee meeting to discuss a lapse that has cost the company significantly and an irregularity that went undetected for more than a year. A director asks the obvious question: Didn’t internal audit highlight this?

The Head of Internal Audit produces a report issued nine months earlier. The weakness is captured, accurately described, and fully supported by evidence. It is the 14^th of 26 observations, presented in a single line.

Nobody in the room can say Internal Audit got the facts wrong. But nobody can say Internal Audit did its job effectively, either.

In our earlier blog, we saw how Internal Audit in India has moved from routine checking to risk-based, insight-driven assurance. Moving ahead from there, insight counts only when it is heard.

Many auditors may think that their responsibility ends once accurate findings are on record. ICAI’s revised Standards on Internal Audit, however, take a wider view: SIA 310, Presentation and Communication of Internal Audit Report, expects reports to enable appropriate action, not merely record findings.

But how does an independent auditor persuade without compromising objectivity?

• The answer lies in storytelling—presenting evidence in a way that makes risks impossible to ignore.

In this blog, let us explore why persuasion is part of the internal auditor’s job, where its limits lie, and how storytelling can help internal auditors make their findings count.

II. Why Stating the Facts Is Not Enough

It is true that an internal auditor is independent, and what management does with an audit finding is management’s decision. However, what is expected from Internal Audit has evolved, and ICAI’s standards also reflect this. Earlier, internal audit was defined mainly as a source of assurance. The revised definition goes further to define internal audit as an assurance and advisory function, expected to give insights and recommendations that add value. An insight is not just a statement of facts; it is meant to be acted upon. And for that, stating the facts is not enough.

On reporting, SIA 310, Presentation and Communication of Internal Audit Report, expects reports to be clear, constructive and suited to the people reading them, providing relevant, reliable and timely information that supports informed decision-making by management and those charged with governance. That is why a report that is accurate but not understood has not done its job.

In other words, the internal auditor must persuade, not by arguing, but by presenting the evidence so clearly that the need for action cannot be missed.

Persuasion, however, has limits. The standards also call for the internal auditor to give a balanced view, without making risks look smaller or bigger than they are, and they leave decisions and responsibility for risks with management. So, the internal auditor’s job is not to force a decision, but to make sure the risk is clearly understood. Exaggerating the impact or leaving out critical facts would turn persuasion into pushing a view, and the auditor would lose the credibility which they can never afford to lose.

In other words, the internal auditor must persuade, not by arguing, but by presenting the evidence so clearly that the need for action cannot be missed.

Persuasion, however, has limits. The standards also call for the internal auditor to give a balanced view, without making risks look smaller or bigger than they are, and they leave decisions and responsibility for risks with management. So, the internal auditor’s job is not to force a decision, but to make sure the risk is clearly understood. Exaggerating the impact or leaving out critical facts would turn persuasion into pushing a view, and the auditor would lose the credibility which they can never afford to lose.

III. Storytelling – The Auditor’s Way

If persuasion means presenting evidence in a way where the need for action cannot be missed, the next question is how.

And the answer lies in storytelling.

In internal audit, it means suitably arranging evidence, so that the reader reaches the same conclusion as the auditor.

Every sound observation already has the elements of a story:

• a setting (what should happen);
• a conflict (what is actually happening);
• a reason (why the gap exists);
• stakes (the consequence); and
• a resolution (what must change).

Auditors collect all of these during fieldwork. Storytelling is simply presenting them in an order and language that a reader can follow, remember, and act upon. A list of observations tells the reader what happened, but a story tells them why it matters and what should happen next. Further, ICAI’s revised internal audit standards also recognize pictures, digital formats, and dashboards as ways of communicating, and treat visualisation tools as part of the modern internal auditor’s toolkit, which can aid in storytelling. It is needless to mention that a well-chosen visual can convey observations faster than a page of text.

IV. Five Principles for Telling the Audit Story Well

A. Put the main message first.

SIA 310 recommends that every report carry an executive summary to make it do real work. Open with the overall conclusion, with the top key issues that matter the most, and what they mean for the business. Scope and method still belong in the report, detailed further down.

A simple test and key intention would be: if a director reads only the first section of content, would they know what matters?

Outcome: The key message gets through, even if the reader only glances at the rest of the report.

B. Tell the complete story of each observation.

An observation that shows a problem but not its cause, or a cause but not its impact, leaves the reader unclear. Every observation should cover all the storytelling elements. An internal auditor should spend quality time on the root cause, which the standards call out as what makes a report useful. It must address the underlying issue rather than the symptoms. When the recommendation addresses the real cause, the issue barely remains in the next year.

Outcome: Management can act without asking for further explanation.

C. Use numbers and plain language.

“Controls need strengthening” is just an opinion. A statement that shows the exposure in rupees, or names the law or policy at risk, is a fact with consequences. Management can connect with it better and respond faster with the right action. Language also matters equally. A finding that needs an auditor to interpret it will rarely prompt the management to act. Every observation should be written so that the management team, without an audit background, can grasp the issue, its impact and the action required in a single reading.

Outcome: The discussion moves from whether the problem exists to how to fix it.

D. Link related findings.

Separate findings often share a common cause. Reported one by one, they appear as minor, unrelated lapses. Read together, they may reveal a single, deeper weakness in a process, a system, or the control environment itself. The internal auditor should identify such patterns and state them clearly. Where a weakness cuts across functions or locations, the report should set out its wider impact and recommend action at the governance level, not just fixes at the process level. Recognising these patterns is where internal audit adds the most value.

Outcome: The management sees the real problem, not just a few limbs of lapses.

E. Present a balanced picture.

A report that highlights only what is not working gives an incomplete picture and invites defensiveness rather than action. An effective report shows both sides – where controls are working well and where they need attention. Acknowledging strengths makes the report more credible, shows that the area has been assessed fairly, and makes it easier for management to accept the gaps that need fixing.

Outcome: Management engages with the report rather than contesting it.

V. The Story Behind Every Observation 

VI. Conclusion

Internal audit was once judged by whether it found the right things. Today, it is judged by whether the right things changed, and the space between the two is the report. ICAI’s revised standards recognise that a report exists to support informed decisions and enable action, which means a finding is not complete until it has been understood. Storytelling, practised with discipline and anchored in evidence, is how internal auditors complete it, without compromising independence. Anyone can list exceptions, but the internal auditor who helps management see a risk clearly, understand its cause and act before it becomes a loss is the one who turns assurance into better governance.

Contributors

CA N Srilatha Bhat – LinkedIn

Poonam Vernekar – LinkedIn