Speaking of Risk and Audit · 2026-01-13 · 17 min
Key moments - from our scoring
Substance score
58 / 100
Five dimensions, 20 points each
Margie Bastola brings 25+ years of experience helping internal audit and compliance teams across Fortune 500 companies, government agencies, and international organizations improve their reporting. The core problem she identifies is that auditors often write for themselves rather than their readers - busy executives, board members, and regulators who want concise findings focused on business risk, not administrative detail. Bastola's book, Clarity Impact Speed: Delivering Audit Reports That Matter (published 2023), emphasizes nine types of report readers, each with different needs, but all sharing a preference for clarity and brevity. A CEO's typical attention span for audit reports is just two pages, yet many departments default to verbose documentation. The episode explores why auditors struggle with the foundational components of findings (condition, criteria, cause, effect, recommendation), with particular emphasis on how weak problem statements and missing root-cause analysis lead to inspection reports rather than audit reports. Bastola stresses that condition must be opposite criteria, and recommendations must address the stated cause - basics that require intensive practice to internalize. The conversation also addresses AI's early limitations in report writing, concluding that while AI excels at grammar and formatting, it lacks the critical thinking and intellectual curiosity needed to truly solve problems. Bastola advises using AI as a research assistant to stimulate thinking rather than delegating the actual writing.
Auditors typically write for themselves rather than their readers, producing wordy and unconvincing reports. They also tend to jump over the risk element in findings, use ambiguous language about effects, and fail to clearly articulate root causes - which makes recommendations ineffective.
Use the condition-criteria-cause-effect-recommendation framework correctly, ensuring condition opposes criteria and recommendations address the root cause. Make risk statements specific and business-relevant (e.g., 'wire transfer function can process erroneous payments with 800 daily payments at $20,000 each') rather than generic (e.g., 'assets not properly safeguarded').
A crisp audit objective, concise scope statement, key findings with ratings linked to the full report, and a conclusion - nothing more. Readers may not go further, and that is acceptable if the executive summary clearly conveys risk and required actions.
AI excels at grammar, clarity, and formatting but lacks the critical thinking, intellectual curiosity, and skepticism needed to identify root causes and develop compelling findings. AI works best as a research assistant to stimulate thinking, not as a replacement for human judgment in writing reports.
Nine types of readers exist including process owners, executive management, board audit committees, regulators, and external auditors. Most are subject-matter experts unfamiliar with the audited area who want you to get to the point, clarify risk in business language, and explain what actions are needed - they don't want excessive detail.
Our reviewer’s read on each dimension, with quotes from the episode.
The episode offers practical frameworks for audit report writing (the five-element finding structure: condition, criteria, cause, effect, recommendation) and concrete advice on reader psychology and risk articulation. However, substantial portions consist of repetitive throat-clearing, mutual admiration, and re-hashing of the same core points (write for the reader, focus on risk, be concise) without introducing materially new insights after the first 8 minutes. The AI discussion is superficial.
Condition, criteria, cause, effect, recommendation. And so, you know, there's baseline principles for developing a finding.
the wire transfer function can process erroneous and illegitimate payments. That's realistic. And then you make it relevant. They process 800 payments a day that are, you know, $20,000.
The core thesis - that audit reports should be concise, risk-focused, and written for busy executives - is well-established conventional wisdom in internal audit circles, not contrarian or first-principles thinking. The five-element finding framework (condition, criteria, cause, effect, recommendation) is standard IIA doctrine. The guest's main contribution is pedagogical refinement and anecdote, not novel methodology or counterintuitive argument. The AI segment echoes mainstream skepticism without original analysis.
write for the reader versus writing for the auditor. That's number one.
Condition is always opposite the criteria. Recommendation always addresses the cause.
Margie Bastola brings legitimate practitioner credentials: decades in internal audit at Deloitte and banking, senior roles at the IIA, published author (2023 book), and active client work with Fortune 500 and international agencies. She has domain expertise and has clearly trained thousands of auditors. However, she is now primarily a consultant and trainer rather than a current operator running audit at scale, which limits fresh operational perspective. The host, Richard Chambers, is similarly positioned as a thought leader rather than active practitioner.
I started off as like most accounting majors do. I went to work for one of the big firms, Deloitte. Spent a couple years there. Didn't like that as much as I did internal audit when I moved into banking
I published a book called Clarity Impact Speed, Delivering Audit Reports That Matter.
The episode includes one concrete business example (wire transfer processing 800 payments a day at $20,000 each) and references to Fortune 500 clients and international agencies, but provides no metrics on outcomes, timelines, failure rates, or measurable improvements from applying the advice. No data on report turnaround time reduction, executive action rates post-reform, or audit effectiveness gains. The AI discussion lacks any quantitative assessment of current tool performance. Most claims remain illustrative rather than evidentially grounded.
They process 800 payments a day that are, you know, $20,000. That means something to that business reader.
I've had CEOs tell me, look, my attention span in these audit reports is usually two pages.
The host asks clear opening questions and follow-ups that guide the conversation logically (career trajectory, common mistakes, how to write for readers, root cause identification, AI, five-year outlook). However, questions are largely softball and inviting; there is no genuine pushback, disagreement, or sharp challenge to the guest's claims. The host validates enthusiastically but does not probe ambiguity, test assumptions, or ask uncomfortable clarifying questions. Follow-ups are polite extensions rather than rigorous probes.
Margie, I first met you when I came to the IIA almost 25 years ago. We had some great experiences over those years.
What do you do to make a report more convincing?
Computed from the transcript - who did the talking, and the words that came up most.
Richard Chambers interviews Margie Bastolla, an audit report - writing expert, trainer, and author, on effective audit reporting. They examine common reporting errors, including unclear effect statements and weak root-cause analysis, and discuss practical techniques to write reports that resonate with high-level readers. Margie also discusses the role of AI as a research assistant, the importance of critical thinking, and trends toward shorter, more visual reporting that still prioritize a clear message.
Transcribed and scored by The B2B Podcast Index.
Hello, I'm Richard Chambers, the Senior Advisor of Risk and Audit for Audit Board, and welcome to another in my continuing podcast series, Speaking of Risk and Audit. I'm joined today by an old friend, Margie Bastola. She's a trainer and a consultant who helps internal audit and compliance departments write clear, impactful reports, reduce excessive rewriting of reports, and quicken report issuance. Margie's clients include Fortune 500 companies and the international agencies, the U.
S. Military, and many private and public sector organizations globally. Margie, welcome to the show. It's great to have you on with me.
Thank you, Richard. It's good to be back. Margie, I first met you when I came to the IIA almost 25 years ago. We had some great experiences over those years.
I got to know you. I got to know all the great capability that you brought to the IIA, but you had been an internal auditor before that. Maybe you could... Help our audience understand a little bit of your career trajectory.
Sure, sure. Richard, I started off as like most accounting majors do. I went to work for one of the big firms, Deloitte. Spent a couple years there.
Didn't like that as much as I did internal audit when I moved into banking and did that for a few years. And then finally, some opportunities rose at IIA headquarters. They needed a trainer. And I traveled with the seminar team that run around the country and around the world, putting on workshops every other week.
So I did that for a while. And then I moved into different roles, including advocacy at the IIA. And then I oversaw the research foundation in the publishing department. Then recently, about 10 years ago, not recently, but 10 years ago, I went to work for myself.
I went back to the classroom, which is my favorite place to be. Yeah. And you're so effective there, too. And you know, you recently published a book on audit reporting for the IIA, I believe, right?
I did. In 2023, I published a book called Clarity Impact Speed, Delivering Audit Reports That Matter. And those are the key attributes that I think are so important for us at the end of the day. So it was a challenge, but it was well worth it.
You and I have, I think, been very aligned over the years about. Importance for audit reports being timely. I think I have a chapter in one of my books titled Better Never Than Late. I don't know that that's always true, but it can be if you miss the opportunity.
But let me ask you more broadly, what are some of the mistakes that internal audit departments and internal auditors commonly make when it comes to reporting? Sure. Well, there are a couple real biggies. First, I think there's a tendency to write for the auditor versus writing for the reader.
That's number one. And then the second biggest mistake is that they write a wordy, unconvincing reports instead of concise and compelling reports. So you've got to write for the reader and you've got to make your reports compelling. And oftentimes we miss the mark.
You know, I've worked with literally thousands of internal auditors over the course of my career. And I think there's always a segment of them that I feel like they feel like they're getting paid by the word. Yeah. And so they would never say in a hundred words what they could say in a thousand words, right?
That's so true. And yet, what does that do to the reader? Yeah, the reader. You know, if you think about who your readers are, these are busy people.
They're either running a function or department. They're an executive. They're some sort of external reader that sits on a board. And they don't care about all of that.
They want you to get to the point. They're busy people who really like to know what's the problem, where are the risks, and are they being handled? They don't want all the extra things that auditors tend to put in those reports. So talk a little more about that.
How do you write for the reader? In my book, and I cover this in my workshops as well, there are nine different types of report readers. If you think about it, there's the process owner and their boss. And they generally like a lot of detail, right?
Yeah, they do. There's the process owner, their boss, there's executive management, there's the board and audit committee, there's external auditors, regulators, there's many. And the fact is, most of those people that read that report, they're what I call experts, but they are unfamiliar with the area that we just audited, and they don't want to become that familiar. That, you know, when you think about an expert who's unfamiliar, what do they want?
As I said, they want you to get to the point. They want you to clarify the risk. They want you to use common, everyday business language that resonates with them. I've had CEOs tell me, look, my attention span in these audit reports is usually two pages.
So what do you do to keep the attention of somebody like that if you feel like you got to use 10 pages to tell the story? Yeah. I think that the struggle is that if we focused on that reader wanting to understand the risk and what actions need to be taken to mitigate that risk, we change what we put in there. And I see one of the biggest weaknesses, and I see this in virtually every audit department that I've worked with, some very solid audit departments, they tend to jump over the risk.
They jump over that effect statement. And it's kind of unusual because if you think about it, we're risk experts. We plan our annual plan or ongoing plan based on risk. The audit itself is based on risk, the test steps.
But when I get to the finding, where's the risk? It's a real, it's missing. It's in most reports. I don't see it.
What is your, what's your view on an executive summary? If you've got a reader like that, who just doesn't have a long attention span. That executive summary really is only as good as those findings that are beneath it. And if you haven't clarified the risk, it's really hard to elevate that message.
So, but if you think about that executive summary, what do people want? A crisp, dotted objective, you know, why were you in there? You know, a crisp scope statement. They want to know basically what are the key findings that you had and that they want a conclusion.
it. And then one of those key findings, if you put a rating, you know, make sure that you can link it back to somewhere in the report, but they don't want anything else. They may not read any further and that's okay. So Margie, talk about the reports that are unconvincing.
I mean, how do you make a report convincing and compelling so that it elicits action? Because at the end of the day, if all we do is put out a report and nobody does anything about it, I liken that to the tree that falls in the forest when there's nobody around, it doesn't get heard. What do you do to make a report more convincing? Again, it's all about the risk.
There's a tendency for us to speak in ambiguous terms when it comes to that risk statement. We'll say things like the effect is that assets are properly safeguarded. Well, does that tell the executive anything new? Nothing.
I had worked with a client one time in banking that every effect for every finding was increased regulatory scrutiny. You're in banking, right? There's always going to be increased regulatory scrutiny. But I want you to tell me, what's the business issue?
You know, how does it affect the business operationally? When I understand that, then I'm going to get you. People, you know, they'll say things like, an example, the company's financial assets are not properly safeguarded and could be misappropriated. Well, that's ambiguous.
But if you want to make it mean something to the reader, you would say something like the wire transfer function can process erroneous and illegitimate payments. That's realistic. And then you make it relevant. They process 800 payments a day that are, you know, $20,000.
That means something to that business reader. They say, oh, we got to fix this. So we're just two generic issues. So why do auditors struggle, internal auditors struggle with writing findings?
Because I've found that to be true all the way throughout my career. I think we have to really think of writing findings as primarily a thinking process. It's a problem-solving process. Condition, criteria, cause, effect, recommendation.
And so, you know, there's baseline principles for developing a finding. you have to put information in the right bucket. As if you were to solve a problem, you have to state what the problem is. And people have more, they struggle more with writing the condition than any other element.
You know, a problem well-defined is a problem half-solved. So you've got to get that condition right because everything else flows. So I think so much of it is. They are missing some of the baseline principles.
Each component is distinct from the other, but interrelated. Condition is always opposite the criteria. Recommendation always addresses the cause. So those kind of things impact how well they do.
What I find in the classroom is we do a lot of very intensive exercises, and you have to put up a finding on the screen like seven, eight times, And about the eighth time, it starts clicking in their brain. They start seeing something's in the wrong place. You're not really solving the problem. Right.
You know, what I've found, too, is, you know. Sometimes people like writing the condition or the, you know, the describing what was broken more than they like trying to figure out how did it happen, that root cause. Because if you don't know what the root cause is, it's awful hard to give some recommendations on how to fix it. So what advice do you give on being able to identify and then articulate a root cause?
Well, I think first, again, to come up with that root cause, you've got to clearly define what the problem is and then the criteria you're judging it against, condition criteria, and then keep asking, but why, but why, but why, and get to both what I call surrounding causes that contributed to it, but what's the real reason that it's going on? And I think people have to be willing to dig enough and sometimes ask the questions that are a little bit more uncomfortable, But those are the very things that need to be solved so that the problem goes away.
So we can't be afraid to ask about the cause because think about it. If you don't come up with a cause, your recommendation only says, well, don't do that again. You don't solve a problem. And so you just become a reporter of problems, not a solver.
It becomes an inspection report, not an audit report, right? Absolutely. So, you know, there's a lot of buzz right now about the power of AI to write audit reports, you know, that, hey, if you give it all the information from your audit, it'll write you a brilliant report. What's your early assessment of that?
My early assessment is it's great with grammar. Okay. Clarity, conciseness, those kinds of things, but it's not very good at thinking it through. It's not, I've not seen it yet.
Maybe it's going to catch up, but I don't see it. Well, it's that intellectual curiosity, critical thinking, skepticism. Those what I call super powers, human superpowers that it's not, it doesn't have. And you've got to have that at the table when you're writing.
Yeah, you too. You know, when this really became AI, I really started seeing a lot of it, I started thinking, well, gosh, maybe I'm just going to retire early because I'm not going to have a job anymore. But I don't think so. Okay.
I've learned over the last couple years that it doesn't. Do what we'd hope it to do. You've still got to give a lot to it. And I've even worked with tech companies that told me, Margie, you don't have to worry.
So if they're hiring me, it's still a problem with the... Absolutely. And what I'm hearing increasingly, and I see it even from the use that I make of AI, is that it all comes down to the prompts. If you can't prompt AI to take the data or the information you give it and tell a story, then it's on its own, right?
You know, it's really going to take hands-on. We're going to have to be pushing the buttons and levers in the era of machines, I believe. I think so, too. You know, you've got to ask it the right questions.
And that can help. It can generate some answers. But, you know, I think we need to think about it more ourselves. I found myself sometimes trying to, I think I'm taking an easy road out by just saying, oh, let's see what AI does.
And then it gives me a bunch of information. Oh, I like this. And then it starts becoming more effort than what I probably would have put into it had I just kind of sat there and focused for a while. I don't know if you've experienced that.
I absolutely have. I call AI my research assistant, right? I'll let it help me come up with ideas, but I will not let AI write the report or write the blog or write the, I just, I use it in that to stimulate my thinking, but it's my thinking that has to be the message that comes through to the reader. Absolutely.
I agree with you. So we're at a very interesting time. Some call it an inflection point. Some call it a crossroads.
All the cliches are in play. If you're looking out five years, what do you see that might be different in the way internal audit is reporting results? Anything that. That you say, hey, I think that might change or might get better or whatever?
I think I have seen over the years the messaging getting tighter. We're starting to leave out more of the detail. We're still not good at elevating the message. We still need to work on that.
But I do think we're moving in the right direction. I see more visuals used, but I see a lot of bad visuals. And so, you know, I think what we need to do is to really focus on And, you know, how do you create a visual and what message needs to be attached to that visual? You still need words, Sarah Bell, right?
And so I do think we're going to see reports that continue to be shorter with more visuals. But again, I always tell people I'd rather just have a paragraph in a simple Word document than something with lots of bells and whistles if it's not well thought out. And there's too much sometimes because we have all this desktop software and we can make things beautiful. I always tell them pretty reports are pretty, but, you know, you can take a pretty report and say, I still don't get what it's trying to say.
So don't focus as much time on making it pretty as you do on getting the message right. Such great advice, Margie. Listen, thank you so much for joining me and for sharing your vision for reporting. Your report is great.
I think I contributed a forward to it. There are only a couple of folks in the world, I think, who are go-to resources for audit reporting, and you're certainly top of that list. Well, thank you, Richard. I appreciate that.
So thank you again for joining us and to our audience. Thank you for joining us for another episode of Speaking of Risk and Audit. I'm Richard Chambers for Audit Board.
Agentic AI Rewrites SOX Testing66 / 100
AI and the Future of Internal Audit74 / 100
Auditing in the Age of AI: Risks, Rewards, and Practical Steps80 / 100
Governing AI at Speed: Policies, Processes & People78 / 100
Optro Unveiled: Rebranding for an AI-Driven GRC future51 / 100