© 2014 McGladrey LLP. All Rights Reserved. February 20, : Your Year to Become a Better Writer

© 2014 McGladrey LLP. All Rights Reserved. Presenters 1 Shalene Jacobson Director, Risk Advisory Services McGladrey LLP Dallas, Texas Jana Larsen Manager, Risk Advisory Services McGladrey LLP Denver, Colorado

© 2014 McGladrey LLP. All Rights Reserved. 2 The Importance of Business Writing Communication within the business environment Takes the form of , memos, reports, executive summaries, etc. Addresses fellow professionals Including clients, management and regulatory agencies Represents you and your company “Hello Mr. Doe, I have completed the accounting report you requested. Thank you” “”Hey man! i finished writing the report u asked me 2 do. thx” Today’s Objective This presentation should help you to: Anticipate readers’ questions Effectively communicate findings Prioritize what Audit Committees should focus on Overview

© 2014 McGladrey LLP. All Rights Reserved. Report Basics 3 Your audience determines how you write: Who are the readers of the report? What do they know prior to reading the report? Avoid boring your audience Avoid (or include) background, definitions and other information they know (or need to know) Anticipate questions or objections Define takeaways and what you want them to know after reading the report IIA standard 2420 states that communications must be: Accurate Clear Concise Constructive Complete Timely Your purpose will determine the message: Goals (purpose) should be clear Each section within the report should have its own goal Introduction Executive summary Scope and testing Etc.

© 2014 McGladrey LLP. All Rights Reserved. Language Style Avoid Subjective and Emotive writing - Slang, negative connotations, loaded words, jargon, emotional language, etc. Strive to use Objective and Unbiased writing - Facts, specific, concise and clear writing 4 “ In my opinion, the problem is…” “ Employees don’t follow policies, which…” “ Two of 30 items sampled did not…” “There are no written policies for X,Y, and Z …” “ Clearly, management doesn’t understand …” “Management reports do not include A and B, which…”

© 2014 McGladrey LLP. All Rights Reserved. Words to Avoid Just “Just” is a filler word that weakens your writing. Removing it rarely effects the meaning, but rather, tightens a sentence Really/Very Using the word "really“ and “very” are examples of writing the way you talk. It's a verbal emphasis that doesn't translate perfectly into text Perhaps/Maybe Do you want your audience to think you're uncertain about what you're saying? When you use words like "maybe" and "perhaps," uncertainty is exactly what you're communicating Ensure We can rarely ‘ensure’ anything. As auditors, we can only provide reasonable assurance. 5 All/Every We should be as specific as possible in writing our reports. Instead of using the term ‘all’, we should include population and sample sizes Things Writers use the word “things” to avoid using a clearer, more specific word that would communicate more meaning. Be specific. Don’t tell us about the 10 things, tell us about the 10 books or 10 strategies. Specificity makes for better writing Got Rather than writing a lazy word, look for clearer, more descriptive language: "I promised I would leave by noon,” I picked up a ball,” or "I woke up today," for example Think of the ways we use the word "got" in conversation: "I've got to go," "I got a ball," or "I got up this morning." Though it's fine for conversation, in writing, "got" misses valuable opportunities.

© 2014 McGladrey LLP. All Rights Reserved. Observations and Recommendations Recommendations are suggested actions based on the report findings Present a fact-based outline followed by interpretation of what you found - Provide enough analysis of the finding to support your recommendation Do more than just describe - Make it clear the significance of what you are talking about and how it relates to the recommendations - Recommendations should cover: o What needs to be done o Who needs to do it o How, when and where it needs to be done Write persuasively - Recommendations should always be written with the question, “Why should they care?” in the back of your mind 6

© 2014 McGladrey LLP. All Rights Reserved. Three Step Program 1.State the FACTS 2.Describe the RISK(S) (Why should they care?) 3.Recommend a SOLUTION to reduce/mitigate the risk 7

© 2014 McGladrey LLP. All Rights Reserved. Commons Pitfalls for Observations and Recommendations 8 Not describing the issue Not describing the risk Information overload (data dumping) Implying you tested or found items you didn’t Exaggerating the importance of a fact or finding Downplay the importance of a fact or finding

© 2014 McGladrey LLP. All Rights Reserved. Examples of Observations and Recommendations 9 Observation: While money order and cashier’s check logs are maintained, these logs are not always complete at three of five branches visited. The logs were consistently missing dual control signatures, as well as the date, customer, account information, and face amount of the item issued. Recommendation: For more accurate inventory records and to fully document the issuance of cashier’s checks and money orders in accordance with Bank policy, we recommend that the money order and cashier’s check logs be fully completed each time an instrument is issued.

© 2014 McGladrey LLP. All Rights Reserved. Examples of Observations and Recommendations 10 Observation: During our review of monetary instruments at the Main Street branch, we located a supply of loan checks that are no longer used by the branch and should no longer be in their inventory. Recommendation: For more accurate inventory and to reduce the risk of inappropriate or unauthorized use of loan checks, we recommend the Bank properly dispose of any unused monetary items from branch locations.

© 2014 McGladrey LLP. All Rights Reserved. Examples of Observations and Recommendations 11 Observation: Commission calculations are completed by manually entering figures into Excel. A second review of the Excel calculations is not completed and spreadsheet security controls are not used. Recommendation: To ensure that commission calculations are correct, we recommend that the figures entered and formulas used be reviewed by a second person. Management may also consider using spreadsheet security controls such as locking down cells with formulas in them.

© 2014 McGladrey LLP. All Rights Reserved. Examples of Observations and Recommendations 12 Observation: A formal system access review for AP Pro has not been recently performed. Recommendation: To ensure that user access to AP Pro is appropriate and provides for segregation of duties, we recommend performing a system access review as soon as possible and then on a periodic basis after that.

© 2014 McGladrey LLP. All Rights Reserved. What about management’s responses? 13

© 2014 McGladrey LLP. All Rights Reserved. Management Responses  Management’s responses sometimes present additional facts or uncover mitigating controls that we were not previously aware of. Therefore, while in draft, we are open to further discussion and updating of the report observations and recommendations if new information becomes available.  On the other hand, we attempt through conversations with process owners and in closing meetings to discuss the risks that were identified and come to an agreement that there are indeed risks (from an audit committee or company-wide perspective) and what a good solution might be for both the audit committee and for management.  It is important for management to acknowledge that there is some risk that an error or fraud is possible (by process owner or others, depending on the situation) and to present an agreeable solution to the audit committee. 14

© 2014 McGladrey LLP. All Rights Reserved. Exercise 1 – Information Overload! Refer to handout for background information and the report observation example  Remember to know your audience  Follow the 3 Step Program: - State the FACTS - Define the RISK (Why should they care?) - Recommend a SOLUTION 15

© 2014 McGladrey LLP. All Rights Reserved. Exercise 2 – Wow, you did a lot of work! Refer to handout for background information  Remember to know your audience  Communications should be: - Accurate - Clear - Concise - Constructive - Complete - Timely 16

© 2014 McGladrey LLP. All Rights Reserved. Closing Summary Communications and reports should be: - Relevant - Value added - Professional - Understandable - Action oriented Know your audience and users 3 step program: - Facts - Risks - Solutions 17

© 2014 McGladrey LLP. All Rights Reserved. Questions? 18

© 2014 McGladrey LLP. All Rights Reserved. This document contains general information, may be based on authorities that are subject to change, and is not a substitute for professional advice or services. This document does not constitute assurance, tax, consulting, business, financial, investment, legal or other professional advice, and you should consult a qualified professional advisor before taking any action based on the information herein. McGladrey LLP, its affiliates and related entities are not responsible for any loss resulting from or relating to reliance on this document by any person. McGladrey LLP is an Iowa limited liability partnership and the U.S. member firm of RSM International, a global network of independent accounting, tax and consulting firms. The member firms of RSM International collaborate to provide services to global clients, but are separate and distinct legal entities that cannot obligate each other. Each member firm is responsible only for its own acts and omissions, and not those of any other party. McGladrey ®, the McGladrey logo, the McGladrey Classic logo, The power of being understood ®, Power comes from being understood ®, and Experience the power of being understood ® are registered trademarks of McGladrey LLP. © 2014 McGladrey LLP. All Rights Reserved. McGladrey LLP th Street #1000 Denver, CO