An Active Voice in Internal Audit Reports Inspires Action

One of the complaints we hear most from internal auditors — and their clients — across the world is that lengthy reports often don’t prompt action. During our practitioner days, we were often disappointed when internal audit reports we labored long and hard to craft often landed with a deafening silence. It wasn’t that the client didn’t agree with our conclusions. It was often a case that the passive nature of the report failed to inspire action. 

Through delivering training to internal audit teams across the world, Sara has seen both entrenched habits and a desire for change. How can we approach reporting differently, by focusing on something that puts the spotlight on action? In this piece, we will share how you can master a surprising writing trick that makes reports clear, credible, and compelling — shifting from passive to active voice. 

Demystifying Active vs. Passive Voice: A Practical Approach 

We’ve all experienced the disappointment of no one following up on important observations. It’s all too easy to blame first-line managers for not leaping into action — but what if it wasn’t clear they were meant to? What if your recommendation stated that, “The server should be upgraded,” “The process should be documented, approved, and communicated,” or something similar?

This passive phrasing will be familiar to many internal auditors and indeed many corporate communicators. Mistakes are made, but lessons are learned. Steps are taken and investigations are launched. Controls haven’t been performed, but improvements will be made. If you feel less than persuaded by this kind of wording, you’re not alone!

The key here is understanding the difference between active voice and passive voice. Rather than getting bogged down in terms that drove us crazy during our college writing courses such as “subject” and “object,” let’s use an easier, more practical approach.

An active sentence starts with the doer. It then features the action, then person or thing on the receiving end of the action (the “done-to,” if you like). For example:

• Active voice: “The manager [doer] reviews [action] the report [done-to].” 

A passive-voice sentence flips things around, so that you start with the done-to, then see the action… then you may or may not discover who the doer is. For example:

• Passive voice: “The report [done-to] is being reviewed [action] by the manager [doer].”

You’re even likelier to see this kind of sentence without the doer: “The report is being reviewed.”

One fun way to spot passive voice is to see if you can add phrases such as “by zombies” or “by kittens” to them. If you can, then they’re usually (but not always) passive.

• The report is being reviewed by kittens.
•  Mistakes were made, but lessons were learned, by zombies.
• This article was written by a zombie and a kitten. (Rhyming unintentional.)

Communications with lots of passive-voice sentences do not inform; they confuse. In many cases, they may come across as evasive or woolly, and they are almost always longer. Reports are the window into our engagement work. If they are not clear, readers may suspect our work is lacking, or our analysis less than rigorous. In any event, they are less likely to be inspired to action!

A good rule of thumb is that 80-85% of writing (in English) should be in the active voice. Any less risks confusing or alienating the reader. People who have something to hide, after all, often use the passive, which is why George Orwell listed it among his “swindles and perversions” of language! If that puts you off ever using the passive, think of good reasons to use it. Perhaps it’s clear from the context who the doer is, or the doer is irrelevant, or even unknown. All these are good reasons to use the passive. Bad reasons to use the passive include thinking it sounds impressive or using it to hide gaps in knowledge.

The Perils of the Passive Voice: An Example

As a QA reviewer in an internal audit function, Sara often came across observations couched in the passive voice: “X control is not performed.” You may think this was merely a stylistic choice. However, every time Sara asked the internal auditor which team, area, or department wasn’t performing the control, there was a silence.

This was worrying. After all, if the internal auditor who tested the control and wrote the observation doesn’t know who the control owner is, then the report will be on shaky ground.

One of the first things we all do in an assurance engagement is to create a risk and control evaluation or assessment document. What are the risks? What are the known or expected controls? And what is our assessment of the adequacy of those controls? To come to that conclusion, we must know where the control sits and which area of the business is responsible for it. If we can’t answer that question even within the internal audit team, then we’re in trouble.

Here is a practical example of confusion arising from passive voice in a (real-life) finding:

•  “The IT support team does not adhere to Control A. Controls B and C are not adhered to, either.”

Here we have one active sentence followed by one passive sentence. Most people, on first reading this text, come to the same conclusion: that it is the IT support team that does not adhere to controls B and C, as well as A. After all, only the IT support team is mentioned, which makes it reasonable to assume from context that it is the doer.

As Sara discovered when discussing this finding with the team who produced it, the reality was different. A second team was responsible for control B; a third team, for control C. Yet using the passive in the second sentence had obscured this crucial information. Crucial, because we need to know where problems exist before analyzing root cause. If, as many people assume, the IT support team is failing with all three controls, does this point to a problem within the team? It could be a problem with recruitment, training, communications, management, or all of the above.

As Sara has noted in her book Radical Reporting: Writing Better Audit, Risk, Compliance, and Information Security Reports: “Taking the easy option of using passive voice is understandable, but risky and potentially unethical. Overusing the passive is the perfect way to obscure any gaps or assumptions in your fieldwork or research, as well as to hinder the organization in actually understanding and addressing problems. This is exactly why the passive voice is the go-to structure for anyone who wants to dodge responsibility.” 

If however, we discover that three distinct teams aren’t adhering to related controls, then perhaps the root cause is different. It could be unclear roles and responsibilities (which could lead us to question governance). It could be that the three teams are using incompatible systems, or that they haven’t received updated guidance. The root cause is likely different, but that may not occur to us if passive-voice wording has obscured the actual situation.

This can lead to far more serious consequences than many think. In his article “Fines Against Internal Auditors Raise Serious Questions,” Richard Chambers examined the U.S. Office of the Comptroller of the Currency’s findings against three Wells Fargo executives, including the chief audit executive (CAE). The judge in the case specified that the CAE had failed, “to timely identify the root cause of team member sales practices misconduct.” If unclear communication can obscure the facts of findings, then situations like this can arise. It is also clear that writing more clearly gives everyone in the internal audit function the information they need to help the first line improve controls.

Overuse of the passive voice can also be a deliberate choice to muddy the waters and hide detail. As internal auditors, we should be alert to how others use the active and the passive voice when answering our questions or describing controls. If a manager describes a process entirely in the passive voice, it could be out of habit. But this habit can provide handy cover for uncertainty — maybe the manager signs off on the process, but doesn’t know exactly who does what at which stage. If this is the case, we need to know.

Active, Not Accusing: Using the Active Voice to Identify Responsibility

We believe that we should challenge ourselves, as internal auditors, to document all our audit fieldwork in the active voice. Again, if we can’t, we must ask ourselves why. Is there a gap in our understanding? Are roles and responsibilities unclear? It cannot be the case we default to the passive voice and allow it to cover up misunderstandings and flaws in our own work.

Using the active voice, however, forces us to state clearly who does and doesn’t do what. It reflects solid fieldwork and analysis, rather than assumptions. “The outwards payments team does not seek managers’ approvals for amounts over $5,000.00.” “Managers do not review monthly which staff have access to this system.” “The project board did not approve the business case before work started.” Note that in all these examples of the active voice, we do not name individuals or even individual roles — the focus is on where responsibility generally sits, not pointing the finger at a specific individual.

This brings us to a common objection when we recommend favoring active over passive voice. “But won’t it just make our readers hate us even more?” Well, we could be flippant and say that if you want to be loved, sell puppies. But the truth lies elsewhere. We — in common with most assurance functions — are usually delivering unwelcome news. It’s normal to try to soften the blow and reduce friction.

Sara has seen many internal audit functions attempt to justify over-using the passive voice by claiming that it makes first-line managers more willing to accept findings. If this were true, then there would be a trade-off: the internal audit report would be unclear and wordy, but at least the first line would accept and promptly address the findings. Yet when Sara asked the teams if this happened, the answer was always no. “They just kick off about something else.”

Diluting the clarity of your writing and thereby reducing the value of your report is never going to help the organization improve. Clearly stating the facts, on the other hand, should promote constructive, substantive dialogue.

This is often the case even in cultures, whether national or regional, that favor less direct communication styles. However, clouding your message won’t help. Treating readers as adults, as colleagues we respect professionally, means stating clearly what we have found. It doesn’t mean making it personal — simply not shying away from the facts.

Active Voice Inspiring Action: An Example

A compelling example of using clear, direct language — including the active voice — in a culture reputed for its politeness and diplomacy comes from Japan. The National Diet of Japan published its official report of the Fukushima Nuclear Accident Independent Investigation Commission in 2012. Its conclusion (effectively its executive summary) starts with the following statement, stark in its frankness and clarity.

The TEPCO Fukushima Nuclear Power Plant accident was the result of collusion between the government, the regulators and TEPCO, and the lack of governance by said parties. They effectively betrayed the nation’s right to be safe from nuclear accidents. Therefore, we conclude that the accident was clearly “manmade.” We believe that the root causes were the organizational and regulatory systems that supported faulty rationales for decisions and actions, rather than issues relating to the competency of any specific individual.

The active voice doesn’t just boost confidence and credibility; it is crucial to plain language. The Plain Language Association International states, “A communication is in plain language if its wording, structure, and design are so clear that the intended audience can easily find what they need, understand what they find, and use that information.” And isn’t this what we want to do when communicating results? 

Plain language — including favoring the active voice — is also more accessible. Clear, simple, short sentences appeal to everyone. They also help achieve accessible written communications, which keep organizations on the right side of disability discrimination law!

As internal auditors, we are often risk averse. We love safety blankets, such as lists of dos and don’ts, but language doesn’t work like that. We must review and analyze rigorously from the start of each engagement, then find the clearest, simplest ways of communicating our conclusions. The active voice will help us in this.

We’re not saying this is easy — simply essential. Internal auditors must be courageous when serving their organizations. Courage isn’t just limited to “pushing against closed doors,” or “sailing toward the storms.” We must also be courageous to tell it like it is when our work is done. Writing in the active voice often requires courage. But more importantly, it is often the call to action that our clients need to hear. Clarity and courage should be at the heart of our work.