Internal audit results - what do you report?

I'm going to post this under the audit sub-forum:

I was going through the agenda of an organization's Management Review and I was stuck by the fact that the FIRST thing discussed was the results of internal audits. I then concluded that I'd never seen internal audit results reported in a manner which management truly understand what they mean.

How does your organization treat the results of your internal audits? What do management get from that report out?

 

How does that summary support leadership's ability to...well...lead? Why should they care about the number of audits or if people fixed stuff on time?

When the forecast says there is an 80% of rain, we all instinctively know to dress appropriately, pack an umbrella, that sort of thing.

When you tell your leadership "Process AAA had 80% of our findings this year", what should they do? What does that statement mean? Why should they feel concerned?...or should they feel concerned at all?

The trick to management review and any audit report outs is, in my opinion, to make the recipient actually care about what needs to be cared about. If all I hear is "75% of our audit findings were people not following the documented procedures", big deal. What risk/impact/effect can that have on the organization? Put it in terms of the need to rework or dispose of nonconforming product...or loss of market share if you lose certification...or poorly trained staff because they're being trained on documents that don't reflect the actual process...

It's easy to say that as leadership, they should know to make that leap. Let's be realistic...that ain't gonna happen and especially not if they entered that room with the mindset that the meeting is simply a box to be checked off for that piece of paper on the wall.

The first time I went through this kind of exercise, I tried to show how the audit findings could have a negative impact on the organization's objectives. These were their objectives and the findings had the potential to hold us back in achieving them. Rank the findings - risk of impact, frequency, sort of sounds likes a mini-FMEA (but the numbers could help prioritize how the findings are addressed).

They may not agree with what you say the possible risks/impacts/effects are, but now you're having a conversation about the audit results, not the audit logistics.