Board writing is a different craft from audit writing, and most auditors learn that the hard way: a report that management praised arrives at the audit committee and produces three minutes of silence, a question about something on page nine, and a request for “the headline next time”. The committee was not being difficult. It was reading at a different altitude, under a different time budget, for a different purpose. This guide sets out how to write for that altitude: what boards need from a page, how to control the height of a sentence, how to remove jargon without removing precision, how to hedge in a way you can defend under questioning, and the one-page patterns that committees consistently praise. It closes with three board-memo makeovers from management-grade drafts.
It belongs to the audit report executive summary and presenting to the audit committee guides; where those cover the summary section and the spoken ten minutes, this covers the prose itself, in any document that reaches a director.
In this guide
- Altitude: the single variable that explains most board feedback
- How a director actually reads
- De-jargoning without dumbing down
- Hedging discipline: confidence you can defend
- One-page patterns boards praise
- Numbers on the page: making them usable
- Sentence-level rules
- Three makeovers from management-grade drafts
- The eight mistakes that get memos sent back
- The pre-send checklist
- Frequently asked questions
- Related guides
Altitude: the single variable that explains most board feedback
Every sentence in a governance document sits at an altitude. At ground level it describes mechanics: which control, which system, which sample. At cruising altitude it describes enterprise meaning: what is exposed, how much, whether management has it in hand, what the committee is being asked to do. Management-grade writing lives near the ground because management needs the mechanics to fix things. Board-grade writing lives high because directors need the meaning to govern. The most common failure in audit writing for boards is not length or jargon; it is altitude, with the mechanics delivered to people who wanted the meaning.
| Altitude | What the sentence is about | Who needs it | Example |
|---|---|---|---|
| Ground: mechanics | Controls, systems, samples, procedures, exceptions | Process owners, remediation teams, the audit file | Three of 25 sampled wire releases above $1 million lacked a second approver in the payment platform because the approval matrix had not been updated after the March reorganisation. |
| Mid: process meaning | Whether the process works, where it fails, why | Senior management, control owners’ bosses | Dual approval over high-value wires is not operating reliably since the reorganisation; the matrix is stale and the platform does not enforce it. |
| Cruising: enterprise meaning | Exposure, trend, management’s grip, the ask | Audit committee, board, regulators reading the pack | The bank’s primary safeguard against a large erroneous or fraudulent payment has not operated reliably for seven months; management has a fix dated 30 November; we will re-test in Q1 and the committee should expect confirmation then. |
Notice that the cruising-altitude sentence is not vaguer than the ground-level one. It contains a duration, a date and a commitment. It simply answers a different question: not “what failed” but “what does this mean for the organisation and what happens next”. Altitude control is the skill of choosing that question deliberately for each audience and then writing only the sentences that answer it, with the mechanics available one layer down for anyone who wants them. The committee pack can carry both layers; the covering memo and the first paragraph of every section must carry the high one.
A practical test: read your draft and mark every sentence G, M or C. A board memo should be mostly C with some M and no G above the fold. If the first page is mostly G, you have written a management report with a board heading on it, and the committee will respond by asking the C-level question you did not answer, usually in a tone that makes it sound like a criticism of the audit. The quarterly audit committee pack guide shows how the four questions a committee actually asks map to the sections of a pack; altitude is how you answer them on the page.
How a director actually reads
Most directors sit on several boards and receive several hundred pages per meeting. The committee chair may read the audit pack carefully; the other members read it the night before, on a tablet, after the finance committee’s pack. Their reading behaviour is predictable and it should shape the writing.
| Reading behaviour | What it means for the writer | Design response |
|---|---|---|
| Reads the first sentence of each section and decides whether to read the rest | The first sentence must carry the conclusion, not the context | Answer-first paragraphs; never open a section with background |
| Skims for numbers, dates and names | Numbers in prose are found; numbers in appendices are not | Put the three numbers that matter in the first paragraph; label them so they can be quoted |
| Reads ratings and colours before text | The rating is the message; the text is the justification | Make sure the text would lead a reader to the rating without seeing it |
| Looks for what is being asked of them | A memo without an ask is read as information and forgotten | State the decision or acknowledgement required, in one sentence, near the top |
| Compares with last quarter | Directors notice movement more than levels | Lead with change: what is new, worse, better, closed |
| Stops at the first unfamiliar acronym | One undefined term can cost the rest of the page | Define on first use or do not use; prefer the plain phrase |
| Will be asked by other directors “what did audit say?” | Your summary becomes their summary | Write the sentence you would like repeated in the boardroom |
The last behaviour is the most useful to design for. A committee member who is asked by the full board what internal audit said about the payments incident will repeat one sentence, and it will be the sentence you gave them if you wrote one worth repeating. If you did not, they will improvise, and the improvised version will be less accurate and less favourable than yours. Writing for the board is, in part, writing the sentence that will be said about your work when you are not in the room.
De-jargoning without dumbing down
Directors are not less intelligent than auditors; they are less immersed. Jargon fails with boards not because it is technical but because it is local: it encodes meaning that only people inside the audit function share. De-jargoning is translation, and good translation preserves precision. The test for every term is whether a financially literate director from a different industry would understand it on first reading without a footnote.
| Audit term | What the director hears | Board-grade replacement | Precision kept? |
|---|---|---|---|
| Control deficiency | Something minor, probably paperwork | A safeguard that is not working | Yes; add severity in the next clause |
| Design vs operating effectiveness | Nothing, or an argument about semantics | “The control was never built to catch this” vs “the control exists but was not performed” | Yes, and the distinction becomes useful to them |
| Management review control | A manager looked at something | The monthly review by the controller that is meant to catch errors above $250,000 | Yes; the threshold is the precision |
| Sample of 25 with 3 exceptions | A statistic they cannot evaluate | “In a sample of 25, 3 failed; applied to the year’s 1,200 high-value wires, that is roughly 140 payments that left without a second approver” | Improved; the extrapolation is what they needed |
| Remediation | Something is being done | The fix, its owner and its date | Yes, and it becomes trackable |
| Root cause | Blame | Why it happened and whether it will happen again | Yes |
| Issue validation | Audit checking its own work | We confirmed the fix works by re-testing it | Yes; the issue validation standard underneath is unchanged |
| Reasonable assurance | A disclaimer | We are confident, not certain; here is what would change our view | Yes, and it invites the right question |
| Entity-level controls | Nothing | The controls that operate across the whole company: tone, oversight, hiring, monitoring | Yes |
| Material weakness | Serious, but what does it mean for us? | The external auditor will have to disclose it, the share price may react, and the CFO’s certification is in question | Yes; the consequence is the meaning |
Two rules make the translation reliable. First, replace a category word with the specific instance: not “a control”, but “the second approval on wires over $1 million”. Specifics are shorter than jargon and more precise. Second, when a technical term must stay because it has regulatory or legal meaning (material weakness, significant deficiency, matter requiring attention), define its consequence in the same sentence. Directors do not need the definition; they need to know what follows from it. The control deficiency evaluation guide explains the categories; the board memo explains what each category costs.
What de-jargoning must not do is remove the information that made the finding true. “Some payment controls need improvement” is jargon-free and useless. “The second approval on large wires has not operated reliably since March; about 140 payments a year are affected” is jargon-free and precise. The second sentence took more work to write, which is why the first one is so common.
Hedging discipline: confidence you can defend
Auditors hedge for good reasons: evidence is sampled, conclusions are inferred, and the Standards require conclusions to be supported. Boards experience the hedging as evasion. The reconciliation is hedging discipline: say exactly how confident you are, why, and what would change your view, and then stop. A director can work with “we are confident the fix is in place; we have not yet seen it operate through a quarter-end”. A director cannot work with “it appears that the remediation may have been substantially implemented, although certain aspects remain subject to further validation”.
| Hedging pattern | Why it fails with boards | Defensible replacement |
|---|---|---|
| Stacked qualifiers (“may potentially”, “could possibly”) | Reads as the writer not knowing | One qualifier, chosen deliberately: “may” or “is likely to”, never both |
| Passive concealment (“it was noted that”) | Hides who concluded what | “We found”; “Management told us”; “The data shows” |
| Scope disclaimers in the conclusion | The conclusion disappears into caveats | State the conclusion; put the scope in one sentence afterwards: “Our testing covered head office; the acquired depots are scheduled for Q2” |
| Generic uncertainty (“there is a risk that”) | Everything is a risk; the sentence says nothing | Name the exposure and its size: “an erroneous payment of up to $4 million could leave without a second check” |
| Over-confidence (“there are no other issues”) | One counter-example destroys credibility | “We found no other exceptions in the 60 items tested; the control over the remaining population is the same, so we expect none” |
| Borrowed confidence (“management confirmed”) | Boards know management confirms things | “Management confirmed and we verified” or “Management confirmed; we have not yet verified” |
Hedging discipline has a second benefit: it survives questioning. When a director asks “how sure are you?”, the writer who hedged deliberately has already answered, and the answer is on the page. The writer who hedged by reflex has to improvise under pressure and usually over-corrects in one direction or the other. The guide to professional skepticism describes the underlying discipline; on the page it looks like a short, plain statement of confidence followed by its basis.
One-page patterns boards praise
Committees do not praise beautiful prose. They praise documents that let them do their job in the time they have. Four one-page patterns earn that praise reliably, and each suits a different purpose.
| Pattern | Use it for | Structure | Why boards like it |
|---|---|---|---|
| The four-question page | The quarterly summary of the function’s work | Are we covering the right things? What have we found? Is management fixing it? Can you rely on us? One paragraph each, numbers in the first sentence | It answers the questions they came with, in the order they ask them; see the quarterly pack guide |
| The incident memo | A single significant finding, incident or regulator matter | What happened (two sentences); what it means for the organisation; what management is doing, by when; what we will do; what we need from the committee | It separates fact, meaning and action; it ends with the ask |
| The changed/unchanged page | Updates on an open matter across meetings | Changed since last meeting; unchanged; new; our view | Directors track movement; this page is built from movement |
| The decision page | Anything that requires a committee decision (plan changes, charter, risk acceptance) | Decision required; recommendation; options with consequences; what happens if no decision | It respects that the committee decides and audit recommends |
All four patterns share three features. The conclusion is in the first sentence. The numbers that matter are on the page, not in an appendix. And the document says what it wants from the reader. The last feature is the one most often missing from audit memos, because auditors are trained to report rather than to ask; but a committee that is not asked for anything will do nothing, and later be surprised that nothing happened.
For the full-length report the same logic applies to the first page. The anatomy of an internal audit report guide describes the structures that serve every reader; the model report library shows them annotated. The board reads the first page and the ratings; everything else exists so that the first page is defensible.
Numbers on the page: making them usable
Directors read numbers before prose, so the way a number is presented decides whether it informs or confuses. Audit drafts tend to present numbers the way the workpaper recorded them: sample counts, exception counts, percentages of a sample. Boards need the same facts translated into the scale of the organisation and the direction of travel.
| Workpaper form | Why it fails on the page | Board form |
|---|---|---|
| 3 of 25 exceptions (12%) | The director cannot tell whether 12% of a sample matters | Roughly 140 of the year’s 1,200 large wires left with one approver |
| $286,412 in duplicate payments identified | Precision implies certainty the sample does not support | About $290,000 of duplicate payments found, $241,000 already recovered |
| Control operating effectiveness: not effective | A verdict without a size | The safeguard did not operate for seven months; exposure up to $4 million per payment |
| Open issues: 87 | A count without a trend or a tail | 87 open issues, up from 71; 11 rated high; the oldest is 19 months old |
| Plan completion 71% | No baseline | 71% of planned hours delivered at 75% of the year, in line with last year |
| Median closure 41 days | No standard to compare against | Issues close in 41 days on average against a 30-day standard |
Three habits make numbers board-grade. Round to the precision the evidence supports and no further; a sampled estimate presented to the dollar invites a question about the dollar. Attach a comparator to every number: last quarter, the standard, the population. And give every count a tail: the oldest, the largest, the one that would embarrass the organisation if it appeared in the press. The internal audit KPIs guide sets out thirty measures with targets, which is where the comparators come from; the severity ratings guide supplies the rule that turns a number into a rating.
Sentence-level rules
Altitude and structure do most of the work, but a page of correctly pitched, correctly structured prose can still fail at the level of the sentence. Nine rules, in rough order of how often they are broken.
- Lead with the subject that matters. “The bank’s largest payment safeguard has not operated since March” beats “Since March, following a reorganisation that changed the approval matrix, the control over…”. Directors read the first six words.
- One idea per sentence, one topic per paragraph. A board paragraph has a job; when it finishes the job, it ends.
- Numbers carry the argument. Every evaluative adjective (significant, weak, inadequate) should be followed by the number that justifies it, or replaced by it.
- Name the actor. Who found, who confirmed, who owns the fix, who decides. Passive voice in governance writing is usually hiding one of those four.
- Dates, not durations. “By 30 November” is trackable; “within the next quarter” is not.
- Cut the throat-clearing. “It should be noted that”, “In accordance with the approved plan”, “As part of our ongoing commitment” delay the sentence the reader wanted.
- Consistent vocabulary. If it is a “finding” on page one it is not an “observation” on page three. Boards read inconsistency as a change in meaning.
- Prefer the verb. “We tested” not “testing was performed”; “management disputes” not “there is a disagreement on the part of management”.
- End on the action. The last sentence of a section is remembered; make it the date, the owner or the ask, not a restatement.
These rules are the same ones the condition, impact and recommendation writing guides teach for findings. Board writing is not a different grammar; it is the same grammar applied at a higher altitude, with less tolerance for waste.
Three makeovers from management-grade drafts
The makeovers below are built from the kind of drafts that reach a CAE’s desk the week before a committee meeting. Each is accurate, well-evidenced, and wrong for the audience. The rewritten versions change altitude, not facts.
Makeover 1: a payments finding at Lakeshore Bancorp
Management-grade draft (72 words): During testing of the wire transfer approval control (WT-04), 3 of 25 sampled outgoing wires exceeding the $1,000,000 dual-authorization threshold were released without evidence of secondary approver sign-off in the payment platform. Root cause analysis indicates that the approval matrix maintained in the platform was not updated following the March 2026 treasury operations reorganization. Management has agreed to update the matrix and implement a quarterly matrix recertification. Target date: 30 November 2026.
Board-grade rewrite (66 words): The second approval on wires above $1 million, the bank’s main safeguard against a large erroneous or fraudulent payment, has not operated reliably since the March reorganisation. In a sample of 25 such wires, three left with one approver; across the year that is roughly 140 payments. The cause is an approval table that was not updated. Management will fix the table and recertify it quarterly, by 30 November; we will re-test in the first quarter. No loss has been identified.
What changed: the control got a name a director understands; the sample became an annual exposure; the cause lost its acronym; the fix kept its date; and the sentence the committee most wanted, “no loss has been identified”, was added, because the draft had assumed everyone knew it.
Makeover 2: a culture observation at Tamarack Stores
Management-grade draft: The hotline program exhibits sub-benchmark utilization (1.06 reports per 100 employees versus the NAVEX 2025 median of 1.57) and elevated anonymity (61%). Survey results indicate 54% of hourly staff in the 30 sampled stores could not identify a reporting channel. Disposition analysis of substantiated cases shows termination rates ranging from 28% to 61% across regions for comparable violations, and 6 of 212 subjects received full discretionary bonuses in the year of the violation.
Board-grade rewrite: Staff do not use the hotline much, and when they do they hide their names: reports run about a third below the benchmark and 61 percent are anonymous. Half the hourly staff we asked in 30 stores could not name a way to report a concern. When misconduct is proven, the consequence depends on the region: termination rates for the same violations range from 28 to 61 percent, and six people were paid full bonuses in the year they were disciplined. Taken together, these say the program is not trusted and not consistent. Management’s plan addresses the channels; the committee may want to ask about the consistency.
What changed: the statistics stayed, but each was given its meaning in the same sentence; the four facts were drawn into one conclusion, which the draft had left for the reader to assemble; and the memo ended by pointing the committee at the question that mattered, which is the one management’s plan had not addressed.
Makeover 3: a plan change at MidState Beverage
Management-grade draft: Following the audit committee chair’s request in June, a cybersecurity program assessment (540 hours) was added to the FY27 plan. In order to absorb the additional hours within approved capacity, the depot rotation program will be reduced from 1,000 to 640 hours and the fleet/DOT advisory engagement (300 hours) will be deferred to FY28. Management has been consulted and has no objection. The committee is requested to note the revised plan.
Board-grade rewrite: Decision required: approval of a change to the FY27 plan. We added the cybersecurity assessment the chair asked for in June (540 hours). To fund it we propose two reductions: fewer depot visits this year (640 hours instead of 1,000, so eight depots instead of twelve) and deferring the fleet compliance advisory to next year. The consequence is that four depots go two years without a visit, which we judge acceptable given the continuous monitoring now running on cash and credit memos. Management agrees. The alternative is to co-source the cyber work at about $90,000, which keeps the full depot program.
What changed: the memo now says it is a decision, names the consequence of the trade-off in operational terms a director can weigh, and offers the alternative with its price. The draft asked the committee to “note” a decision that had in effect already been taken, which is the fastest way to make a chair feel bypassed.
The eight mistakes that get memos sent back
| Mistake | How it reads to the chair | Fix |
|---|---|---|
| Background before conclusion | “Get to the point” | Conclusion in sentence one; background in an appendix or not at all |
| Mechanics above the fold | “This is for management, not for us” | Altitude check: G/M/C on every sentence; nothing G on page one |
| No ask | “What do you want from us?” | One sentence stating the decision or acknowledgement required |
| Ratings without a stated rule | “Why is this a High and that a Medium?” | State the rating rule once in the pack; the severity ratings guide gives one |
| Numbers only in appendices | “How big is this?” | Three numbers in the first paragraph of every section |
| Reflexive hedging | “Does audit actually have a view?” | One deliberate qualifier per claim, with its basis |
| New information in the meeting | “Why is this the first we hear of it?” | No surprises: anything significant goes to the chair before the pack; see the first committee meeting as CAE guide |
| Length as diligence | “Nobody read it” | A page per matter; the file holds the rest |
The pre-send checklist
Run this on any document before it reaches a director. It takes ten minutes and prevents most of the feedback above.
1. Does the first sentence of the document state the conclusion or the decision required?
2. Could a director repeat one sentence from this page accurately to the full board? Which one? Is it the one you want?
3. Mark every sentence on page one G, M or C. Is anything G? Move it down.
4. Are the three numbers that matter in the first paragraph of each section, labelled so they can be quoted?
5. Is every evaluative adjective followed by, or replaced with, a number?
6. Is every technical term either replaced by its specific instance or defined by its consequence in the same sentence?
7. Is there exactly one deliberate qualifier per claim, and is its basis stated?
8. Does every fix have an owner and a date, not a duration?
9. Does the document say what it wants from the reader?
10. Has the chair seen anything in it that would surprise them?
Board-writing pre-send checklist
The checklist is deliberately mechanical. Board-grade writing is not a talent; it is a set of decisions about altitude, structure and confidence that can be checked, and a function that checks them produces committee papers that get read, quoted and acted on. That is the entire point of writing them.
Frequently asked questions
How long should an audit committee memo be?
One page per matter, with the conclusion in the first sentence and the three numbers that matter in the first paragraph. Supporting detail belongs in an appendix or the audit file. Length is not read as diligence by directors; it is read as a failure to decide what matters.
Should I remove all technical terms from board papers?
Replace local jargon with the specific instance it refers to; keep terms that carry regulatory or legal meaning (material weakness, matter requiring attention) and define their consequence in the same sentence. The goal is translation that preserves precision, not simplification that loses it.
How do I hedge without sounding evasive?
State your confidence once, plainly, and give its basis: “We are confident the fix is in place; we have not yet seen it operate through a quarter-end.” One deliberate qualifier per claim. Stacked qualifiers and passive constructions are what directors read as evasion.
What is the most common reason board memos get sent back?
Altitude. The memo describes mechanics (controls, samples, systems) when the committee needed meaning (exposure, trend, whether management has it in hand, what is being asked). The fix is to grade every sentence on page one and move the mechanics down.
Should the memo recommend or decide?
Recommend, with options and consequences, and state clearly when a decision is required. Committees react badly to being asked to “note” a decision that has already been taken, and equally badly to memos that present information with no view.
Do these rules apply to the full audit report as well?
They apply to its first page, its executive summary and its ratings. The body of the report is management-grade by design, because management needs the mechanics. The board reads the first page and the ratings, so those must stand on their own.
Related guides
- The audit report executive summary — the one page that decides the report’s fate.
- Presenting to the audit committee — the ten spoken minutes that define your function.
- Reporting to the audit committee: the quarterly pack — the four questions a committee actually asks, and the pack that answers them.
- Your first audit committee meeting as CAE — preparation, content arc and candour.
- Anatomy of an internal audit report — structures that serve every reader.
- Finding severity ratings — the calibrated matrix and the report rating rule.
- Writing impact that lands — consequences in dollars, risk and plain sight.
- Writing audit reports with AI assistance — the workflow and the guardrails.
- The audit committee playbook — oversight from the director’s side of the table.
Leave a Reply