The Report Writing Episode

Introduction to the Guest and Topic:

Host Allie Krings introduces Megan McCormick, Team Lead of the Professional Writing Team at KirkpatrickPrice. The conversation focuses on the role of professional writers in cybersecurity audits and how effective communication helps make complex audit reports more understandable and impactful. Megan shares her background, explaining that she joined Kirkpatrick Price with a degree in English Professional Writing and no prior cybersecurity experience, eventually growing from a professional writer into a leadership role.

What Is the Professional Writing Team?:

The Professional Writing Team is responsible for transforming technical audit findings into clear, professional, and client-friendly reports. While auditors provide the technical expertise and assessment results, the writing team ensures the information is organized, accurate, polished, and understandable for a broad audience.

The team’s role is to bridge the gap between technical cybersecurity concepts and effective communication, helping clients and report readers clearly understand the state of a security program.

What Does Professional Writing Look Like Up Close?:

For Writers: Professional writers work closely with auditors, subject matter experts, and clients to understand technical information and convert it into concise, readable reports. Many writers join the team with backgrounds in English, journalism, or communications and learn cybersecurity concepts through hands-on experience and collaboration.

For Clients: Clients receive reports that are professionally formatted, grammatically polished, and tailored to their audience. The goal is to create reports that can be understood by technical teams, executives, stakeholders, and customers alike without sacrificing accuracy.

What Makes Kirkpatrick Price Reports Different?:

Kirkpatrick Price maintains a dedicated professional writing team that focuses exclusively on report quality. Templates, formatting standards, branding, and writing structures are developed internally to create consistency across reports.

The team works closely with auditors to ensure technical content remains accurate while being presented in a way that is clear, concise, and accessible. This approach helps distinguish Kirkpatrick Price reports from more traditionally structured audit reports that may focus primarily on technical content.

Why Is Good Communication Important in Cybersecurity?:

Cybersecurity and compliance information can often feel overwhelming because of the specialized terminology, frameworks, and technical concepts involved. Effective communication makes it easier for organizations to understand their security posture and the value of the audit process.

Megan explains that writers bring a unique perspective because they initially encounter cybersecurity information with fresh eyes. This allows them to identify confusing language and help translate technical concepts into understandable business communication.

What Are the Biggest Challenges in Writing Audit Reports?:

One of the biggest challenges is balancing technical accuracy with readability. Reports must remain detailed enough to accurately reflect audit findings while avoiding unnecessary complexity.

Another challenge is determining which information is essential and which details can be streamlined. Writers must evaluate large amounts of auditor notes and supporting information, identifying the most important elements while removing unnecessary content.

Why Can’t AI Fully Replace Professional Writers?:

While AI can assist with drafting and content generation, Megan notes that AI struggles to consistently distinguish between critical details and less important information. Effective writing requires judgment, context, and understanding the audience.

Professional writers evaluate every section of a report, deciding what information is necessary, what should be emphasized, and how content should be organized. This human judgment helps ensure reports remain meaningful and easy to consume.

How Do New Writers Learn Cybersecurity?:

Most writers join the organization without prior cybersecurity experience. Through training, collaboration with auditors, and hands-on exposure to audit engagements, they gradually build expertise in cybersecurity, governance, risk, and compliance.

The writing team fosters a culture of continuous learning, encouraging writers to ask questions, take professional risks, and develop confidence working with unfamiliar technical concepts.

What Traits Make Someone Successful on the Professional Writing Team?:

Successful writers demonstrate strong communication skills, curiosity, and a willingness to learn. They must be comfortable working independently while also collaborating with auditors and subject matter experts.

Megan highlights several key traits, including intrinsic motivation, attention to detail, comfort with learning new concepts, confidence in asking questions, strong accountability, and adaptability. These qualities help writers grow quickly and effectively contribute to client-facing work.

How Do Auditors and Writers Work Together?:

The writing team and audit teams work closely throughout the reporting process. Auditors provide technical expertise while writers refine the presentation of that information.

This collaboration creates an environment where writers can continually expand their cybersecurity knowledge, while auditors benefit from having their findings communicated clearly and professionally.

How Is the Professional Writing Team Evolving?:

As organizations face increasing compliance obligations across multiple frameworks, the writing team has expanded its role beyond traditional report development.

The team now helps clients consolidate compliance requirements across frameworks such as SOC 2, ISO 27001, HIPAA, and PCI DSS. Because many frameworks contain overlapping requirements, the team helps organizations create unified control libraries that reduce duplication and simplify audit preparation.

How Does Compliance Consolidation Help Clients?:

Many organizations spend significant time responding to audits across multiple frameworks. Often, the same evidence, controls, and documentation are requested repeatedly.

By helping clients consolidate controls and align requirements across frameworks, the writing team can significantly reduce audit fatigue. Instead of preparing separately for multiple audits, organizations can leverage a single control structure to support numerous compliance efforts.

Does Client Size Impact Report Quality?:

Megan emphasizes that every client receives the same level of care and attention regardless of size.

Whether the client is a small organization with a narrow scope or a global enterprise operating across multiple business units, the objective remains the same: deliver a high-quality report that clearly communicates the organization’s security posture and compliance efforts.

What Is the Future of Professional Writing?:

Despite advances in AI and automation, Megan believes professional writing will remain an essential skill. Organizations will always need effective communicators who can evaluate information, understand context, and tailor messages for specific audiences.

While AI may assist with certain writing tasks, the ability to clearly communicate complex information remains a uniquely human skill. As cybersecurity and compliance become increasingly complex, the demand for strong communicators will continue to grow.

How Can Companies Ensure Compliance?:

Compliance begins with clear communication. Organizations must be able to document their controls, explain their security practices, and present information in a way that stakeholders can understand.

Professional writing plays a critical role in this process by ensuring technical findings are translated into meaningful, actionable information. By combining technical expertise with effective communication, organizations can better demonstrate compliance, build trust, and provide assurance to customers and stakeholders.

Final Thoughts:

Megan emphasizes that great communication is just as important as technical expertise. While cybersecurity professionals identify risks and evaluate controls, professional writers ensure that work is communicated effectively to the people who rely on it.

By combining technical knowledge with strong communication practices, organizations can transform difficult audit experiences into valuable opportunities for learning, improvement, and assurance.