What an internal audit report contains
You get the objectives and scope, the findings with their significance and priority, our conclusion, and an action plan naming who is responsible and by when.
500+
audit and attestation engagements
AICPA
peer-reviewed firm
16+
years auditing experience
Who reads the report
Your board or audit committee reads it for assurance. The process owner reads it to find out what has to change. An external auditor may read it when planning their own work, and a buyer may ask for it during diligence.
We separate the summary from the findings so each reader can go straight to the detail they need. A director gets the conclusion and the high-rated findings. The process owner gets the finding on their own control.
Internal audit report format
We open with an executive summary: the conclusion and the high-rated findings. We set out objectives and scope next, including any limitations on the work. We put the findings after that, each with its significance and priority. We close with the action plan, naming the individuals responsible for addressing each finding and the planned date for completing the work.
Executive summary
The conclusion and the significant findings
Objectives and scope
What the work covered, and any limitations
Findings
Criteria, condition, root cause, effect and priority
Action plan
The agreed action, who is responsible, the date
What goes into each internal audit finding
We write each finding in six parts. Under Standard 14.3 of the Global Internal Audit Standards, internal auditors must prioritize each finding by significance and identify root causes with management where that is possible. Under Standard 15.1 they must specify who is responsible for addressing each finding and the planned date for completing the action. Internal audit functions that adopt those standards must follow them; we use the same order so your managers can act on the report:
Criteria
The policy, standard or contract term we evaluate the process against.
Condition
What we found when we tested it.
Root cause
Why the gap exists, where we can identify it from the evidence.
Effect and priority
The risk or cost of the gap, quantified where we have the numbers, and how urgently you should act.
Recommendation or action plan
What should change, specific enough for somebody to act on.
Owner and date
Who is responsible for the action and when it should be complete.
How we rate internal audit findings
We rate each finding at one of three levels, and we list the high-rated findings first in the executive summary.
High
The control is missing, or your team did not perform it in the sample we tested, and the company could suffer a loss, a compliance breach or a misstatement. Your managers act on it before the next reporting date.
Medium
Your team performs the control with exceptions, and could miss an error at this step until a later review. Your managers fix it by the date in the action plan.
Low
Your team performs the control as designed, and the finding is a documentation or housekeeping point. Your managers fix it when they next revise the process.
An internal audit report example, one finding written out
Illustrative only: the policy, the sample size and the results are fictional.
- Criteria
- The company requires two approvals on an invoice above the authority limit.
- Condition
- We tested forty invoices above that limit and found twelve paid with one approval.
- Root cause
- Approvers must sign in sequence, and staff work around the sequence when an approver travels.
- Effect and priority
- The company paid twelve invoices without the second approval it requires, and we rate it High.
- Action plan
- Allow parallel approval and name a standing delegate for each approver.
- Owner and date
- The controller, by the end of the quarter.
Why we do not send a blank internal audit report template
You can download a blank template in a minute. You still have to decide which control mattered in your business, which standard applied to it and what the gap cost. We get those answers from testing.
We set out the structure and write the report from the work itself. A team that fills in a template without testing produces weak findings and wastes the money spent on the report.
How to write an internal audit finding
Say what you tested and the sample size, so the reader can judge how much weight to give the finding.
Write the cause as a process problem where your testing shows one, and name the weak routing, threshold or approval design instead of blaming a person.
Say plainly where the numbers do not exist, so the reader does not take an unquantified effect as a quantified one.
Want the audit as well as the report
Sometimes a client will think that there has to be somebody that knows. There's cases where nobody knows the answer exactly. There's multiple levels of court for that reason, because not everything's spelled out. Sometimes you just have to use your best judgment.
The team impressed us with their professionalism, attention to detail, and thorough approach. They took the time to understand the business and provided clear insights that went beyond the typical audit findings.
How we set the cost of an internal audit report
We set the fee on four things:
Processes in scope
We charge less for one process than for five.
Transactions tested
We size samples to the volume you run through each control.
Systems and locations
We add hours for each system or site we pull evidence from.
Who does the testing
We charge less to write up results your team has tested than to test from scratch.
Related services
- Internal audit services
- SOX compliance audits
- Financial statement audits
- Forensic audits
- Internal audit outsourcing
Treat the information as general, not advice for your circumstances. Ask a CPA to look at your own control environment before you rely on any of it.
Ask us to write your report
Tell us what you need reviewed and who will read the result. We come back with a scope, a price and the format we will deliver against.
Contact
Connect with Dimov Audit
Our dedicated team is ready to assist you on your path to financial success.
24 Mercer St, 2nd Floor, Suite 214
New York, NY 10013
United States
Reviewed by George Dimov, CPA. Dimov Audit writes internal audit reports for boards, owners and process leads across all 50 states. George brings 20+ years of accounting and consulting experience. Profile