The internal audit report is the only product most readers ever see of several hundred hours of work, and it is usually written at the end of an engagement, under time pressure, by people trained to test rather than to write. A good one lets an audit committee member grasp the conclusion in two minutes, lets a process owner understand exactly what to fix and why, and lets a reader three years later reconstruct what was examined and what was found. A bad one buries a high-rated finding on page eleven under a paragraph about scope. This guide gives a nine-step method for producing the good kind, from the finding sheets at the end of fieldwork to the issued report, with the structure, the writing techniques, the rating logic, the handling of management’s response, the review checks and a worked example traced through a real report structure.
Three companion guides sit alongside this one. The report template gives the document itself with every section drafted; the report anatomy guide dissects a finished report page by page; the report examples guide shows several in different styles. The why audit reports put everyone to sleep guide covers readability, and the executive summary guide the one page that matters most. This guide is the method that connects them.
In this guide
- What the Standards require of the report
- The components, and the order they go in
- Step 1: start from the finding sheets, not a blank page
- Step 2: decide the overall conclusion and rating
- Step 3: write the executive summary
- Step 4: build each finding from the five Cs
- Step 5: rate each finding and defend the rating
- Step 6: obtain and present management’s response
- Step 7: handle disagreement and accepted risk
- Step 8: edit for the reader
- Step 9: review, approve, issue and distribute
- Formats: when to use the long form, the short form and the memo
- The mistakes that make reports unread
- A worked example: the route cash report
- Questions about writing audit reports
- Related guides
What the Standards require of the report
The Global Internal Audit Standards treat the report as the final engagement communication (Standard 15.1) and set its content: the engagement objectives, scope and conclusions; the findings with their ratings, where the methodology uses them; management’s action plans or, where management declines to act, its acceptance of the risk; and any limitations. Standard 11.2 sets the qualities every communication must have, and they double as an editing checklist: accurate, objective, clear, concise, constructive, complete and timely. Standard 11.5 requires that where management has accepted a risk the chief audit executive believes is beyond the organization’s appetite, the matter is escalated, ultimately to the board, and the report is where that acceptance is first recorded. Standard 11.4 requires errors in an issued report to be corrected and recommunicated. The Domain V guide covers the standards in sequence; the point for the writer is that the report has mandatory content, and a report that omits the conclusion, the scope or management’s response is non-conforming however well written.
The components, and the order they go in
Every function’s template differs in format and few differ in substance. The components below appear in nearly all of them; the order is the one that serves readers, who read from the top and stop when they have what they need. The template gives each section drafted.
| Component | Purpose | Length | Who reads it |
|---|---|---|---|
| Title block | Entity, engagement name, report number, date, distribution, rating | Half a page | Everyone |
| Executive summary | The conclusion, the rating, the two or three things that matter and what management is doing about them | One page, never more | Committee, executives; the only part most read |
| Background and objectives | Why the area matters, what the engagement set out to answer | Half a page | Readers new to the area |
| Scope and approach | What was and was not covered, period, locations, methods, limitations | Half a page | Process owners; external auditors; regulators |
| Summary of findings | A table: finding, rating, owner, due date | One table | Everyone tracking actions |
| Detailed findings | Each finding with condition, criteria, cause, consequence, recommendation and management’s response | Half to one page each | Process owners; the people who will fix things |
| Positive observations (optional) | Well-designed controls and improvements since the last audit | A few lines | Auditees; the committee’s sense of balance |
| Appendices | Rating definitions, detailed test results, sample methodology, prior findings status | As needed | Specialists; the next audit team |
Step 1: start from the finding sheets, not a blank page
The method below assumes a process or program audit with several findings; the formats section explains how it shrinks for smaller engagements.
Reports written well start before fieldwork ends. Each potential finding should exist as a finding sheet in the workpapers from the day it was identified: the condition observed with the evidence reference, the criteria it fails, the cause as far as it is known, the effect quantified where possible, and the management contact already told about it. The five Cs guide gives the sheet. By the closing meeting (the closing meeting guide), every sheet has been discussed with the process owner, the facts are agreed even where the significance is not, and the writer’s job is assembly and editing rather than discovery. Functions that write the report from memory after fieldwork spend twice as long, argue about facts that should have been settled in week two, and issue late. Start the report document on day one of fieldwork with the background, objectives and scope sections drafted from the planning memo (the planning memo template is written so those sections lift straight across), and add findings as they are confirmed.
Step 2: decide the overall conclusion and rating
Before writing a sentence of the summary, decide what the report concludes. The conclusion answers the engagement objective (were collections complete and deposited intact? is the program operating effectively?) in one sentence, and the overall rating, where the methodology uses one, follows from the findings’ ratings and their pattern. The decision should be made by the engagement lead and the chief audit executive together, with the methodology’s rating definitions open, because the rating is the single word the committee will remember and the one management will contest. A common scale is four levels; whatever the labels, the definitions must be written down in the methodology and reproduced in the report’s appendix, so the rating is applied rather than felt.
| Overall rating | Typical definition | Pattern of findings that produces it |
|---|---|---|
| Satisfactory (or Effective) | Controls are designed and operating to manage the risks within appetite; any findings are low | No high or medium findings, or one medium with a strong compensating control |
| Satisfactory with exceptions (Generally effective) | Controls are adequate overall; specific weaknesses need attention | One or two medium findings, no high |
| Needs improvement (Partially effective) | Significant weaknesses exist in design or operation; the objective is at risk | One high, or several medium findings with a common cause |
| Unsatisfactory (Ineffective) | Controls do not manage the risks; the objective is not being met | Multiple high findings, or a single high that defeats the control objective |
Step 3: write the executive summary
The executive summary is the report for most of its readers, and the executive summary guide is devoted to it. The method in brief: open with the conclusion and the rating in the first sentence, not with the background; follow with why the area matters in one or two sentences a director would recognize (dollars, customers, regulation); state the two or three findings that drive the rating, each in one sentence that names the control gap and its consequence; summarize what management has committed to and by when; and name anything the committee must decide, such as an accepted risk. One page, no more; if the summary runs over, the writer has not decided what matters. Write it last, after the findings are final, and then read it as if it were the only page: does a reader who stops here know what was found, how bad it is and what happens next?
Step 4: build each finding from the five Cs
A finding is an argument, and the five Cs are its structure: the condition (what is), the criteria (what should be), the cause (why the gap exists), the consequence (what it risks or has cost) and the corrective action (what should change). Each element has a failure mode, and readers can feel which one is missing even when they cannot name it. A finding with no cause produces a recommendation that treats the symptom; a finding with no quantified consequence is dismissed as theoretical; a finding whose criteria are the auditor’s preference rather than a policy or standard is argued about forever. The table shows a weak and a strong version of each element from the same finding.
| Element | Weak | Strong |
|---|---|---|
| Condition | Reconciliations are not always performed independently. | At 9 of 12 depots, the daily route cash reconciliation is performed by the depot administrator who also receives the cash from drivers; 14 of 60 reconciliations sampled (five per depot) were performed by the cash handler, and no second-person review was evidenced. |
| Criteria | Good practice requires segregation of duties. | The Cash Handling Policy (section 4.2, revised March 2025) requires the reconciliation to be performed by a person independent of cash receipt and reviewed by the depot manager. |
| Cause | Staff shortages. | Eight depots have a single administrative position; the policy was written for the four largest depots and no alternative control (such as a regional review of reconciliations) was designed for the others. |
| Consequence | Cash could be misappropriated. | About $31 million a year of driver-collected cash passes through these depots; a diversion by the person who both receives and reconciles would not be detected by any existing control, and the FY26 Dayton diversion ($18,400 over five months) was found by a customer complaint rather than a control. |
| Corrective action | Management should improve segregation of duties. | Route the daily reconciliation files to the regional finance team for independent reconciliation and review at the eight single-administrator depots by 31 March 2027, with a weekly exception report to the controller; longer term, evaluate the handheld system’s bank-feed matching to automate the reconciliation. |
Two rules keep findings honest. State the condition in terms of what was tested (population, sample, exceptions), because a reader deciding how much to worry needs the denominator; “several instances” tells them nothing. And write the cause as management would recognize it, which usually means a design gap, a resourcing decision or a monitoring failure rather than “lack of oversight”, which is a description of every control failure ever found. The root cause analysis guide gives a method for getting from symptom to cause.
Step 5: rate each finding and defend the rating
Finding ratings are where auditors and management argue most, and the argument is shorter when the rating is applied from written criteria. The severity ratings guide gives a full method; the core is a two-dimensional judgment, likelihood that the weakness leads to harm and the size of the harm, with adjustments for pervasiveness (one depot or all twelve), regulatory implications and whether the weakness is already known. Write the rationale for every high and medium rating in a sentence in the finding, so that when management asks “why is this high?” the answer is in the document rather than in a meeting. Ratings also drive the follow-up machinery: a high finding usually carries a shorter remediation window, executive-level ownership and committee tracking, which is why owners contest it. Hold the rating when the criteria support it; change it only when the facts change.
Step 6: obtain and present management’s response
The Standards require management’s action plan or risk acceptance in the report, and the response is the part of the report that produces change, so it deserves as much care as the finding. A usable response has four parts: the action (specific enough to be validated later), the owner by name and title, the target date, and, where the finding is high, an interim mitigation while the permanent fix is built. Send findings to owners as they are confirmed rather than all at once at the end, give a stated turnaround (five working days is common), and offer to help owners word actions that can be validated: “we will improve controls” cannot be closed on evidence; “the regional finance team will perform and sign the daily reconciliation for the eight listed depots from 1 February 2027” can. Present responses verbatim under each finding, labeled as management’s, with the audit function’s comment only where the response does not address the finding. The life of a finding guide follows what happens next, and the issue validation guide shows what a validator will need the action to say.
Step 7: handle disagreement and accepted risk
Management may dispute a fact, a rating or a recommendation, or may agree with all three and decline to act. Each is handled differently. A disputed fact is resolved before issue, by re-examining the evidence; if the auditor was wrong, the finding changes or goes. A disputed rating is resolved by the chief audit executive against the written criteria, and if management still disagrees, both views appear in the report. A disputed recommendation is the easiest: the finding is about the gap, not the fix, and management may propose a different action that closes the gap. Declining to act is risk acceptance, and under Standard 11.5 it is recorded in the report with the accepting executive’s name and reasoning and escalated to the committee where the chief audit executive judges the risk beyond appetite. The difficult conversations guide covers the meetings where these are argued, and the disputing a finding guide shows the process from the auditee’s side.
| Situation | Resolution | How it appears in the report |
|---|---|---|
| Management disputes a fact | Re-examine evidence; correct or withdraw the finding if wrong | Only the corrected finding; disputes about facts do not belong in the issued report |
| Management disputes the rating | CAE decides against written criteria | Audit’s rating stands; management’s view stated in one sentence in the response |
| Management proposes a different fix | Accept if it closes the gap; say so | Management’s action, with audit’s note that it addresses the finding |
| Management accepts the risk | Record the acceptance; CAE assesses against appetite; escalate if beyond it | The acceptance, the accepting executive, the reasoning; a line in the executive summary flagging it for the committee |
| Management will act but on a long timeline | Agree interim mitigation for high findings | Permanent action and date, interim action and date |
Step 8: edit for the reader
Editing is where reports are won, and it is a separate pass from writing. The readability guide and the writing for auditors series cover the craft in depth; the techniques that change the most in the least time are below, each with a before and after taken from draft reports.
| Technique | Before | After |
|---|---|---|
| Lead with the point | In the course of our review of the reconciliation process, it was noted that in certain instances… | Fourteen of sixty reconciliations were performed by the cash handler. |
| Name the actor | Overrides were approved without independent review. | Depot administrators approved 1,412 of their own overrides. |
| Replace abstractions with numbers | A significant number of customers do not receive statements. | 1,130 of 4,200 cash customers receive no statement. |
| Cut audit-speak | Management should ensure that appropriate controls are implemented to mitigate the risk. | Route reconciliations to regional finance by 31 March. |
| One idea per paragraph | A paragraph covering condition, cause and recommendation together | Three short paragraphs, labeled |
| Remove hedges | It appears that there may be a potential weakness… | The control did not operate at nine depots. |
| Use the reader’s vocabulary | Deficiencies in the completeness assertion over cash receipts | Cash collected by drivers may not all reach the bank |
Step 9: review, approve, issue and distribute
Before issue, the report passes three reviews, each with a different question. The engagement lead checks every statement against the workpapers (is each number, date and name traceable to evidence, and does every finding tie to a finding sheet?). The audit manager or CAE reviews for judgment (is the conclusion supported, are the ratings consistent with the criteria and with ratings in other reports, is anything missing that the committee would expect to see?). A reader outside the engagement, where the function is large enough, reviews for clarity (can a non-specialist follow it?). The review notes guide shows how to run and clear the comments. Approval is the CAE’s signature. Distribution follows the methodology: the full report to the executive owner and the process owners, the executive summary to the committee pack, and a defined list for anyone else, with the external auditor and regulators receiving reports under the function’s access protocol. Timing is a quality measure: issue within an agreed number of working days of the closing meeting (ten to fifteen is common), and report the measure to the committee, because a report issued eight weeks after fieldwork is describing a process that has already changed.
| Check | Who | Question | Typical catch |
|---|---|---|---|
| Evidence trace | Engagement lead | Is every fact referenced to a workpaper? | A sample size or exception count that changed during fieldwork and was not updated |
| Rating consistency | Audit manager / CAE | Would this finding receive the same rating in another report this year? | Rating inflation in difficult relationships; deflation in friendly ones |
| Completeness | CAE | Objectives, scope, conclusion, findings, responses, limitations all present? | Scope limitation omitted; accepted risk not flagged in the summary |
| Readability | Reader outside the team | Can a director read the summary in two minutes and know what to do? | Summary that starts with background; jargon |
| Tone | CAE | Is it constructive, factual and free of blame language? | “Failed to”, “neglected”, names of individuals |
| Mechanics | Anyone | Numbers add up, dates consistent, owners spelled right, report number and date present | Finding table totals not matching the detailed section |
Formats: when to use the long form, the short form and the memo
Not every engagement needs the full structure. Functions that use one format for everything either over-document small reviews or under-document large ones, and the choice of format is a planning decision recorded in the planning memo. Four formats cover most needs, and the components above shrink or expand with them; what never changes is that the conclusion, the scope, the findings and management’s response are present in some form.
| Format | Use for | Length | What changes |
|---|---|---|---|
| Full report | Process and program audits with several findings; anything going to the committee in full | 8 to 15 pages | All components; appendices as needed |
| Short-form report | Audits with no or one finding; thematic reviews across units with a single pattern | 2 to 4 pages | Summary and findings merged; scope in a paragraph; rating definitions by reference |
| Memorandum | Advisory engagements; validation of a single issue; follow-up results; pre-implementation observations | 1 to 3 pages | No rating; observations and advice instead of findings; labeled advisory so the independence consequences are visible |
| Dashboard or one-page summary | Committee reporting across many engagements; continuous auditing results | 1 page | Ratings, open actions and trends by engagement; links to the underlying reports |
Audiences also shape the document. The committee reads the summary and the ratings and wants the pattern across reports; the presenting to the audit committee guide covers that conversation. Executive owners read the findings that carry their name and the dates. Process owners read the detail and want the test results in the appendix so they can reperform them. Regulators and external auditors read for scope, method and whether findings were followed through, and will compare the report with the workpapers; the regulatory findings guide explains what examiners look for. Writing one report that serves all four is possible because the structure is layered: each reader stops at the layer that answers their question, which is why the order of components matters as much as their content.
The mistakes that make reports unread
Starting with background instead of the conclusion, so the reader must work to find the point. Executive summaries that run to three pages and are therefore not summaries. Findings without denominators, so no one can judge scale. Causes written as “lack of” something, which is a restatement of the condition. Recommendations that say “ensure” and “appropriate”, which cannot be validated. Rating definitions that live in the methodology and never in the report, so management argues the rating from scratch each time. Management responses paraphrased by the auditor instead of quoted, which costs the auditor the ownership it was trying to create. Reports issued so late that the people named have moved on. Blame language that turns a process owner into an opponent. And a positive-observations section so long it reads as an apology for the findings, or so absent that the report reads as if nothing in the area works. The report writing mistakes guide expands each with fixes.
A worked example: the route cash report
MidState Beverage’s report FY27-01, on route cash at its twelve depots, is dissected page by page in the report anatomy guide; here is how the nine steps produced it. The finding sheets were complete by the closing meeting in week seven: five findings, their facts agreed with the depot operations director even though she contested two ratings. The chief audit executive and the engagement lead set the overall rating at Unsatisfactory against the methodology’s definitions, because two high findings (reconciliations performed by cash handlers at nine of twelve depots; 1,412 self-approved overrides) defeated the control objective across most of the population. The executive summary opened with that conclusion, gave the $31 million exposure in its second sentence, stated the two high findings in one sentence each, summarized the eleven agreed actions and their dates, and flagged in its final paragraph that the chief operating officer had accepted the residual risk on customer statements for 1,130 customers, which the committee would need to consider.
Each finding ran to about a page. The first finding’s condition gave the denominator (14 of 60 reconciliations, nine depots), its criteria cited the policy section, its cause named the single-administrator staffing model and the policy written for large depots, its consequence quantified the exposure and cited the FY26 Dayton diversion found by a customer rather than a control, and its corrective action was the regional reconciliation route with a date and a longer-term automation evaluation. Management’s responses appeared verbatim under each finding with owners and dates; where the operations director disagreed with the medium rating on handheld synchronization failures, her one-sentence view appeared beneath audit’s rationale. The editing pass cut the draft from nineteen pages to eleven, mostly by removing hedges and merging a scope section that had repeated the planning memo. The report issued twelve working days after the closing meeting, the committee spent twenty minutes on it, and the accepted risk became a standing item until the COO reversed the decision the following quarter after the first statement run found two more diversions. The follow-up engagement in the FY28 plan will validate all eleven actions.
Questions about writing audit reports
What should an internal audit report include?
The engagement objectives, scope and overall conclusion (with a rating where used); each finding with condition, criteria, cause, consequence and recommendation; management’s action plans or risk acceptance with owners and dates; any limitations; and an executive summary that states all of this in one page.
How long should an internal audit report be?
As short as the findings allow: a one-page executive summary, half a page each for background and scope, a findings table and half a page to a page per finding. Eight to fifteen pages is typical for a process audit with four to six findings; detail belongs in appendices or workpapers.
What are the five Cs of an audit finding?
Condition (what is), criteria (what should be), cause (why the gap exists), consequence (the risk or cost) and corrective action (what should change). A finding missing any one of them is weaker and usually produces a worse recommendation.
How are audit findings rated?
Against written criteria in the function’s methodology, usually combining the likelihood of harm and its size with adjustments for pervasiveness and regulatory implications, producing high, medium or low. The rationale for each high and medium rating should appear in the finding.
What if management disagrees with a finding?
Disputed facts are resolved against the evidence before issue. Disputed ratings are decided by the chief audit executive against the criteria, with management’s view recorded. If management declines to act, the risk acceptance is recorded in the report and escalated to the audit committee where the risk appears to exceed appetite.
How soon after fieldwork should the report be issued?
Most functions target ten to fifteen working days from the closing meeting to issue, and report the measure to the committee. Starting the report on the first day of fieldwork and confirming findings as they arise is what makes the target achievable.
Related guides
- Internal audit report template — every section drafted.
- Anatomy of an internal audit report — a finished report dissected.
- Internal audit report examples — several styles compared.
- The executive summary — the one page that matters most.
- The five Cs of audit findings — the finding sheet.
- Finding severity ratings — rating criteria and method.
- Root cause analysis for audit findings — from symptom to cause.
- Why your audit reports put everyone to sleep — readability.
- Writing for auditors — the craft series.
- Audit report writing mistakes — and their fixes.
- The closing meeting — where findings are agreed.
- Difficult conversations in audit — disputed ratings and accepted risk.
- Presenting to the audit committee — the report in the room.
- The life of a finding — what happens after issue.
- Issue validation — what the action must say to be closed.
- Review notes — running the review.
- Disputing an audit finding — the auditee’s side.
- GIAS Domain V — Standards 15.1 and 11.2 to 11.5.
- On Writing Well by William Zinsser: Summary and Lessons for Audit Reports — clear, simple prose for audit reports.
Leave a Reply