Search “internal audit report example” and you will find templates — empty scaffolding with section headings and lorem-ipsum promises. What you will not find is the thing every auditor actually needs: complete, realistic reports you can read end to end, with someone explaining why each sentence is shaped the way it is. Real reports are confidential; good fakes are hard work; so the profession’s most-produced document has almost no public exemplars.
This library fixes that. Below are five fictionalized but structurally faithful internal audit reports spanning the range every function must be able to write: a clean report (satisfactory, no findings — harder to write well than you think), a mixed report (the everyday case: real findings, functioning process), an adverse report (the one that goes to the committee with an unsatisfactory conclusion), a short-form report whose findings table has to stand alone, and a follow-up report that closes findings on evidence. The shaded blocks are the reports; the notes between them are the annotations — the craft choices, and the failure modes each choice avoids. Companies, people, and numbers are invented; the anatomy is exact.
This library was rewritten in September 2026 to add two reports the August version did not have: a short-form report with a findings table, drawn from the purchasing card audit written up elsewhere on this site, and a follow-up report that closes one of Report B’s findings and leaves the other open, because the report that says what happened next is the one committees read most carefully and the one nobody publishes an example of. It also adds the anatomy of a report section by section, with the failure each section prevents, and the rule by which each of the five reports’ overall ratings was derived from its findings. Reports A, B and C and their annotations are unchanged.
The library
- Report A — the clean opinion: Payroll Processing (Satisfactory)
- Report B — the mixed result: Accounts Payable (Needs Improvement)
- Report C — the adverse call: Third-Party Risk Management (Unsatisfactory)
- Report D — the short-form report: Purchasing Card Program (Needs Improvement)
- Report E — the follow-up report: Accounts Payable findings, six months on
- The anatomy, section by section
- How each report’s rating was derived
- The design choices behind all five
- Where to go next
Report A — the clean opinion: Payroll Processing
Clean reports are where credibility is built or squandered. Write them thin (“no findings noted, control environment adequate”) and you teach executives that a satisfactory audit produced nothing; write them padded with manufactured pseudo-findings and you teach management that no result is ever good enough. The model below does neither: it earns the clean opinion by showing the work.
| Report | Internal Audit Report 2026-11: Payroll Processing | Rating | Satisfactory |
| Issued | August 14, 2026 | Distribution | CFO; CHRO; VP Payroll; Audit Committee (summary) |
| Period | July 1, 2025 – June 30, 2026 | Engagement lead | R. Vance, Audit Manager |
Executive summary. Payroll processing controls are designed adequately and operated effectively during the period. We tested the controls over payroll changes, off-cycle payments, time capture, and disbursement across a population of 26 pay cycles covering $148M in gross pay. All 6 key controls tested operated without exception; payroll bank reconciliations were current and clean; and the ghost-employee analytic we ran across the full employee master against HR, badge, and network-access data identified no anomalies. Two low-risk betterment opportunities were discussed with management and are summarized in Appendix B; neither affects the rating. This audit covered processing controls only — payroll accounting (accruals, allocations) is scheduled as a separate engagement in Q2 2027.
Craft notes. Four sentences do all the work. Sentence one is the conclusion — first, unhedged, in the report’s own rating vocabulary. Sentence two proves the conclusion was earned: populations, dollars, and the sexiest test in the file (the ghost-employee analytic) named specifically, because a clean opinion is only as credible as the work behind it is visible. Sentence three handles the betterment items without letting them blur the rating — “discussed and summarized in an appendix” keeps the main body honest about what is and is not a finding. Sentence four is the scope fence: saying plainly what this audit did NOT cover is the cheapest insurance in reporting, because the reader who assumes payroll accounting was covered is the reader who blames you in Q3.
Background and scope. Payroll is processed biweekly for 3,900 employees across two legal entities through Workday Payroll, with disbursement via the treasury payment factory. The audit assessed the design and operating effectiveness of key controls over: (1) payroll change authorization (new hires, terminations, compensation changes); (2) off-cycle and manual payments; (3) time capture and overtime approval for the 1,700 non-exempt employees; (4) payroll review and release; (5) disbursement reconciliation; and (6) segregation of duties between payroll setup, processing, and release. Approach: walkthroughs with control owners, attribute testing on statistically sized samples (design per our standard sampling parameters), and full-population analytics where data permitted. Scope exclusions: payroll accounting and expatriate payroll (separate engagements); benefits administration (audited 2025, Satisfactory).
Craft notes. The scope section is a numbered contract: six controls, named the way the RCM names them, so the detailed results can tick through the same list and the reader can audit the audit. “Full-population analytics where data permitted” earns trust — it tells the reader sampling was a choice, not a limitation accepted lazily. And the scope-exclusion sentence names where each excluded area lives instead, which converts “what about X?” from an attack into a calendar question.
Results by area. (1) Change authorization: 25 of 25 sampled changes carried authorized source documentation and system approval matching the HR record; segregation between initiator and approver held in all cases. (2) Off-cycle payments: all 41 off-cycle runs in the period were tested; each carried documented justification and dual approval; median cycle time 1.4 days. (3) Time capture: 25 sampled timecards agreed to approved schedules; overtime approvals preceded payment in 25 of 25; the two highest-overtime cost centers were reviewed in full with no exception. (4) Review and release: the variance-review control (investigating period-over-period swings above 5% at cost-center level) operated in 26 of 26 cycles, with documented disposition of 118 flagged variances. (5) Reconciliation: 12 of 12 monthly payroll bank reconciliations were completed within deadline with no unresolved items over 30 days. (6) Ghost-employee analytic: full employee master (3,942 records) matched against HR status, badge activity, and network logins; 14 initial exceptions all resolved as leaves, remote contractors, or timing — zero unresolved.
Craft notes. Every line is numerator over denominator — the same photographability standard our 5 C’s masterclass demands of findings applies to clean results, and it is what makes this report’s “Satisfactory” mean something. Note the analytic’s honesty: 14 initial exceptions, all resolved, zero unresolved. Reporting the intermediate number is deliberate — it shows the analytic had teeth, and it pre-answers the skeptic who suspects the test was tuned to find nothing. A clean report that shows its near-misses is twice as credible as one that shows a row of green ticks.
Appendix B — betterment opportunities (no rating impact). (i) The overtime pre-approval threshold ($0) generates ~600 approvals per cycle; management may wish to evaluate a de minimis threshold with monitoring, trading approval volume for review quality. (ii) Off-cycle justification codes are free-text; standardized codes would enable trend analytics. Management concurred with both and will evaluate by Q1 2027; no action plans required.
Craft notes. Betterment items are advisory observations, and the report treats them with advisory grammar: “may wish to evaluate,” no owners, no tracked actions, quarantined in an appendix. The moment you track a betterment item like a finding, you have created a finding with worse paperwork. Give management genuinely free suggestions and they will keep telling you things; bill every conversation and they will stop.
Report B — the mixed result: Accounts Payable
The mixed report is the everyday workhorse: real findings inside a process that mostly works. Its craft problem is proportion — honoring what functions while making the deficiencies impossible to skim past.
| Report | Internal Audit Report 2026-14: Accounts Payable | Rating | Needs Improvement |
| Issued | August 21, 2026 | Distribution | CFO; Controller; VP Procurement; Audit Committee |
| Period | July 1, 2025 – June 30, 2026 | Findings | 1 High, 1 Moderate; 2 low-risk items in Appendix |
Executive summary. AP controls over invoice matching, approval routing, and disbursement release are designed adequately and operated effectively; three-way match exceptions were dispositioned appropriately in all 25 sampled cases. However, two deficiencies elevate the residual risk of duplicate and improper payments and result in an overall rating of Needs Improvement. First (High), the system’s duplicate-invoice check matches only on exact invoice number, vendor, and amount; our full-year analytic across 61,400 paid invoices identified $214,000 in likely duplicate payments that near-match logic would have caught, of which $178,000 has been confirmed and $121,000 recovered to date. Second (Moderate), 31 of 46 vendor-master changes sampled lacked evidence of the required callback verification for bank-detail changes — the control that defends against payment-redirection fraud. Management’s action plans, summarized below, are due October 31 and December 15 respectively; internal audit will validate before closure.
Craft notes. The “however” pivot is the mixed report’s signature move: one sentence of earned credit, then the deficiencies with numbers attached — and the recovery figure ($121,000 already back) converts the finding from embarrassment into demonstrated value. Both findings compress to the five-sentence discipline of the 5 C’s; the full versions in the report body carry the complete condition/criteria/cause/consequence/action chain. Note also what the rating sentence does NOT do: it does not average. Two real deficiencies inside an otherwise-clean process is “Needs Improvement,” not “Satisfactory with observations” — rating inflation is the reporting sin committees eventually punish hardest.
Finding 1 (High) — Duplicate payments: near-match invoices bypass the system check. The ERP duplicate check blocks only exact matches on vendor + invoice number + amount. Testing across all 61,400 invoices paid in the period identified 96 likely duplicates totaling $214,000 — invoice numbers differing by prefixes or transposition, split amounts, or the same invoice paid to a vendor’s duplicate master record. $178,000 confirmed as duplicates by AP to date; $121,000 recovered. Criteria: AP Policy §5.2 requires controls designed to prevent duplicate disbursement. Cause: the match rule was configured at implementation in 2019 and never reassessed as invoice volume tripled; duplicate vendor records (see Finding 2’s cause family) defeat even exact matching. Consequence: at the observed rate, continuing exposure approximates $200,000 annually, concentrated in the two highest-volume vendor categories; none of the confirmed duplicates was flagged by any existing control — all were found by this audit’s analytic. Management action (Controller, Oct 31): implement fuzzy-match logic (normalized invoice numbers, amount tolerance, cross-record vendor matching) in the pre-payment run; recover remaining confirmed duplicates; re-run the audit analytic quarterly until two consecutive clean quarters.
Craft notes. A High finding earns its rating on the page: full-population testing (not a sample — 61,400 invoices), confirmed dollars, a cause that names the configuration decision and its year, and an action that includes the audit analytic itself becoming management’s monitoring control — the quiet endgame of good audit analytics. The phrase “none was flagged by any existing control” is the consequence doing surgical work: it converts “we found duplicates” into “you have no defense against this class of error.”
Finding 2 (Moderate) — Vendor bank-detail changes: callback verification not evidenced. 31 of 46 sampled vendor-master changes involving bank details lacked documented callback verification to a known contact, required by Treasury Fraud Standard §2.4 for all payment-instruction changes. Cause: the AP service center treats the callback as complete when the requestor’s email is “verified,” a misreading of the standard that entered the desk procedures during the 2024 offshoring transition; the procedure document itself is wrong. Consequence: unverified bank changes are the primary entry point for business email compromise payment fraud; the organization processed $9.6M through vendor records whose banking changes lacked verified callbacks during the period (no fraudulent redirection identified in testing). Management action (VP Shared Services, Dec 15): correct the desk procedure, retrain the team, add callback evidence as a mandatory workflow field, and run a retroactive verification of all bank changes from the period, prioritized by payment volume.
Craft notes. The cause here is the finding: the desk procedure itself is wrong, which is why the action leads with correcting the document rather than “retraining” people to override it. And the consequence sentence pairs the scary number ($9.6M exposed) with the honest one (no actual redirection found) — the calibration that keeps High/Moderate ratings meaningful. This entire fact pattern — and the test program that catches it — is developed at full length in our complete guide to auditing accounts payable.
Report C — the adverse call: Third-Party Risk Management
Adverse reports are rare, political, and career-defining in both directions. The craft rules invert: shorter, cooler, and built for the audit committee rather than the process owner — many functions issue them memo-style precisely because the committee is the primary reader. Watch how the temperature stays low while the content escalates.
MEMORANDUM — Internal Audit Report 2026-16: Third-Party Risk Management Program. Rating: Unsatisfactory. To: Audit Committee; CEO; CFO. This audit assessed the enterprise TPRM program against TPRM Policy §1–6 and, as forward-looking criteria, the IIA’s Third-Party Topical Requirement effective September 15, 2026. The program is not operating as designed, and in three areas the design itself is inadequate. (1) No complete third-party inventory exists: procurement, InfoSec, and finance maintain conflicting lists (1,842 vs 1,310 vs 2,067 records); 388 vendors receiving payments in the period appear on none of them. (2) Risk tiering has not been refreshed since 2023; 14 of 22 critical-tier vendors — including both payment processors — lack a current risk reassessment. (3) No exit plans exist for any critical vendor, and offboarding controls (data destruction, access revocation) could not be evidenced for 9 of 10 sampled terminations. Contributing cause across all three: the TPRM office has been staffed at 1.5 FTE against an approved model of 4 since mid-2024, and quarterly program reporting to the Risk Committee stopped in Q3 2024 without escalation. Consequence: the organization cannot currently answer which third parties can access its data, move its money, or interrupt its operations — the baseline the incoming IIA requirement treats as mandatory assurance ground. Management concurs with the facts. A remediation program with executive ownership (COO), dedicated funding, and milestone reporting to this committee is attached; internal audit will re-assess design in Q1 2027 and operating effectiveness in Q3 2027, and will report milestone status quarterly until then.
Craft notes. Every escalation instrument is present and none of it is loud. The rating is in the subject line — no burying. The three failures are numbered facts with denominators, not characterizations (“1,842 vs 1,310 vs 2,067” indicts more efficiently than any adjective could). The cause names the resourcing decision and the reporting that went dark — without assigning blame to a person, because adverse reports about programs survive review and adverse reports about people start wars. “Management concurs with the facts” is the sentence that makes the whole memo land: it tells the committee the debate is over scope of repair, not reality — which is exactly where the no-surprises doctrine (socialize findings as they emerge, never at issuance) should have put things. And the closing commits AUDIT to dates too: re-assessment windows and quarterly reporting. An adverse opinion without an audit follow-up plan is an accusation; with one, it is a turnaround program. The criteria move — citing the Third-Party Topical Requirement as forward-looking criteria three weeks before it binds — is the kind of timing that makes a committee take the rating seriously.
Report D — the short-form report: Purchasing Card Program (Needs Improvement)
Most engagements do not need the full report. A short-form report is one page of conclusion and a findings table, with the detailed findings and action plans attached rather than embedded, and it is the format that mature functions issue for the majority of their work. Its craft problem is the opposite of Report B’s: with no room for proportion, every sentence has to carry a number, and the table has to be readable by a committee member who will never open the attachment. The report below is the one the MidState Beverage purchasing card audit issued: 210 cards, $3.4 million of spend, eight findings and one matter referred under the fraud response protocol.
| Report | Internal Audit Report FY28-07: Purchasing Card Program | Rating | Needs Improvement |
| Issued | Week seven of the engagement, three days after the exit meeting | Distribution | CFO; Controller; VP Operations; Audit Committee |
| Period | Twelve months of card activity from both providers | Findings | 2 High, 4 Medium, 2 Low; one matter referred under the fraud response protocol |
Conclusion. The purchasing card program’s core controls, merchant category blocks, transaction and monthly limits and the reconciliation of the provider settlement to the ledger, are designed adequately and operated during the period for the 210 cards on the legacy program. Two High findings and four Medium findings result in a rating of Needs Improvement. The High findings are that 44 clusters of transactions with one fleet maintenance vendor, totalling $148,000 at three depots, were divided to stay within the $2,500 single-transaction limit and so bypassed purchase order approval, a pattern the accounts payable audit reported for the same vendor at the purchase order threshold; and that the program administrator approved his own statement and could raise limits and change merchant blocks alone, while four cardholders in total were routed to approve their own statements. The rating is Needs Improvement rather than Unsatisfactory because the exposure of both High findings is bounded by the monthly limit and the ledger reconciliation, neither is a repeat finding, and management corrected the approval routing during fieldwork. Analytics ran on the full year of transactions from both providers. One matter identified by the analytics was referred under the fraud response protocol on day four of fieldwork and is not addressed in this report. Recoveries and savings identified during the engagement total $54,400: an unclaimed provider rebate of $31,000, twelve recurring charges with no living owner cancelled at $18,000 a year, $4,300 of expense claims duplicated on cards, and $1,100 of transactions on cards active after their holders’ termination.
| Rating | Finding | Action owner | Target date |
|---|---|---|---|
| High | 1. Transactions divided around the single-transaction limit: 61 clusters, 44 with one fleet maintenance vendor, $148,000, bypassing purchase order approval and the two-quote rule | Fleet Manager; Program Administrator | October 31 |
| High | 2. Program administration without segregation: the administrator approved his own statement and could raise limits and change blocks alone; four cardholders and two reciprocal pairs routed to approve their own or each other’s statements (routing corrected during fieldwork) | Controller | November 30 |
| Medium | 3. Issuance and recertification: 31 cards held by staff whose roles carry no purchasing need, 19 inherited from predecessors; 38 cards dormant for six months; 14 of 26 limit increases with no recorded justification, four never reversed | Program Administrator | December 15 |
| Medium | 4. The acquired distributors’ program: cards on the former provider block cash advances only, with no tier table and no block list of their own | Controller | November 30 |
| Medium | 5. Fourteen gift card purchases of $2,900 coded as staff recognition with no recipient list; the recognition policy sets no documentation requirement (the individual matter is handled under the protocol) | CHRO | October 31 |
| Medium | 6. Reconciliation discipline: 22 percent of statements reconciled late; receipts attached for 71 percent of charges above the threshold; the suspension rule never triggered because the deadline was configured at 120 days | Program Administrator | October 15 |
| Low | 7. Twenty-seven card transactions also claimed through expenses, $4,300, eleven cardholders; recovered | AP Manager | Complete |
| Low | 8. Cardholder agreements signed for 140 of 210 cards and training recorded for 90 | Program Administrator | December 15 |
Management response. Management agrees with the findings and the rating. The action plans in Attachment 2 are owned as shown; the CFO has assigned the program administrator role’s second-person controls to the Controller’s team pending the November redesign. Internal audit follow-up. Internal audit will validate findings 1, 2 and 6 on evidence at their target dates and the remainder at the December 15 date, and will re-run the split-transaction and approval-routing analytics quarterly for two quarters. Attachments: 1, detailed findings with condition, criteria, cause and consequence; 2, management action plans; 3, rating definitions; 4, scope and approach.
Craft notes. Five choices make the short form work. The conclusion paragraph derives the rating in the open: it names the two Highs, says why they are not Unsatisfactory against the published definitions, and does it in one sentence, because the committee member who reads only this paragraph will otherwise supply their own reason. The referral is one sentence that says a matter exists, was referred, and is not here; it names no one, characterizes nothing, and gives the reader no way to identify the person, which is what the protocol requires and what a later investigation will thank you for. The recoveries sentence comes after the findings, not before, so that the report is not mistaken for a value pitch, and it is itemized to the dollar because a round number in a value sentence reads as marketing. The findings table carries the condition in numbers and nothing else, with the owner and the date, and each row would survive being the only thing the reader saw. And the follow-up sentence commits audit to specific validations and to re-running its own analytics, which is the sentence that turns the two Highs from accusations into a program.
One vocabulary note across the library: Report B rates its second finding “Moderate”, the purchasing card report rates on High, Medium and Low, and the severity matrix adds Critical above High. Scales differ by shop and the anatomy survives them all; what does not survive is a scale without published definitions, which is why every report here attaches them.
Report E — the follow-up report: Accounts Payable findings, six months on
The follow-up report is the one that decides whether the committee believes the others. It reports the status of previously issued findings on evidence, not on management’s assertion, and it has to say “still open” without drama and “closed” without generosity. The memo below follows Report B’s two findings to their target dates. The three statuses it uses, validated closed, implemented pending evidence, and open, are the only three worth having; “in progress” is what every open item says about itself.
MEMORANDUM — Follow-up Report 2027-03: Accounts Payable (Report 2026-14). To: Audit Committee; CFO; Controller; VP Shared Services. This memo reports the validated status of the two findings in Internal Audit Report 2026-14 at their target dates. Finding 1, duplicate payments (High): validated closed. The pre-payment duplicate check now applies normalized invoice numbers, an amount tolerance of one percent and cross-record vendor matching; we inspected the configuration, traced its change record to the October 28 release, and re-performed the audit analytic on the two quarters since. In the first quarter the new check stopped three near-match invoices totalling $19,400 before payment; in the second, our analytic found no paid duplicate across 16,900 invoices. Of the $57,000 confirmed and unrecovered at issuance, $49,000 has been recovered and $8,000 written off with Controller approval after the vendor entered administration. The quarterly re-run of the analytic is now a Controller’s monitoring control with its own owner and evidence, so the closure does not depend on this function repeating it. Finding 2, vendor bank-detail changes (Moderate): open, target date extended to March 31. The desk procedure was corrected and reissued on December 9, callback evidence is a mandatory field in the vendor change workflow from December 12, and 40 of 40 changes we sampled since that date carry a documented callback to a number held on file. The retroactive verification of the period’s changes is incomplete: 312 of 406 bank-detail changes have been verified, including every vendor paid more than $50,000 in the period, and 94 remain, all below that threshold, with a combined payment volume of $1.4 million. No redirected payment has been identified in the 312. Because the verification is the part of the action plan that bounds the exposure already incurred, the finding remains open at its original rating until the 94 are complete; management has committed to March 31 and to a weekly count to the Controller until then. We will validate on evidence in the first week of April and report the result in the next quarterly issue status. No findings from this report are proposed for risk acceptance.
Craft notes. Read the two statuses against each other. The closed finding is closed on four kinds of evidence, the configuration inspected, the change record traced, the analytic re-performed, and the monitoring control handed over with an owner; the memo names each so the committee can see that “closed” was earned rather than accepted. The open finding gets the same discipline in the other direction: it says precisely what has been done, quantifies what has not, and gives the reason the finding cannot close yet in one sentence about exposure, which is the sentence that keeps the conversation off “but we did most of it”. Notice that the rating does not move. A finding is re-rated when its facts change, and a corrected procedure does not change the exposure of the 94 unverified changes; the issue validation guide covers the standard of evidence and the life-of-a-finding guide follows a finding through exactly this stage. The last sentence, that nothing is proposed for risk acceptance, is there because its absence would be read as a question; where management does decide to stop, the risk acceptance guide gives the process that replaces the follow-up.
The anatomy, section by section, and the failure each section prevents
Five reports of different lengths and temperatures share one skeleton. The table names each section, its job, the length it should be in a full report, the failure it exists to prevent, and where in the library to see it done. The report anatomy guide treats each section at length and the template set provides the shells.
| Section | Its job | Length in a full report | The failure it prevents | See it in |
|---|---|---|---|---|
| Header block | Identify the engagement, the rating, the period, the readers and the finding count before a sentence is read | Six cells | The reader hunting for the rating; the report forwarded without its distribution | A, B, D |
| Executive summary or conclusion | State the conclusion first, prove it was earned, name the findings with numbers, fence the scope | One page, four to eight sentences | The buried rating; the clean opinion that shows no work; the mixed report that averages | A, B, C, D |
| Background and scope | A numbered contract of what was assessed and how, and where the exclusions live | Half a page | “What about X?” arriving as an attack instead of a calendar question | A |
| Results by area | In a clean or mixed report, the numerator-over-denominator evidence for what worked | Half a page to a page | The “Satisfactory” that means nothing; the analytic nobody can tell had teeth | A |
| Findings | Each finding on the five C’s chain, ordered by rating, titled by consequence, action plan inline | Half a page each | The finding that reads as an opinion; the response exiled to an appendix | B, C |
| Findings table | Rating, condition in numbers, owner, date; readable without the attachment | One row per finding | The committee member who never opens the detailed findings | D |
| Referral sentence | Say a matter exists and is handled elsewhere, without identifying or characterizing | One sentence | A report that prejudices an investigation, or hides that one exists | D |
| Management response | Agreement or recorded disagreement with the facts and the rating; ownership of the plans | Three to six lines | The committee learning of a dispute from the process owner | C, D |
| Audit’s own commitments | What internal audit will validate, when, and what it will re-run | Two sentences | The adverse opinion that is an accusation rather than a program | C, D, E |
| Betterment items | Advisory suggestions in advisory grammar, quarantined from the findings | An appendix | The observation that acquires an action plan and becomes a finding with worse paperwork | A |
| Rating definitions | The published anchors for the report rating and the finding ratings | An appendix | A rating negotiated instead of derived | All five |
| Follow-up status | Validated closed, implemented pending evidence, or open, each on named evidence | One paragraph per finding | Closure by assertion; “in progress” as a permanent state | E |
How each report’s rating was derived from its findings
Ratings with published definitions are the first design choice in the section below, and the definitions are only half of it; the other half is the rule that connects the finding ratings to the report rating, applied the same way every time. The rule the five reports use is the one in the report template set: Satisfactory means no High findings and any Medium findings contained with plans; Needs Improvement means one or more High findings whose exposure is bounded by a compensating control or was contained during the engagement, or Medium findings that together impair an objective; Unsatisfactory means a High finding on a key control with no compensating control, a repeat High, or a pattern of Highs that says the process is not controlled. The derivation is never an average, and the report says in one sentence how the rule was applied.
| Report | Findings | Derivation | Rating |
|---|---|---|---|
| A, payroll processing | None; two betterment items | All six key controls operated; the analytic resolved every exception; betterment items carry no rating weight by definition | Satisfactory |
| B, accounts payable | 1 High, 1 Moderate | The High was contained during the engagement: the duplicates were confirmed, most were recovered and the near-match fix was specified with a date; the Moderate carries a plan with a retroactive verification; neither is a repeat | Needs Improvement |
| C, third-party risk management | Three design failures with one contributing cause | No inventory, stale tiering and no exit plans are key controls absent, not weak, with nothing compensating, and reporting to the Risk Committee had stopped; the pattern says the program is not controlled | Unsatisfactory |
| D, purchasing cards | 2 High, 4 Medium, 2 Low | Both Highs bounded by the monthly limit and the settlement reconciliation; the routing High corrected in fieldwork; neither a repeat; the Mediums have plans | Needs Improvement |
| E, follow-up on B | 1 closed, 1 open at Moderate | A follow-up report carries the status of findings, not a new rating; the original rating stands until the open finding is validated closed, at which point the next full engagement rates afresh | No new rating |
Two of the derivations are worth arguing with, which is the point of writing them down. Report B’s High could have made the report Unsatisfactory in a function whose definitions treat any High on a payment control as decisive; this library’s definitions ask whether the exposure was bounded or contained, and an audit that found the duplicates, confirmed them and got most of the money back had contained it. Report D’s two Highs could have been read as a pattern; the derivation sentence says why they were not, one was corrected during fieldwork and the other had already been reported one level up the spend stack, so the committee can disagree with the reasoning rather than with an unexplained label. That is what a published rule buys: disagreements about ratings become disagreements about facts and definitions, which are the two things an audit committee is equipped to settle.
The design choices behind all five
Read the five reports side by side and the system underneath them shows. Conclusion first, always: rating and thesis in the first sentence, because executives read the first sentence and the findings titles, and everything else is reference material. One page of executive summary regardless of engagement size — the summary is the report; the rest is the file surfacing. Findings ordered by severity, titled by consequence, each compressible to five sentences. Management responses inline, not exiled to an appendix — the committee should see finding and commitment as one unit, and a response that reads evasive next to a crisp finding is its own signal. Ratings with published definitions (Appendix A in the full reports, Attachment 3 in the short form): a three-tier scale — Satisfactory / Needs Improvement / Unsatisfactory — with written anchors, applied without averaging. And the no-surprises doctrine throughout: nothing in any of these reports was news to its process owner at issuance; the report is the record of a conversation that already happened, which is why even the adverse one could say “management concurs with the facts.”
Final Thoughts
Steal the anatomy, not the words. Your rating scale, section names, and house tone will differ; what should survive translation is the machinery: conclusions stated first and earned visibly, clean opinions that show their work, findings built on the 5 C’s chain, short forms whose tables can stand alone, adverse calls delivered cold with audit’s own commitments attached, and follow-ups that close on evidence and stay open without apology. Pair this library with the findings masterclass for the element-level craft and the model workpaper for the evidence trail underneath, and the whole reporting pipeline, test to finding to report to closure, is now on the site in worked-example form. For the sentence-level skills, our step-by-step report writing guide completes the set.
Where to go next
The reports here are the end of a chain that starts in fieldwork. The accounts payable and purchasing card guides carry the engagements behind Reports B, D and E with every test and its result; the severity matrix is where the finding ratings in every table came from; the report anatomy guide and the template set turn the skeleton above into pages you can fill; and the negotiation guide covers the meeting between the draft and the issue. The Findings & Reporting, Writing and Resources & Templates categories hold the rest.
Related guides
- The 5 C’s of Audit Findings: A Masterclass — the chain every finding in these reports is built on, with five dissections.
- Anatomy of an Internal Audit Report — each section of the skeleton, treated at length, with structures for every reader.
- The Internal Audit Report Template Set — full, short-form and memo shells, annotated, with the rating definitions.
- Finding Severity Ratings: The Calibrated Matrix — the anchors and the grid behind every rating in the tables above.
- How to Write an Internal Audit Report: Step by Step — the sentence-level craft.
- Writing Airtight Audit Conditions — the numbers-only condition lines the findings tables depend on.
- Writing Impact That Lands — consequences in the reader’s currency, as the executive summaries use them.
- Writing Audit Recommendations Management Can Actually Implement — the action plans that sit inline in Reports B and D.
- Finding Makeovers: Five Audit Findings Rewritten — weak findings rebuilt before they reach a report.
- Negotiating Audit Findings Without Watering Them Down — the exit meeting that precedes every report here.
- Evaluating Management Responses — when the action plan in the response section is good enough.
- The Life of a Finding — one finding followed from fieldwork to the follow-up report.
- Issue Validation in Internal Audit — the evidence standard Report E closes on.
- Risk Acceptance by Management — the process that replaces follow-up when management decides to stop.
- The Finding and Issue Log Template — where the findings in these tables live between reports.
- How to Audit Accounts Payable — the engagement behind Reports B and E.
- How to Audit Purchasing Cards — the engagement behind Report D.
- The Annotated Model Workpaper — the evidence trail underneath every result line.
- The IIA’s Third-Party Topical Requirement — the forward-looking criteria Report C cites.
Leave a Reply