The quarterly audit committee deck is the single most consequential document a chief audit executive produces, and most of them are terrible. They are eighty slides where twelve would do, they paste report text into bullet points, they lead with activity and bury the one finding the committee needed to hear, and they leave the committee with no decision to make and no view of whether the function is any good. The committee, which meets for ninety minutes four times a year and gives internal audit perhaps forty of those minutes, learns to skim, and the CAE learns that nothing they present is challenged, which is not the same as being trusted.
This guide is the deck itself: a twelve-slide architecture that covers everything the Global Internal Audit Standards require the chief audit executive to communicate to the board, slide-by-slide templates with the headline, the content, and the presenter’s notes, the design rules that make a slide readable by a director who has forty other pages to get through, and the time-boxing that fits it into a real agenda, including the version for the meeting where the chair gives you twenty minutes. MidState Beverage’s first-quarter FY27 deck is the worked example. The report template set covers the documents the deck summarizes; the CAE interview guide covers how committees judge the person presenting.
In this guide
- What the committee needs, and what the Standards require you to tell it
- The twelve-slide architecture
- Slide-by-slide templates with presenter notes
- Design rules for board-grade slides
- Time-boxing: the forty-minute version and the twenty-minute version
- The pre-read memo and the week before the meeting
- What changes by quarter
- Worked example: MidState’s first-quarter FY27 deck
- Common mistakes
What the committee needs, and what the Standards require you to tell it
An audit committee needs four things from internal audit each quarter: to know whether the coverage it approved is being delivered, to hear the findings that change its view of the organization’s risk and control, to see that management is fixing what was found, and to be given the decisions that are its to make. Everything else is appendix. The Standards turn those needs into requirements on the chief audit executive: communicate the plan and significant changes, report on resources and their adequacy, communicate engagement results and the overall view of governance, risk management, and control, bring unresolved risk acceptance to the board, disclose impairments and limitations, and report quality assessment results and performance measures. The table maps each requirement to the slide that carries it, which is how the architecture was built.
| What the Standards require the CAE to communicate | Standard | Slide | Frequency |
|---|---|---|---|
| The internal audit plan, and significant changes to it, for approval | 9.4 | 3 | Annually for approval; every quarter for changes |
| Resource adequacy and the impact of any shortfall | 10.1, 8.2 | 9 | Every quarter; in full at plan approval |
| Engagement results, and the overall assessment of governance, risk management, and control | 11.3, 15.1 | 2, 4, 5 | Every quarter; overall opinion annually |
| Risk accepted by management that may be unacceptable to the organization, when unresolved with senior management | 11.5 | 8 | As it arises |
| Status of action plans, and escalation of those not implemented | 15.2 | 6 | Every quarter |
| Impairments of independence or objectivity, and scope limitations | 7.1, 2.1 | 9 | As they arise; confirmed annually |
| Quality assessment results and performance measures | 8.3, 8.4, 12.1, 12.2 | 10 | Scorecard every quarter; quality report annually |
| Charter review, external assessment planning, and the CAE’s own performance and independence | 6.2, 8.4, 7.1 | 11 | Annually; external assessment discussion eighteen months out |
| Emerging risks and changes to the audit universe | 9.1, 9.4 | 7 | Every quarter |
One thing the table does not show is the private session, the fifteen minutes at the end of the meeting with management out of the room. It has no slides. It is where the chair asks whether anything was left out of the deck, whether any rating was pressured, and what the CAE is worried about that is not on the plan, and a CAE who has nothing to say in it has usually put it all in the deck already, which is the goal. The Domain III guide covers the board relationship the deck serves.
The twelve-slide architecture
| # | Slide | Purpose | Content | Minutes | Source document |
|---|---|---|---|---|---|
| 1 | Cover and agenda | Orient | Period, date, the four decisions requested today, listed | 1 | None |
| 2 | Dashboard | The state of the function on one page | Plan delivery, engagements rated this quarter by rating, open actions with past-due count, resources against plan, quality scorecard headline, one sentence of the CAE’s overall view | 3 | Metrics sheet; issue log; plan tracker |
| 3 | Plan progress and changes | Coverage promised versus delivered | Engagements complete, in progress, not started, deferred; changes requested with rationale; hours used against plan | 3 | Plan tracker |
| 4 | Engagements reported this quarter | Results at a glance | One row per report: title, rating, number of findings by severity, the headline in one sentence, management’s response summarized in three words | 4 | Final reports |
| 5 | Findings requiring the committee’s attention | The substance | One slide per high or critical finding, at most three: what was found with the number, why it matters, the root cause, what management is doing and by when, what the committee should ask | 10 | Final reports; the five Cs |
| 6 | Open actions and aging | Is management fixing things | Open actions by rating and age band; past due with owner names; past due twice, escalated; validated closures this quarter | 4 | Issue log; the issue log template |
| 7 | Emerging risks and universe changes | What is changing | Three to five risks the function is watching, each with the plan response; entities added to or removed from the universe | 3 | Risk assessment; regulatory feed |
| 8 | Decisions for the committee | What is theirs to decide | Risk acceptances brought under Standard 11.5; plan changes for approval; escalated actions; each with the CAE’s recommendation | 4 | Correspondence; issue log |
| 9 | Resources, independence, and limitations | Can the function do the job | Headcount against plan, vacancies, co-source usage, budget; any impairment or scope limitation and how it was handled | 2 | Budget; staffing memos |
| 10 | Quality and performance | Is the function any good | The scorecard with trend; QC exceptions; survey scores; quality actions open and closed; annual: the quality report | 2 | Metrics sheet; the QAIP kit |
| 11 | Administrative | Housekeeping that needs a minute | Charter review, external assessment plan, policy approvals, the CAE’s annual independence confirmation, training | 2 | Charter; QAIP |
| 12 | Appendix | Depth on request | Executive summaries of every report, the full open issue list, plan detail by engagement, the metrics definitions | 0 | Everything |
Forty minutes for slides one to eleven, with slide five taking a quarter of the time, and the appendix sent as a pre-read and never presented. The order is deliberate: the dashboard tells the committee where things stand before any detail, the substance comes in the first half while attention is highest, the decisions come after the committee has heard the evidence for them, and the administrative items come last because they are the ones that can be taken in thirty seconds if time runs out.
Slide-by-slide templates with presenter notes
The templates below give each slide its headline pattern, its content, and the presenter’s note that goes beneath it. Headlines are sentences that state the message, not labels that name the topic; “Plan delivery is on track with two deferrals for approval” is a headline, “Plan update” is not. Content is written as short statements with numbers, never as pasted report paragraphs.
Slide 1. Cover and agenda. Headline: Internal Audit report to the Audit Committee, [quarter, year]. Content: the meeting date; a numbered list of the decisions requested today (approve plan changes; note the risk acceptance on [item]; approve the external assessment budget); the pre-read reference. Presenter note: name the decisions in the first thirty seconds so the committee knows what it is being asked to do before it hears anything else.
Slide 2. Dashboard. Headline: one sentence that is the CAE’s overall view this quarter (“Control environment stable; route cash remediation on schedule; two areas past due”). Content, in six tiles: plan delivered [n] of [n] with hours used [percent]; engagements reported [n], rated [n] satisfactory, [n] needs improvement, [n] unsatisfactory; open actions [n], past due [n], past due twice [n]; validated closures this quarter [n]; resources [n] of [n] positions filled, co-source hours used [n]; quality scorecard [n] of [n] measures on target. Presenter note: this is the only slide some members will read; every number on it must reconcile to a later slide or the appendix.
Slide 3. Plan progress and changes. Headline: the delivery message (“Six of eight engagements in progress or complete; acquisition integration deferred one quarter at management’s request; we recommend approval”). Content: a status bar of the plan by engagement; hours used against budget; changes requested with the reason, the risk of deferral, and the CAE’s recommendation. Presenter note: a deferral is a coverage decision the committee owns; say what will not be looked at this year as a result.
Slide 4. Engagements reported this quarter. Headline: the pattern (“Three reports issued; one Unsatisfactory in route cash, two Satisfactory”). Content: a table, one row per report: engagement, rating, findings by severity, the one-sentence headline, management’s response in three words (agreed and funded; agreed, risk accepted on one item; disputed). Presenter note: do not walk the table; point at the row that leads to slide 5.
Slide 5. Findings requiring the committee’s attention (one slide per finding, maximum three). Headline: the finding as a sentence with its number (“1,412 of 37,400 route settlements had variance overrides approved by the person whose variance it was”). Content: why it matters in one line, with the exposure; the root cause in one line; what management has committed to, with owner and date; validation date; the question the committee should ask management. Presenter note: this slide is the reason the committee exists; give it the time and expect questions. Never soften the headline to protect a relationship.
Slide 6. Open actions and aging. Headline: the trend (“Open actions down from 31 to 24; three past due, one escalated”). Content: open actions by rating and age band (0 to 90 days, 91 to 180, over 180); past-due actions listed by name with owner and new date; actions past due twice with the escalation status; closures validated this quarter and closures on assertion, separately. Presenter note: name the owners; the committee cannot hold anonymous management accountable.
Slide 7. Emerging risks and universe changes. Headline: what has changed since the plan (“Two new obligations and one acquisition added to the universe; no plan change needed this quarter”). Content: three to five items, each with what changed, why it matters to this organization, and the function’s response (added to the plan, monitoring, advisory engagement, no action with reason). Presenter note: this is the slide that shows the function looks forward; keep it to risks with a response, not a news digest.
Slide 8. Decisions for the committee. Headline: the decisions, numbered. Content, per decision: what is being decided, the options, the CAE’s recommendation, and what happens if the committee declines. For a risk acceptance under Standard 11.5: the risk, management’s rationale, the CAE’s view of why it may be unacceptable, and the recommendation. Presenter note: stop talking after the recommendation and let the chair call the decision; record it in the minutes in the words used.
Slide 9. Resources, independence, and limitations. Headline: the capacity message (“Fully staffed; co-source within budget; no impairments to report”). Content: positions filled against plan; vacancies and their effect on the plan; co-source hours and spend against budget; any independence or objectivity impairment and how it was managed; any scope limitation imposed and its effect. Presenter note: a shortfall goes here with its impact on coverage, in the words of Standard 10.1; the committee decides what to do about it, not the CAE.
Slide 10. Quality and performance. Headline: the scorecard message (“Five of six measures on target; report cycle time improved to 14 days median”). Content: the metrics sheet as one table with target and trend; QC exception count; survey scores; quality actions open and closed; in the fourth quarter, the annual quality report’s conformance statement. Presenter note: the committee should see the function measured the way the function measures everyone else.
Slide 11. Administrative. Headline: “Items for noting.” Content: charter review date; external assessment plan and budget; policy or methodology changes; the CAE’s annual independence confirmation; training and credentials. Presenter note: thirty seconds unless a decision is on it.
Slide 12 onward. Appendix. Executive summary of each report issued, one page each; the full open issue list; plan detail by engagement with hours; metrics definitions; the risk acceptance correspondence. Presenter note: never presented; referenced by page number when a member asks.
Design rules for board-grade slides
A committee member reads a slide the way a regulator reads a report: quickly, looking for the number, and suspicious of anything that seems designed to reassure. The rules below are the ones that survive contact with real committees, and each has a reason that is about how directors read rather than about aesthetics.
| Rule | What it means in practice | Why |
|---|---|---|
| Headline is the message | Every title is a full sentence stating the conclusion; a reader who sees only titles gets the whole story | Directors read titles first and often only; a label wastes the most-read line on the slide |
| One message per slide | If a slide has two conclusions, it is two slides | Mixed messages get the weaker one remembered |
| Every number has a comparator | 24 open actions, down from 31; 3 past due, against a tolerance of zero | A number without a comparator is a fact without a meaning |
| Ratings in words and a consistent color | Satisfactory, Needs Improvement, Unsatisfactory, in the same three colors every quarter, never a traffic light without the word | Color alone fails for a quarter of readers and every printed pack |
| No report text | Findings are restated for the slide: number, exposure, cause, action, date; the report is in the appendix | Report paragraphs on slides are unreadable at any font size |
| Eighteen-point minimum | Body text at 18 points or larger; tables at 14 with no more than eight rows | Packs are read on tablets and printed at reduced size |
| Name the owners | Past-due actions and findings carry the responsible executive’s name and title | The committee holds people accountable, not functions |
| The three-second test | Show the slide to someone for three seconds and ask what it said; if they cannot, rebuild it | That is how long most slides get |
| Source every figure | A footer reference to the report, log, or sheet each number came from | A committee member who can trace a number trusts the next one |
| Same structure every quarter | Slides in the same order with the same layouts; only the content changes | Directors learn where to look; a redesigned deck costs a quarter of attention |
| Bad news first, plainly | The Unsatisfactory rating is in the dashboard sentence and the first row of slide 4 | Committees forgive bad findings and never forgive discovering one on slide 30 |
Time-boxing: the forty-minute version and the twenty-minute version
The deck is built for forty minutes, and the chair will sometimes give you twenty, usually because the external auditor overran or a transaction is on the agenda. The version for that meeting is not the same deck presented faster; it is a different selection with the same numbers, and the rule for building it is that nothing the committee must decide and nothing the Standards require the CAE to communicate is dropped. The pre-read carries the rest, and the pre-read memo, two pages sent five business days ahead with the deck, is what makes the twenty-minute version work: it tells members what is in the pack, which slides carry the decisions, and what changed since the last meeting, so that the meeting can start from the substance.
| Slide | Forty minutes | Twenty minutes | Ten minutes, the emergency version |
|---|---|---|---|
| 1 Cover and agenda | 1 minute | 1 minute | 30 seconds: the decisions only |
| 2 Dashboard | 3 | 2 | 2 |
| 3 Plan progress | 3 | 1, changes for approval only | Pre-read; approval requested verbally |
| 4 Engagements reported | 4 | 1, point at the row that matters | Skip; in pre-read |
| 5 Findings for attention | 10 | 8, the top finding only if three exist | 4, one finding |
| 6 Open actions | 4 | 2, past-due and escalations only | 1, escalations only |
| 7 Emerging risks | 3 | 1, one item | Skip |
| 8 Decisions | 4 | 3 | 2 |
| 9 Resources and independence | 2 | 30 seconds, impairments or shortfalls only | Only if there is one |
| 10 Quality | 2 | Pre-read | Skip |
| 11 Administrative | 2 | Pre-read, decisions taken verbally | Skip |
| Private session | 15, outside the slot | 10, protected | 5, never dropped |
The private session is the one item that does not shrink to zero. A CAE who lets it be dropped for time has told the committee, without saying so, that there is nothing they would say with management out of the room, and a committee that lets it be dropped has told the CAE that independence is a formality. Ask the chair to protect it before the meeting, not during. The internal audit department guide covers what the private session is for.
The pre-read memo and the week before the meeting
The deck is only half of the pack. The other half is a two-page memo, sent with the deck five business days before the meeting, that does three things: it lists the decisions requested with a one-line recommendation for each, it states what changed since the last meeting in five or six sentences, and it tells the reader which slides and appendix pages to read if they have ten minutes. Members who read the memo arrive able to challenge; members who do not still get the decisions in the first thirty seconds of the meeting. The memo is also the place to warn the chair, in writing, of anything contentious, because a chair surprised in the room by an Unsatisfactory rating or a risk acceptance dispute will spend the meeting managing the surprise rather than the substance.
Pre-read memo, [quarter]. To the Audit Committee from the Chief Audit Executive. Decisions requested at this meeting: 1. [decision, recommendation]. 2. [decision, recommendation]. 3. [decision, recommendation]. Since the last meeting: [five or six sentences: reports issued and their ratings; the finding the committee should focus on; actions closed and past due; any resource, independence, or limitation matter; any risk acceptance brought under Standard 11.5]. If you read one thing: slide 5 and appendix page [n]. Questions from the last meeting, answered: — [answer, slide reference]. Contact before the meeting: [CAE, direct line].
The week before the meeting has its own routine. The CAE briefs the chair by phone on the substance and the decisions, so the chair can plan the agenda and the private session. The CAE briefs the chief executive and chief financial officer on what the deck says, not to negotiate it but so that nobody in the room is surprised by their own function’s finding; a rating does not change in that briefing, and the CAE says so at the start of it. And every number on the dashboard is reconciled to its source one last time, because the first number a director finds wrong is the last number they trust.
What changes by quarter
| Quarter | Additional content | Decisions requested | Slides affected |
|---|---|---|---|
| First | Prior-year completion: final plan delivery, the annual overall opinion on governance, risk management, and control if not given at year end; the year’s first results | Confirm the plan; approve the budget if not done | 2, 3, 4 |
| Second | Mid-year plan review: reprioritization against the updated risk assessment; validation results from the first follow-up window | Plan changes; escalations | 3, 6, 8 |
| Third | Preview of next year’s risk assessment and universe changes; resource request for the next plan; external assessment planning if due within eighteen months | Direction on next year’s coverage; external assessment approach | 7, 9, 11 |
| Fourth | Next year’s plan for approval; the annual quality report with the conformance statement; the CAE’s independence confirmation; charter review | Approve the plan and budget; note the quality report; approve the charter | 3, 10, 11, plus the plan paper from the plan template |
Worked example: MidState’s first-quarter FY27 deck
MidState Beverage’s chief audit executive presented the first-quarter FY27 deck to an audit committee of three directors in a forty-minute slot, with the route cash report as the substance and a risk acceptance as the decision. The deck was eleven slides plus a nineteen-page appendix sent five days ahead with a two-page pre-read memo. The table shows what each slide carried; the numbers are the ones that appear across this site’s MidState examples, and the point of the table is how little text a slide needs when the numbers are right.
| Slide | Headline | Content | Minutes used |
|---|---|---|---|
| 1 | Internal Audit report to the Audit Committee, Q1 FY27 | Three decisions requested: note the risk acceptance on customer statements; approve the FY28 external assessment budget; approve the acquisition integration timing change | 1 |
| 2 | Route cash controls failed at nine of twelve depots; remediation is funded and on schedule; the rest of the environment is stable | Plan 2 of 8 reported, 3 in progress, hours 23 percent used; 1 Unsatisfactory, 1 Satisfactory; 24 open actions, 3 past due, 1 escalated; 6 of 6 positions filled, co-source 40 of 140 hours used; 5 of 6 quality measures on target | 3 |
| 3 | Plan on track; acquisition integration audit moved from Q2 to Q3 at the CFO’s request, recommended for approval | Status bar; the deferral’s reason (ERP migration slipped), the risk of waiting one quarter, and the CAE’s view that the audit is more useful after migration | 3 |
| 4 | Two reports issued: route cash Unsatisfactory with five findings; fleet maintenance Satisfactory with two | Two rows; management response “agreed and funded” for route cash except one item, “agreed” for fleet | 2 |
| 5a | 1,412 of 37,400 route settlements had variance overrides approved by the person whose variance it was | Exposure: the same pattern let an $18,400 diversion run five months in FY26; cause: ERP roles allowed self-approval and no cross-depot review existed; action: role change live, monthly override report to the controller, VP Operations, 31 May; validation in the Q4 window; committee question: how do we know the role change covers all twelve depots | 5 |
| 5b | Settlement reconciliations were prepared and reviewed by the same person, or by someone who handled the cash, at nine of twelve depots | Exposure: the primary detective control over $31 million of cash was not independent; cause: depot staffing assumed a separation the depots did not have; action: reconciliation moved to the clerk with manager review, staffing adjusted at three depots, Director of Route Accounting, 30 June; committee question: what does the staffing change cost and is it in the budget | 5 |
| 6 | Open actions down from 31 to 24; three FY26 actions past due; the handheld sync-failure action escalated to the COO | Aging bands; the three past-due actions with owners and new dates; one escalated action with the COO’s response; 7 closures validated, 0 on assertion | 4 |
| 7 | Two new obligations added to the universe; the compliance inventory from the DOT advisory is complete | State privacy statute, effective in eighteen months, added to FY28 candidates; DOT compliance program first assurance scheduled FY28; no plan change now | 3 |
| 8 | Decision: management has accepted the residual risk on statements for 1,130 customers until ERP migration; the CAE recommends the committee require interim statements | Management’s rationale (cost of a manual run; migration in ten months); the CAE’s view (unstated customers were how the FY26 loss went undetected); options: accept, require a quarterly manual statement run, require monthly; recommendation: quarterly, at an estimated cost management confirmed as modest | 5 |
| 9 | Fully staffed; co-source within budget; no impairments | Six of six; 140 co-source hours contracted for the ERP access audit; no limitations | 1 |
| 10 | Five of six measures on target; report cycle time at 16 days median against a 15-day target | The scorecard with FY26 baseline and Q1; QC exceptions 2, both on IPE testing, training done; first survey results: 4.4 mean, fairness 4.0 on the route cash report | 2 |
| 11 | Items for noting and one approval | FY28 external assessment: validated self-assessment recommended, budget requested, approved; charter review scheduled Q4 | 2 |
The committee took thirty-three minutes, spent nine of them on the risk acceptance, required the quarterly statement run, approved the external assessment budget, and asked one question the CAE had not anticipated: whether the depot staffing change on slide 5b would be validated before or after the summer volume peak. The private session ran twelve minutes. The following quarter’s deck opened with the answer to that question, which is the other rule of committee decks: every question the committee asked last time is answered on a slide this time, whether or not it was asked again. The report examples guide has the route cash findings as they appeared in the full report the appendix carried.
Common mistakes
| Mistake | What it looks like | Fix |
|---|---|---|
| The eighty-slide deck | Every report summarized on three slides each; the committee skims | Twelve slides; reports in the appendix; one slide per finding that matters |
| Activity as the message | Hours charged, reports issued, meetings held | Coverage delivered, findings that matter, actions closed, decisions needed |
| Labels for titles | “Plan update”, “Findings”, “Resources” | Sentences that state the conclusion |
| Bad news on slide 30 | The Unsatisfactory rating after twenty slides of green | Dashboard sentence first; slide 4 first row |
| No decisions | The committee is informed and asked nothing | Slide 8 exists in every deck, even when the decision is to note a risk acceptance |
| Anonymous management | “Management has agreed to remediate” | Owner name and title, date, validation date |
| Report text on slides | Paragraphs at ten-point type | Number, exposure, cause, action, date; nothing else |
| Re-designed every quarter | A new template each meeting | Same twelve slides, same order, same layouts, forever |
| The private session dropped | “We’ll skip it this time, we’re over” | Protected with the chair before the meeting |
| Last quarter’s questions forgotten | The committee asks the same thing twice | A slide answers every question from the last meeting |
The deck is the function’s quarterly account of itself to the people it works for, and its quality is judged by what the committee does with it: the questions it asks, the decisions it makes, and whether, in the private session, the chair has anything left to ask that the slides did not already answer. Build it to the twelve-slide architecture, present it in forty minutes or twenty, and the committee will start to arrive having read it, which is the only measure of a board pack that counts.
Related guides
- Internal audit report template set
- Internal audit plan template
- Finding and issue log template
- The QAIP documentation kit
- Building a QAIP from scratch
- Finding severity ratings
- The five Cs of audit findings
- Internal audit report examples
- GIAS Domain III: governing the function
- GIAS Domain IV: managing the function
- The chief audit executive interview
- Inside the internal audit department
- Co-sourcing vs. outsourcing: a board-level comparison
- Start here
Leave a Reply