A draft internal audit report is the auditors’ document, sent to you for two purposes: to catch anything factually wrong before it becomes permanent, and to collect your response. In the window you are given, which in most functions is five to ten working days and is sometimes as short as two, you can still change five things: the facts, the wording of the condition, the stated cause, the rating where the corrected facts no longer meet the definition, and your management response. You cannot change the scope, the existence of a finding the evidence supports, the auditors’ conclusion, or the distribution list, and every hour spent arguing those is an hour taken from the five that move.
This guide is the operating method for the whole document under time pressure, written from the audit side of the table so you know what the team is thinking when your comments arrive. It covers what a draft is and is not at this stage, a 48-hour plan with named roles, a comment taxonomy the auditors can act on, the fact-check, the executive summary (the one page that matters most), the phrases that signal more than they say, a comment memo template, the timing rules, and how your comments are recorded. It sits between the auditor-side closing meeting playbook and the finding-level guide to disputing a single finding; for the full arc of an audit from your chair, start at the Being Audited? hub.
One assumption: the findings in the draft were discussed with you before it arrived. If one is new, raise that before anything else in this guide.
In this guide
- What the draft is at this stage, and what it is not
- The 48-hour review plan: roles and hours
- The five things you can still change, and the things you cannot
- Read the executive summary first, and last
- Reading between the lines: what the phrases signal
- How to mark up the draft: a comment taxonomy
- Running the fact-check: trace every number and date
- Cause, rating and the response block in the time left
- The formal comment memo
- Timing rules: deadlines, extensions and what happens if you miss them
- How your comments are recorded under Standards 13.1 and 15.1
- Common review mistakes and their consequences
- Worked example: one finding marked up, before and after
- Questions readers ask
- Related guides
What the draft is at this stage, and what it is not
By the time a draft reaches you, the auditors consider fieldwork closed and the findings settled in substance. Standard 13.1 of the Global Internal Audit Standards requires communication with management throughout the engagement, and in a well-run function each finding was walked through with its owner before the closing meeting. The draft is therefore not a first look. It is the written version of what you were told, with ratings applied, the overall conclusion derived and the executive summary written. What it adds is permanence: the words in the draft are the words the audit committee will read unless something changes them in the next few days.
Three patterns of draft are common. This is practitioner observation rather than anything the Standards prescribe; your function’s methodology will say which it uses.
- One draft with everything. Findings, finding ratings, the overall rating and empty response blocks, with a single deadline for corrections and responses. The most common corporate pattern, and the one this guide assumes.
- A two-step draft. A factual-accuracy draft first, sometimes with ratings marked provisional, then a revised draft for responses. Use the first window for facts and context only; positions on cause and rating belong in the second, when the facts are settled.
- Finding sheets, then the draft. Findings were issued and confirmed during fieldwork and at the closing meeting; the draft assembles them, and comments are expected to be light. Material corrections at this stage mean something in the earlier conversations did not land, and the auditors will read it that way too.
What the draft is not: a negotiation document, a private communication to you (the audit lead, the audit manager and often the chief audit executive have already reviewed it), or final. It usually carries the same handling restriction as the final report. The auditors are bound by Standard 5.2 to protect the information they gathered, and a draft forwarded beyond your review team is the quickest way to find that future drafts arrive later and with less in them. The chief audit executive owns the content and signs the report. You own your response, and nothing else in the document is written in your voice.
Public-sector readers will recognize a more formal version of the same stage. The GAO’s Government Auditing Standards (the Yellow Book) tell auditors to obtain and report the views of responsible officials on findings, conclusions, recommendations and planned corrective actions, and state that written comments are preferred. Where comments conflict with the findings, auditors evaluate their validity, modify the report if they are valid and supported by sufficient, appropriate evidence, and otherwise explain their disagreement in the report; if no comments arrive within a reasonable period, the report may be issued without them, saying so. Corporate functions rarely publish your comment memo, but they record it and act on it, as the section on how comments are recorded explains.
One more anchor. Standard 11.2 requires the auditors’ communications to be accurate, objective, clear, concise, constructive, complete and timely. Those seven words are the most useful frame you have for the next 48 hours. A comment showing the draft failing one of them must be taken seriously, because the function’s own quality reviewers use the same words. A comment asking the auditors to be less accurate or less complete must be refused, however politely it is put.
The 48-hour review plan: roles and hours
Whatever deadline you were given, run the review as a 48-hour exercise with named roles. The reason is sequencing. The fact-check has to finish before the comment memo can be written; the memo has to be seen by your executive before it goes; any action you commit in another function’s name needs that function’s written agreement; and the auditors need time to consider your points and revise before the committee pack cut-off. A review that starts on the last day produces a memo full of unverified assertions and responses that will fail validation a year later.
The roles, with the one thing each must not do:
- Accountable owner (the manager or director named in the draft). Reads everything, decides every position, signs the memo. Must not rewrite the auditors’ prose line by line; that is the fastest way to have the whole package set aside.
- Fact-checkers (one per finding, or one per data source). Trace every number, date, name and reference to its source and complete the trace sheet. The best pairing is the person who pulled the original evidence for the auditors plus one person who did not. Must not argue cause or rating; their output is facts.
- Response writer (one pen for all findings). Drafts every response block in the same voice from the closing meeting notes and the owner’s decisions. Must not commit an action owned by someone else without that person’s written agreement.
- Coordinator (often whoever ran the request list during fieldwork). Version control, evidence file naming, the attachments index, the submission. Must not forward the draft outside the review team.
- Executive sponsor (the executive whose name is on the distribution list). Two touchpoints: a 15-minute pre-brief around hour 20 and approval around hour 36. Also the route to the chief audit executive if a disagreement is significant enough to escalate.
- Other owners (IT, HR, finance, a vendor manager) whose actions you need. Asked on day one, answering in writing by hour 32.
| Hours | Who | What | Output |
|---|---|---|---|
| 0–1 | Owner | Read the executive summary and the summary of findings table only. Log the deadline. Confirm receipt with the audit lead and ask for three things: the item-level exception detail behind each number, the rating definitions if they are not in an appendix, and whether a revised draft will come back to you before issue. Name the review team. | Deadline on three calendars; requests sent; team named |
| 1–3 | Owner | One full read without a pen. A second read marking each paragraph with a comment type from the taxonomy below. Allocate findings to fact-checkers and brief them on the trace sheet. If the deadline is not workable, ask today for a specific extension with a reason. | Marked draft; fact-check assignments; extension request if needed |
| 3–8 | Fact-checkers; writer; owner | Trace sheets started: every number, date, name, system, policy clause and period. Writer builds response skeletons, one per finding, from the closing meeting notes. Owner checks each rating against the published definitions and drafts any cause argument. | Trace sheets half complete; response skeletons; list of other owners to contact |
| 8–24 | Fact-checkers; coordinator; owner | Trace sheets complete, with evidence files pulled, named and indexed. Owner decides which corrections, omissions and wording requests go in, and which disagreements, if any, are worth recording. | Completed trace sheet; evidence pack v1; decision list |
| About 20 | Owner; executive | Fifteen-minute pre-brief: what the report says, what will be corrected, what will be accepted, whether anything will be disputed and how far. No executive should learn the rating from the committee pack. | Executive informed before any surprise |
| 24–32 | Owner; writer | Draft the comment memo and the response blocks. Collect written agreement from other owners for actions in their name. Call the audit lead to preview the two or three largest points before they arrive in writing; no surprises works in both directions. | Memo v1; responses v1; agreements in hand; audit lead not surprised |
| 32–40 | Executive; legal or compliance if needed | Executive review of memo and responses. Legal or compliance review only where a finding has regulatory or contractual consequences. Dates confirmed against release calendars, hiring plans and committee dates. | Approved memo and responses |
| 40–48 | Coordinator; owner | Submit the memo, the marked-up draft, the evidence pack and the responses as one package. Confirm receipt. Ask when the revised draft will arrive and whether you may see it before issue. Record what was sent and when. | Submission logged; next date in the diary |
If the deadline is longer than 48 hours, keep the plan and spend the extra days on the dependencies (other owners’ agreement, IT release dates, a budget conversation), not on a slower fact-check. The facts do not get more accurate with time; the responses do get more realistic.
The five things you can still change, and the things you cannot
Take the five in the order the auditors will consider them, because each depends on the one before.
- The facts. The condition is a statement of what was found: numbers, dates, populations, periods, the names of systems and policies. Facts are the cheapest thing to change, and the auditors want them right, because a wrong number in a final report is their error, and Standard 11.4 requires a significant error or omission in a final communication to be corrected and recommunicated to everyone who received it. Evidence wins; explanation does not. The hierarchy the auditors apply to audit evidence applies to your corrections: system records and dated documents from the period, not a spreadsheet built this week.
- The wording of the condition. Once the facts are right, the characterization has to match them. “Routinely”, “pervasive”, “no controls” and “unauthorized” are claims about the population, and the tested population either supports them or it does not. Ask for wording that is more precise, never merely softer. The auditor-side rules for writing airtight conditions are the test the auditors apply to themselves; hold them to it.
- The cause. The cause drives the action, and Standard 14.3 expects the auditors to work with management to identify root causes where possible. “Lack of oversight” and “insufficient training” are placeholders. If you can show a design feature, a system behavior or a dependency that explains more of the exceptions, it is in both sides’ interest to use it; the guide to cause statements that point to the fix shows what a cause the auditors will accept looks like.
- The rating, within the definitions. Ratings move when facts move or when a definition was misapplied; they do not move because the rating is unwelcome. Get the definitions, apply them to the corrected facts, and argue in those terms. The calibrated severity matrix explains how a typical function derives finding ratings and the overall report rating; if your function publishes its own rule, argue from that one.
- Your response. The only part of the report written in your words and marked as yours: position, action, cause addressed, owner, date, interim measure, evidence of completion. The craft of action plans that close is covered separately; the point here is that the response is where any disagreement you could not resolve lives, in your words, permanently.
The things you usually cannot change were settled earlier or belong to someone else. Scope and period were fixed at planning, and the time to contest them was then; the guide to disagreements about scope, timing and access covers that conversation. A finding supported by evidence stands even if the control has since been fixed, because the finding describes the period tested; Standard 15.1 requires the final communication to acknowledge actions you have already started or completed, and that acknowledgment is what to ask for instead of deletion. The conclusion and the overall rating are the chief audit executive’s judgment applied through a published rule. The distribution list follows the charter.
| Element | Changeable at draft stage? | What it takes | What the auditors do with your comment |
|---|---|---|---|
| Numbers, dates, names, periods, references | Yes | Evidence that predates the audit request: system records, dated documents, workflow logs | Verify, correct the text, recompute dependent figures |
| Characterization of the condition (adjectives, generalizations) | Yes | A more precise formulation tied to the tested population | Accept precision; refuse softening; may add the population basis to the text |
| Omitted context (compensating control, permitted exception, prior self-identification) | Yes | Evidence the context existed during the period tested | Add it; reassess effect and possibly rating |
| Cause | Yes | A cause that explains more of the exceptions, with evidence of how the process runs | Discuss; adopt it, or state both causes; adjust the recommendation |
| Effect and exposure statement | Partly | Corrected numbers; a basis for any exposure figure | Recompute the numbers; keep the risk statement, which is their judgment |
| Finding rating | Only within the definitions | Corrected facts, or a definition misapplied | Re-derive; change if the definition says so; otherwise record your position |
| Recommendation | Indirectly | A workable alternative action addressing the same cause (Standard 14.4 allows management action plans in place of recommendations) | Record your action plan; the recommendation may stay as written |
| Your management response | Entirely | Position, action, owner, date, interim measure, evidence of completion | Include in your words; add an auditor’s comment only if they disagree |
| Existence of an evidenced finding | No | Only new evidence that the condition did not exist, or that the criterion did not apply in the period | Keep the finding; record your disagreement |
| The auditors’ conclusion | No | Nothing at this stage | Record your position in the response |
| Scope, objectives, period | No | Settled at planning | May add a scope note; nothing else |
| Overall report rating | Only through the findings | Finding ratings that change under the published rating rule | Re-derive under the rule and show the derivation |
| Distribution list | Rarely | A request to add a co-owner; removals are the chief audit executive’s decision | Decide under the charter and methodology |
| Timetable to the committee | No | An early extension request, at most | Meet the pack cut-off, with or without your response |
Read the executive summary first, and last
The readers who decide what an audit report means for you, the audit committee and your executive’s peers, read the executive summary and little else. The guide to the audit report executive summary explains how it is built in five moves across three paragraphs: the reason for the work, the verdict with the rating, a digest of the findings that drive it with their numbers, what worked, and what happens next, including your actions and any disagreement. Your review of that page has one purpose: to make sure it says exactly what the findings say, no more and no less.
Read it first because it tells you what the auditors think the story is, which is not always what the finding blocks add up to. Read it last, after the fact-check, because every number in it must match the corrected blocks, and because summaries are written before drafts are corrected and are the part most often not re-read. The same discipline applies to the summary of findings table: titles, ratings and dates in the table must match the blocks, and readers who skim see the table, not the blocks.
| Element of the summary | What to check | Comment type if it is wrong |
|---|---|---|
| Verdict sentence | Does it describe the area the way the evidence supports: which processes, which period? A verdict about “procurement” when the findings are about purchase order timing is a precision problem, not a tone problem. | Precision, with proposed wording |
| Rating derivation | Does the sentence explaining the overall rating match the published rule and the finding ratings after correction? | Rating, argued from the definitions |
| Theme sentences | Do the themes group findings by the causes stated in the blocks, or do they introduce a cause (“culture”, “oversight”) that appears nowhere else in the report? | Cause, or precision |
| Finding digest numbers | Does every number carry the same numerator, denominator and period as the finding block it summarizes? | Factual correction, cross-referenced to the block |
| What worked | Is it specific? If the auditors tested effective controls in your area and said nothing about them, ask for one sentence; Standard 11.2 asks for communication that is complete as well as accurate. | Omission |
| What happens next | Are your actions, owners and dates stated as you wrote them, most important first? Any unresolved disagreement belongs here too, not only under finding 3. | Response content; omission |
| Status of prior findings | Repeat or overdue items are named here; check each against the issue log and the validation record. | Factual correction |
| Committee-pack version | Some functions prepare a fifty-word version for the pack. Ask to see it; for most committee members it is the report. | Request |
Reading between the lines: what the phrases signal
Audit reports are written in a controlled vocabulary. Most of it is neutral. Some words are load-bearing because the rating rule, the committee or a regulator reads them as signals, and the auditors chose them knowing that. The table is a practitioner reading of the ones that matter most to a manager with a pen in hand; where your function’s methodology defines a term formally, the definition governs.
| Phrase in the draft | What the auditor usually means | What it does to the rating or the reader | What to do in your comments |
|---|---|---|---|
| “Pervasive” or “systemic” | The exceptions are spread across the population, period and locations, not clustered | Often the difference between a Medium and a High; the committee hears “everywhere” | Ask for the basis. If the exceptions concentrate in one month, site or vendor group, show the distribution and propose “concentrated in” |
| “Repeat finding” or “previously reported” | A prior finding on the same control was closed and the condition has returned, or was never fixed | Most rating rules escalate a repeat; committees react to it more than to any single rating | Check the prior finding’s substance and its validated closure. If the control or the cause is different, say so with the prior report reference |
| “Management is aware” or “was aware” | The issue was known and not fixed | Read by the committee as an accountability signal about you | If you self-identified it, logged it and acted, insist on the full sentence: identified when, logged where, action requested, blocked by what |
| “No evidence was provided” or “could not be evidenced” | The control may have operated but nothing proves it | The finding is about evidence of operation; the fix is usually cheap | Provide contemporaneous evidence if it exists. Never create it now; say the control ran but was not evidenced |
| “Not designed effectively” versus “not operating effectively” | The control as designed cannot achieve its objective, versus the design is fine and execution failed | Different remediation, different implication for your team | Confirm which is being asserted; a design finding needs a design response, not retraining |
| “Management stated” or “according to management” | The auditors have not verified the statement | Reads as a claim, not a fact | Supply the evidence so the statement becomes a verified fact, or accept the attribution |
| “In internal audit’s judgment” | An opinion element: effect, significance or rating | Facts can inform it; argument cannot overturn it | Offer facts that bear on the judgment; do not ask for the opinion to be withdrawn |
| “Compensating control” present or absent | If present, the auditors accept that a second control reduces the exposure | Often justifies a one-level downward override of the finding rating; at report level it can be the difference between Needs Improvement and Unsatisfactory | If you have one and it is absent, that is an omission comment with evidence; the guide to compensating controls shows what qualifies |
| “Auditor’s comment” under your response | The auditors disagree with your response or consider it inadequate | The committee sees two positions under the finding | Find out before the final what would remove it; usually a named owner, a real date or an action that addresses the cause |
| “Isolated” or “limited to” | The auditors believe the condition does not generalize | Good for you | Check that it is accurate and make sure it survives into the final |
| “Matters referred” or “referred to” | Something has gone to investigation, legal or compliance | Nothing about it will be discussed | Do not comment on it in the memo; follow the protocol you have been given |
How to mark up the draft: a comment taxonomy
Drafts come back to us in one of two forms: a document with every sentence rewritten in tracked changes, or a numbered list of specific points, each with a type and, where needed, evidence. The first takes a day to triage and most of it is refused; the second takes an hour and most of it is accepted. Where it helps, name the attribute of Standard 11.2 the comment invokes: a factual correction is about accuracy, an omission about completeness, a precision request about objectivity and clarity.
| Type | Use it when | Format | Example | What the auditors usually do |
|---|---|---|---|---|
| 1. Factual correction | A number, date, name, period, system or reference is wrong | “Draft says X. Correct: Y. Evidence: file reference.” | “Draft says 19 of 45. Four of the 19 are call-offs against blanket orders approved before the invoice date (ERP extract CR-PO-07). Correct: 15 of 45, before the exception in item 2.” | Verify the evidence; change the text; recompute every dependent figure |
| 2. Omission | A material fact that existed during the period is missing | “Add after paragraph N: text. Evidence: reference.” | “Add: the emergency-repair exception in PP-04 section 5.1 applied to 2 of the items; approvals attached.” | Add it if evidenced; reassess effect and rating |
| 3. Precision (wording) | The characterization overreaches the tested facts | “Replace A with B because evidence.” | “Replace ‘routinely procured without authorization’ with ‘committed before a purchase order was raised’; 9 of the 13 had budget-holder approval before commitment.” | Accept wording that is more accurate; refuse wording that is only softer |
| 4. Cause | The stated cause does not explain the exceptions | “Proposed cause: text. Basis: evidence.” | “The ‘no-PO’ vendor flag permits invoice entry without a purchase order for 212 vendors; the list has not been reviewed since the 2024 cutover; 11 of the 13 exceptions are flagged vendors.” | Discuss; adopt it or state both; adjust the recommendation |
| 5. Rating, within definitions | The corrected facts no longer meet the definition applied | “The definition of High requires X; corrected facts show Y; proposed rating Z.” | “High requires a key control failing across the period; the corrected exceptions fall in the two cutover months.” | Re-derive; change only if the definition says so; otherwise record your position |
| 6. Disagreement with the finding | You believe no reportable condition exists | “Management disagrees because reason. Evidence: reference.” | “The review operated; the workflow approval log attached was not requested during fieldwork.” | Consider new evidence; otherwise keep the finding and record both positions |
| 7. Response content | Anything that belongs in your response block | In the response block, never as a comment on the auditors’ text | See the worked example | Include in your words; add an auditor’s comment only if they disagree |
| 8. Editorial | Typos, formatting, cross-reference mismatches | One list at the end of the memo | “Page 7 table: finding 2 title differs from the block title on page 12.” | Fix without discussion |
Comments that do not work, and cost credibility for the ones that do: “this will look bad”; “other departments do the same”; “please delete”; complaints about tone with no proposed wording; documents created after the request; and comments on findings you do not own unless they are factual. The auditor-side guide to negotiating findings without watering them down describes how the team is trained to hear each of these, which is worth ten minutes of your 48 hours.
Running the fact-check: trace every number and date
A fact-check is a trace, not a read. For every number, date, name, system, policy clause and period in each finding, someone opens the source, confirms or corrects the statement, and records which. Ask the audit lead on day one for the item-level exception detail behind each figure. Most functions will give it to you, because it was built from your data, and without it you are checking arithmetic rather than facts. If the function will not release it, ask for the sample list and the exception references instead, and say in the memo that the fact-check was limited to what was provided.
Four things to trace that reviewers skip. The period: a draft can say “the year” when the sample covered a quarter. The population: what the 45 was drawn from, and whether blanket-order call-offs, intercompany items or a decommissioned system belong in it. The criteria reference: the policy clause and version in force during the period, not the current one. And dependent figures: a percentage, a dollar exposure and a sentence in the summary all change when a numerator changes, and the auditors will not always catch every one. If the finding rests on a sample, the guide to how auditors handle test exceptions explains what they may and may not conclude from it, which tells you where a wording comment is justified.
| Ref | Statement in draft | Source checked | Result | Evidence file | Comment type |
|---|---|---|---|---|---|
| F1, para 1 | “45 invoices sampled” | Internal audit sample list CR-S-01, received 14 October | Confirmed | None needed | None |
| F1, para 1 | “19 with a purchase order dated after the invoice” | ERP purchase order history for the 19 items, run 21 October | 4 are call-offs against blanket orders approved before the invoice; 2 fall under the documented emergency exception | CR-PO-07.xlsx; EMG-0113.pdf; EMG-0127.pdf | Factual correction; omission |
| F1, para 1 | “42%” | Arithmetic | 19 of 45 is 42%; after correction 13 of 45 is 29% | Not applicable | Dependent figure |
| F1, para 1 | “during FY26” | Sample list | Sample covers April to September 2026 only | CR-S-01 | Factual correction |
| F1, criteria | “PP-04 section 3.2” | Policy register | Section 3.2 in version 4; version 3, in force until June 2026, had the same requirement at 3.1 | PP-04 v3 and v4 | Editorial |
| F1, condition | “Management is aware” | Control self-assessment log Q1 2026; IT request IT-2026-0419 | Self-identified March 2026; system change requested 19 March; not yet scheduled | CSA-Q1-26.pdf; ticket export | Omission (context) |
| F1, effect | “increased fraud risk” | No basis stated in the draft | Ask for the basis; propose a stated exposure figure | Not applicable | Precision |
| F2, para 1 | “61 duplicate vendor records” | Vendor master extract, run 21 October | 58 duplicates; 3 are separate legal entities with similar names | CR-VM-02.xlsx | Factual correction |
| Summary, page 1 | “purchasing is routinely conducted without authorization” | Cross-reference to corrected F1 | Not supported: 9 of the 13 had approval before commitment | Not applicable | Precision (summary) |
The trace sheet is the attachment that makes the memo credible. A memo that says “several figures are wrong” is read as a complaint; a memo with a nine-row trace sheet and six evidence files is read as help, and treated accordingly.
Cause, rating and the response block in the time left
Cause: offer the better explanation, with its evidence
A cause comment succeeds when your cause explains more of the exceptions than theirs. Count. If 11 of 13 exceptions involve vendors on an unreviewed exemption list, the list is the cause and the other two are noise; if the exceptions are spread evenly across vendors, months and requisitioners, “insufficient training” may be closer to right than you would like. The method in root cause analysis for audit findings is what the team used to reach their cause; the owner’s version of root cause analysis shows how to reach yours in a week, and which causes are not causes. Present the working. Do not move the cause to another department without that department’s agreement, because the action will then be theirs and they have not seen the draft.
Rating: argue only from the definitions, and only after the facts
Ask for the rating definitions on day one if the draft has no appendix; the common scales, and what each level triggers for your area, are decoded in internal audit ratings explained for auditees. Then apply them to the corrected facts, in writing, in one paragraph: this is the definition, this is what the corrected facts show, this is the rating the definition produces. If the paragraph does not produce a different rating, do not send a rating comment; record the disagreement in your response if you still hold it, and spend the time on the response instead. The overall report rating works the same way through the rating rule: a change in one finding’s rating changes the report rating only if the rule says so, and the guide to what an Unsatisfactory rating means explains what rides on that derivation.
The response: eight elements, written by one person
The response block needs a position (agree, partially agree with the part specified, or disagree with a reason), an action stated so someone else could verify it, a line linking the action to the cause, a named owner with a title, a date, an interim measure where the fix is months away, the evidence you will show at closure, and any dependency on another team with that team’s agreement. The owner and the date are not optional: Standard 15.1 requires the final communication to specify who is responsible for addressing each finding and the planned completion date, so a response without them will come back. For complete responses by situation, from full agreement to risk accepted, use the library of management response examples. Three situations need care at the draft stage. If you have already remediated, provide evidence that meets the closure evidence standard and ask for the acknowledgment Standard 15.1 requires; the finding stays, the acknowledgment goes in. If the right answer is not to fix it, risk acceptance is a separate documented decision with its own approvals, and Standard 11.5 requires the chief audit executive to escalate an acceptance beyond the organization’s appetite to senior management and, if unresolved, the board; do not write “risk accepted” in a response block as if it were a position. And if your response is likely to attract an auditor’s comment, find out why before the final; the criteria in evaluating management responses are what it will be tested against.
The formal comment memo
The memo is a short covering document: your overall position, the comments by type with evidence references, the responses, and the two or three things you need. It will be read by the audit lead and the audit manager, filed in the engagement documentation, and, if a disagreement escalates, read by the chief audit executive and possibly your chief executive. Write it for that last reader: factual, numbered, free of adjectives, with no sentence you would be uncomfortable seeing quoted.
| Section | What goes in it | Example line |
|---|---|---|
| Header | Report title and draft version or date; your name and role; the date; the deadline you were given | “Comments on draft report FY27-03 Procure-to-Pay (draft of 20 October 2026), Director of Procurement, 22 October 2026; deadline 26 October.” |
| 1. Overall position | One paragraph: accepted subject to the corrections below, or disagreement with finding N for the reasons in section 5; nothing else | “Management accepts findings 1 to 3 subject to the corrections in section 2 and the cause in section 5; responses are attached.” |
| 2. Factual corrections | Numbered; each with location, draft text, correct text, evidence reference | “2.1 Finding 1, paragraph 1. Draft: 19 of 45. Correct: 13 of 45 (29%). Evidence: CR-PO-07, EMG-0113, EMG-0127; trace sheet rows 2 and 4.” |
| 3. Omissions and context | Facts that existed in the period and should appear; each with evidence | “3.1 Finding 1. Add: self-identified in the Q1 2026 control self-assessment; system change requested 19 March 2026 (IT-2026-0419).” |
| 4. Precision requests | Each with the draft phrase, the proposed phrase and the basis | “4.1 Summary, paragraph 2. Replace ‘routinely conducted without authorization’ with ‘committed before a purchase order was raised’. Basis: 9 of 13 approved before commitment.” |
| 5. Cause and rating positions | Proposed cause with its basis; any rating argument from the definitions; a clear statement if you accept the rating | “5.1 Finding 1 cause: proposed text attached. 5.2 Finding 1 rating: management accepts High on the corrected facts.” |
| 6. Management responses | Attached per finding in the function’s template, or embedded in the marked-up draft | “Responses for findings 1 to 3 attached; named owners have confirmed in writing (attachments 7 to 9).” |
| 7. Actions already completed | What was done, when, with closure-standard evidence; a request for acknowledgment | “7.1 Duplicate vendor records (finding 2) merged 21 October (CR-VM-03). Management requests acknowledgment in the final report.” |
| 8. Requests | A revised draft before issue; a meeting if needed; distribution additions; the committee-pack summary | “Management requests sight of the revised draft and the committee summary, and asks that the Head of Maintenance be added to distribution as co-owner of action 1.2.” |
| 9. Attachments index | Every file, named consistently, with the comment it supports | “Attachment 3: CR-PO-07.xlsx, ERP purchase order history for 19 items, run 21 October 2026; supports 2.1.” |
| Sign-off | Owner’s name and title; executive’s name as reviewer | “Prepared by the Director of Procurement; reviewed by the Chief Financial Officer.” |
Timing rules: deadlines, extensions and what happens if you miss them
The deadline on a draft is set backwards from the audit committee cycle. The report has to be final by the pack cut-off, so the auditors allow themselves time to consider your comments, revise, and clear the final through their own review. A deadline that looks arbitrary to you is usually the latest date that still leaves them that time. This matters for how you ask for more of it: in my experience an extension request on day one, with a reason and a specific date, is almost always granted; the same request on the deadline day often is not, because the days have already been spent.
If you cannot do everything by the deadline, send the facts on time and the responses as soon after as agreed. Factual corrections have to be in before the auditors revise; responses can follow by a day or two without harm if the audit lead knows. The reverse order, responses on time and facts later, means the responses were written to the wrong facts.
| Scenario | What the auditors typically do | How it reads to the committee | What to do |
|---|---|---|---|
| Comments and responses submitted on time | Consider each point, revise, send a revised draft or the final | A normal report | Ask to see the revised draft; check the summary again |
| Extension requested on day one with a reason and a date | Usually grant a few days if the committee cycle allows | Invisible | Use the time on dependencies, not a slower fact-check |
| Extension requested on the deadline day | Often refused, or granted for 24 hours | Invisible if met | Send what is complete and name what will follow |
| Facts on time, responses a day or two late by agreement | Revise the facts; hold the final briefly for responses | Invisible | Confirm the new date in writing |
| Responses not received by issue | Issue with “management response not received” or “response to follow”, and tell your executive | Read as disengagement; the worst outcome short of a dispute | Never let this happen silently; a one-line holding response is better than none |
| Deadline missed with no contact | Issue as drafted with a note that no comments were received | Read as acceptance of everything in the draft | Call the audit lead the moment you know you will miss it |
| Factual error found after the final is issued | Correct and recommunicate under Standard 11.4 if the error is significant; otherwise note it | A corrected report, which everyone notices | Raise it in writing with evidence; do not wait for the follow-up audit |
| Wording or rating disagreement raised after the final | No change; a position can be noted at follow-up | Reads as relitigating | Record it in the follow-up response, then let it go |
How your comments are recorded under Standards 13.1 and 15.1
The Standards define where each kind of comment ends up, and knowing the destinations changes how you write them. Standard 13.1 requires the auditors to follow an established methodology under which both sides can state their positions on the final communication and the reasons for any difference of opinion; it requires them to discuss a disagreement with you and try to reach a mutual understanding, and it does not oblige them to change any part of the results unless there is a valid reason to. Standard 15.1 requires the final communication to include the results, conclusions and management’s action plans, to acknowledge actions you have already started or completed, and to go to the readers who need it.
- Accepted factual corrections become the auditors’ text. No trace of your comment appears in the report; the correction and its evidence are retained in the engagement documentation the auditors must keep under Standard 14.6.
- Accepted omissions and precision requests also become the auditors’ text, in their words, which may not be yours. Check the revised draft.
- A position the auditors do not accept is recorded in your management response, in your words, marked as management’s. Where the disagreement is significant, ask for it to be stated in the executive summary as well, so the committee does not have to find it under finding 3.
- Your action plans, with owners and dates, go into the report and then into the issue tracking system, where Standard 15.2 requires the function to confirm implementation, keep the status current and, if an action slips past its date, obtain your explanation and consider whether the delay amounts to accepting the risk.
- Actions already started or completed are acknowledged in the final, with the finding retained for the period tested.
- An unresolved significant disagreement, especially one where management declines to act on a High finding or accepts a risk beyond appetite, goes up the escalation ladder to senior management and, if still unresolved, the board. The committee reads both positions; the one that cites evidence and the function’s own definitions reads better than the one that cites inconvenience.
- The memo itself stays in the engagement file, where internal quality reviewers, external assessors and, in regulated industries, examiners can read it. Write it as if they will.
The committee pack is built from the final report, not from your memo, so a point that lives only in your memo does not reach the committee. If it matters that the committee knows the issue was self-identified, or that an action depends on a funding decision above your level, it has to be in the report text or in your response. The guide to how the quarterly committee pack is assembled shows what survives the compression.
Common review mistakes and their consequences
Most of these come from treating the draft as a document to be edited rather than a set of facts to be checked.
| Mistake | Why it happens | Consequence | Do this instead |
|---|---|---|---|
| Rewriting the auditors’ prose in tracked changes | It feels like reviewing | Every change must be adjudicated; the package is set aside; the real corrections are lost in the noise | Numbered comments by type; propose replacement wording only where the text is inaccurate |
| Arguing the rating first | The rating is what hurts | Hours spent on the element least likely to move; facts left unchecked | Facts, then cause, then rating within the definitions |
| Submitting explanations as evidence | You know what happened | Low evidential weight; nothing changes | System records and dated documents from the period |
| Creating or backdating documents | The control ran; the paperwork did not | An integrity problem that can turn a finding into an investigation | Say the control operated but was not evidenced, and fix the evidence habit |
| Forwarding the draft widely | Everyone wants to see it | Confidentiality breach; future drafts arrive later with less in them | Review team only; the final is the document for distribution |
| Committing actions others own | It gets the response finished | Fails validation; becomes a repeat finding with your name on it | Written agreement from the real owner, or name yourself coordinator and them owner |
| Staying silent on a disagreement, then raising it at the committee | Hoping for a sympathetic audience | Read as an ambush; the committee backs the recorded process | Record it in the response; escalate through your executive to the chief audit executive if significant |
| Missing the deadline without asking | The day job | Report issued without your response | Ask for the extension on day one |
| Leaving the executive summary and the findings table unread | They look like boilerplate | The page the committee reads carries the wrong characterization; a title or date in the table contradicts the block | Read them first and again last; check every number against the blocks |
| Treating “already fixed” as “should be deleted” | Fair-seeming logic | Refused; credibility cost | Ask for the acknowledgment Standard 15.1 requires, with closure-standard evidence |
| Spending the hours on the Low findings | They are easiest to argue | No effect on the rating; the High goes under-reviewed | Accept the Lows quickly unless a fact is wrong; put the hours on the Highs |
Worked example: one finding marked up, before and after
Calder Ridge Utilities is a hypothetical regional water and power utility; every name, number and date below is invented. Its internal audit function issued the draft report on its procure-to-pay audit (FY27-03) on a Tuesday morning, with comments and responses due the following Monday, four working days later. The draft carried three findings: a High on purchase orders raised after commitment, a Medium on duplicate vendor master records, and a Low on approval thresholds not updated after a delegation change. The overall rating was Needs Improvement under the function’s published rating rule. The Director of Procurement ran the 48-hour plan with two fact-checkers from the purchasing team, the procurement analyst as response writer, the finance systems manager as fact-checker for anything drawn from the ERP, and the Chief Financial Officer as executive sponsor.
The draft of the High finding read as follows. Title: “Pervasive non-compliance with purchase order policy.” Condition: “Testing of 45 invoices during FY26 identified 19 (42%) where the purchase order was raised after the invoice date, indicating that goods and services are routinely procured without prior authorization. Management is aware of the issue.” Criteria: Procurement Policy PP-04, section 3.2. Cause: “Lack of management oversight and insufficient training of requisitioners.” Effect: “Unauthorized spend, budget overruns and increased fraud risk.” Rating: High. Recommendation: “Management should ensure all purchases are supported by a purchase order raised before commitment and should provide training to requisitioners.”
Within the first hour the director asked for the 19 exception references and the rating definitions; both arrived by lunch. By hour 24 the trace sheet shown earlier was complete. Four of the 19 were call-offs against blanket orders approved months before the invoices; the auditors had compared the release date rather than the blanket order date. Two were emergency repairs under section 5.1 of the same policy, approved retrospectively within the 48 hours the policy allows. Of the remaining 13, nine had budget-holder approval by email before the commitment, which made the condition a purchase-order timing failure rather than unauthorized spend; four had no pre-commitment approval of any kind, totaling $212,000. The sample period was April to September 2026, not FY26. The self-assessment log showed the director’s own team had identified purchase order timing in March 2026 and raised a system change request that IT had not scheduled. Eleven of the 13 exceptions involved vendors on the ERP’s “no-PO” exemption list, which had grown to 212 vendors and had not been reviewed since the 2024 system cutover.
At hour 20 the director briefed the CFO: the facts would be corrected, a cause would be proposed, and the High would be accepted on the corrected facts, because the appendix definition of High (a key preventive control failing in more than a quarter of the sample with material exposure) still fit at 13 of 45. The response would commit a vendor-list review that procurement owned and a system change that IT would have to own in writing. At hour 26 the director called the audit lead to preview the blanket-order point and the self-identification point. The memo, the trace sheet, seven evidence files and three responses went in at hour 44, Thursday morning, two working days before the deadline. The revised draft arrived the following Tuesday.
| Element | Draft wording | Management comment (type) and evidence | Final wording |
|---|---|---|---|
| Title | “Pervasive non-compliance with purchase order policy” | Precision: exceptions concentrate in exempt vendors; propose a title stating the condition and the count | “Purchase orders were raised after commitment for 13 of 45 sampled invoices” |
| Condition, count and period | “45 invoices during FY26 … 19 (42%)” | Factual correction: 4 blanket-order call-offs (CR-PO-07), 2 emergency exceptions (EMG-0113, EMG-0127); period April to September 2026 (CR-S-01) | “For 13 of 45 invoices sampled from April to September 2026 (29%; $1.9 million of $6.4 million sampled spend), the purchase order was created after the invoice date” |
| Condition, characterization | “routinely procured without prior authorization” | Precision: 9 of 13 had budget-holder approval before commitment (approval emails, attachment 5) | “In 9 of the 13 cases a budget holder had approved the purchase by email before commitment; in 4 cases ($212,000) no approval before commitment was evidenced” |
| Condition, “management is aware” | “Management is aware of the issue” | Omission: self-identified in the Q1 2026 control self-assessment (CSA-Q1-26); change request IT-2026-0419 raised 19 March 2026, not scheduled | “Management identified purchase order timing in its Q1 2026 control self-assessment and requested a system change in March 2026; the change had not been scheduled at the time of fieldwork” |
| Cause | “Lack of management oversight and insufficient training of requisitioners” | Cause: 11 of 13 exceptions involve vendors on the “no-PO” exemption list (212 vendors, unreviewed since the 2024 cutover); maintenance requisitioners bypass the step because turnaround averages four working days | “The ERP permits invoice entry without a purchase order for 212 vendors flagged as exempt; the exemption list has not been reviewed since the 2024 system cutover, and 11 of the 13 exceptions involved exempt vendors. Purchase order turnaround averaging four working days contributed to the remaining cases” |
| Effect | “Unauthorized spend, budget overruns and increased fraud risk” | Precision: ask for the basis; propose exposure figures from the corrected facts | “Spend is committed before the purchase order control operates; $212,000 across 4 invoices had no evidenced approval before commitment. Where invoices bypass the purchase order step, three-way matching does not occur” |
| Rating | High | Accepted on the corrected facts, stated in the memo | High (unchanged); report rating Needs Improvement (unchanged) |
| Recommendation and response | “Management should ensure all purchases are supported by a purchase order … and provide training” | Response: agree; actions, owners, dates, interim measure, evidence; IT agreement attached | Action 1.1: reduce the exemption list to defined categories, Director of Procurement, 31 January 2027. Action 1.2: ERP change to require a purchase order reference with an exception workflow, Director of IT (agreement attached), 31 March 2027. Interim: weekly report of invoices without a purchase order, reviewed by the Procurement Manager from 1 December 2026. Evidence: approved category list, change ticket and test evidence, 12 weekly review sign-offs |
The result is typical of a well-run review: the facts changed, the cause changed, the characterization changed, the rating did not, and the response was strong enough to need no auditor’s comment. The executive summary’s sentence about purchasing “routinely conducted without authorization” became a sentence about purchase order timing with the 13 of 45 figure and the self-identification noted. The Medium finding’s count went from 61 to 58 duplicate records on the strength of a vendor master extract; the Low was accepted as written with a two-line response. The director’s name appeared in the committee pack next to a plan that was already in motion.
This guide is general and educational; it is not legal or employment advice.
Questions readers ask
How long do you have to respond to a draft internal audit report?
The function’s methodology sets it, and the covering email states it. In most functions it is five to ten working days; some allow as little as 48 hours for a factual-accuracy pass, with responses due later. The deadline is set backwards from the audit committee cycle, so ask for any extension on the day the draft arrives, with a reason and a specific date, rather than on the deadline.
Can management change a draft audit report?
Management can get facts corrected with evidence, get missing context added, get overreaching wording made precise, propose a better-evidenced cause, and argue a rating from the function’s published definitions. Management cannot remove a finding the evidence supports, change the scope, alter the auditors’ conclusion, or edit the auditors’ text directly. The chief audit executive owns the report; management owns the response.
What should management comments on a draft audit report include?
A short memo with an overall position, numbered factual corrections each with evidence, omissions to add, precision requests with proposed wording, any cause or rating position argued from the definitions, the management response for each finding, evidence of anything already remediated, and an attachments index. Attach the trace sheet showing what was checked against which source.
What happens if management does not respond to a draft audit report?
The report is issued on schedule. Most functions mark the response block “management response not received” or “response to follow” and tell your executive; some issue with a note that no comments were received, which the committee reads as acceptance of everything in the draft. Either outcome is worse than any comment you could have written, so a one-line holding response with a date beats silence.
Can you dispute an audit rating in the draft report?
Yes, but only from the function’s rating definitions applied to the corrected facts. Write one paragraph: the definition, what the corrected facts show, the rating the definition produces. If that paragraph does not produce a different rating, record your position in the response rather than sending a rating comment. Ratings change when facts or the application of the definition change, not because the rating is unwelcome.
Who should see the draft audit report?
Your review team: the accountable owner, the fact-checkers, the response writer, the coordinator, your executive sponsor, and any owner whose action you need, limited to their finding. The draft usually carries the same confidentiality restriction as the final; the final is the document for wider distribution.
Does fixing the issue before the final report remove the finding?
No. The finding describes the control’s state during the period tested, and that does not change because the control works now. What you can and should ask for is the acknowledgment Standard 15.1 requires of actions already started or completed, supported by evidence that would satisfy a closure validation. Many functions then close the action quickly at follow-up rather than carrying it for months.
What is the difference between a draft audit report and a final audit report?
The draft is the auditors’ complete report before management’s comments and responses are incorporated; it is circulated to the audited area only, for factual accuracy and response. The final includes the corrected facts, your responses in your words, any recorded disagreement, acknowledgment of actions already taken, and the distribution list, and it is signed by the chief audit executive and sent to the audit committee and the executives named.
Related guides
- Being Audited? hub — every stage of an audit from the auditee’s chair, with the quick answers.
- The Audit Closing Meeting Playbook — the auditor-side meeting that precedes the draft, and why nothing in the draft should be new.
- When You Disagree With an Internal Audit Finding — the finding-level dispute: facts, cause, rating and recommendation, each argued differently.
- Anatomy of an Internal Audit Report — the eleven parts of the document you are reviewing and what each is for.
- The Audit Report Executive Summary — how the one page the committee reads is built, move by move.
- Writing Management Action Plans That Actually Close — the eight elements of a response and the dates that hold.
- Risk Acceptance by Management — the documented process when the right answer is not to fix it.
- Finding Severity Ratings — the calibrated matrix and the report rating rule you will be arguing from.
- Management Responses to Audit Findings: 15 Examples — complete responses by situation, from “agree” to “risk accepted”, with wording that holds up.
- Internal Audit Ratings Explained for Auditees — what Satisfactory, Needs Improvement and Unsatisfactory mean for your area, and what is worth contesting.
- Reporting to the Audit Committee: The Quarterly Pack — what survives the compression from report to committee pack.
- Failed an Internal Audit? What an Unsatisfactory Rating Means — what rides on the overall rating and what to do next.
- Root Cause Analysis From the Auditee’s Side — finding a cause the auditors will accept, and the causes that are not causes.
- The Auditee’s Playbook — a paid PDF for people on the receiving end of an audit, covering this stage among the others.
Leave a Reply