Internal audit reports are, generally, the major tangible output seen from the work of internal audit. The most important phase of the internal audit process and the primary means of communication, by which persons outside and inside the organization are apprised of internal audit’s work is issuance of internal audit report. They provide a good opportunity to integrate total internal auditing efforts and also an overall basis for appraisal of internal audit work. The basic objective is to issue reports that will command the attention of the various process owners who have the responsibilities for the various operational activities, and to persuade them to take appropriate corrective action. Internal audit reports constitute the basic evidence about the internal audit activities carried out in an organization and evaluate the contribution made by them. It is, therefore, extremely important that internal audit reports should be supported by high quality audit fieldwork. The form and content of internal audit report would be significantly affected by the scope of engagement of internal auditor.
Standard on Internal Audit (SIA) 4 “Reporting” issued by the Internal Audit Standards Board of ICAI specifies that the internal auditor’s report should contain a clear written expression of significant observations, suggestions/ recommendations based on the policies, risks, controls and transaction processing taken as a whole and management responses. The process of reporting flows from overall internal audit objectives, as specified in the appointment letter.
SIA 4 “Reporting” lays down that the internal auditor’s report should ordinarily include certain basic elements. An illustrative layout is given below :–
(c) Period of coverage of the Report;
(d) Report Distribution List;
(e) Opening or introductory paragraph;
(i) identification of the processes/functions and items of financial statements audited; and
(ii) a statement of the responsibility of the entity’s management and the responsibility of the internal auditor;
(f) Objectives/Scope paragraph (describing the nature of an internal audit):
(i) a reference to the generally accepted audit procedures in India, as applicable;
(ii) a description of the engagement background and the methodology of the internal audit together with procedures performed by the internal auditor; and
(iii) a description of the population and the sampling technique used.
(g) Executive Summary, highlighting the key material issues, observations, control weaknesses and exceptions;
(h) Observations, findings and recommendations made by the internal auditor;
(i) Comments from the local management;
(j) Action Taken Report — Action taken/ not taken pursuant to the observations made in the previous internal audit reports;
(k) Date of the report;
(I) Place of signature; and
(m) Internal auditor’s signature with Membership Number.
IMPORTANT ASPECTS OF QUALITY REPORTING
Internal auditor should try to draft a high quality report presenting his audit findings and recommendations in the best presentable form, so that timely and relevant information is delivered to key stakeholders. Enhancing the quality of internal audit report would assist to achieve the objective of internal audit by providing relevant assurance and contributing to the efficiency and effectiveness of governance, risk management and control. Internal auditor should share their perspective/ opinion on the matters that were of most significance in the audit of the current period. Qualitative internal audit report can further support the governance role of the audit committee by creating a better link between the role of the internal audit and the responsibilities of the audit committee and board.
Internal audit report should be compact and easy to read, understandable to a broad audience and should be compelling and persuasive. It is essential that irrespective of the nature of the internal audit work or the findings, internal audit report should be so well drafted that the readers are easily able to scan an audit finding and take a decision about the corrective steps to be taken. Further, as the evaluation process involves analysing both satisfactory and unsatisfactory aspects of the auditee’s operations in light of the audit objectives, so mentioning the auditee’s steps in improving controls or correcting errors together with the noted deficiencies or aspects in need of improvement can add much to the usefulness of the internal audit report as a management tool. The language used in the internal audit report should be concrete, descriptive and factual, and it should communicate a precise message. Further, objectivity in writing report should be maintained and a self review should be done to ensure that the report is clear, complete and correct.
Generally, the internal audit reports should be drafted taking into account requirements of the various types of readers of the internal audit report which, generally, includes following:
- Board of Directors and Audit Committee
- Senior Management like, CEO, CFO, etc.
- Business Management and Process Owners
- Personnel or Employees tasked with direct implementation of recommendations
- External Auditors
- Other External Stakeholders, like, Regulators
Accordingly, analysis of divergent reader needs and uses would help the internal auditor to appropriately design their report. In conclusion, while drafting the report, the internal auditor should consider the logic of auditing, the analysis of reporting objectives and the analysis of requirement of the readers.
Internal auditor should analyze the following important aspects while drafting internal audit report:
(a) Most important readers of the internal audit report inside and outside the organization;
(b) Knowledge of the subject covered in the report by the readers;
(c) Usage of the report by interested readers;
(d) Readers should accept conclusions and results;
(e) Implementation of recommendations that have both short and long term impact on issue. Accountability for implementation should also be specified.
SIA 4 mentions that the internal auditor should exercise due professional care to ensure that the internal audit report, inter alia, is:
(ii) factual — Presents all significant matters with disclosure of material facts specific
(vi) complies with generally accepted audit procedures in India, as applicable.
Internal audit technical skills and the ability to communicate results to people in a way that will best assure their acceptance and active support form essential elements of good internal audit reporting. In order to enhance readability, main message should come first which should then be followed by supporting details and explanations. Internal auditor should take care of following while drafting internal audit report so that the methodology and quality of internal audit report is highlighted to audit committee and other stakeholders:
(i) Using the right tone and language;
(ii) Taking a positive approach, i.e., tone is not critical, judgmental or unbalanced;
(iii) Writing clearly and concisely;
(iv) Quality of findings in terms of materiality;
(v) Quality of recommendations in terms of impact so that they correct current conditions and prevent future effects;
(vi) Degree of risks covered by the internal audit plan;
(vii) Root cause analysis of findings which are being carried forward from previous internal audit reports;
(viii) Rating recommendations as high, medium and low in order to assist management in assigning priorities. Sometimes, rating as satisfactory, needs improvement and unsatisfactory is also used by internal auditors;
(ix) Making report user friendly and streamlining contents to eliminate extraneous or redundant information;
(x) Any organizational/ legal constraint or constraint imposed by time and resources should be specified in the report;
(xi) Articulating the findings of internal audit and highlighting the risks impacting the organisation.
It is suggested that the following devices may be applied while drafting internal audit report for easier reading:
(c) Topic Sentences
TECHNOLOGY AN IMPORTANT TOOL
Technology provides a highly structured and standardized method of reporting internal audit results as the internal auditor can have quick and easy access to all internal audit data. The following are some important benefits of using technology:
- Standardized data collection
- Ability to create and condense information
- Impactful visualizations and supporting metrices
- Strategic insights that improve business performance
- Trend analysis, charts, maps
- Ensures consistency