The report is the culmination of an internal audit, where the internal auditors describe what they found, provide evidence of the issues that were detected, and the corrective action that they recommend to fix them. The specific process for writing the report and the content that needs to be in it – or that should be in it – needs to follow a rigorous structure that ensures that all of the important information is provided and the stakeholders get what they need to make an informed decision about the future of their company.

In this article, Dr. Nick Oberheiden, founding partner of the national law firm Oberheiden P.C. and an experienced internal audit consultant, discusses the internal audit procedures that should be followed when writing the report and the internal audit checklist needed to make sure that an internal audit provides the information necessary in a way that is useful and conducive to corrective action.

The Goal of the Report is to Give the Stakeholders the Information Uncovered in the Internal Audit

When preparing the internal audit findings, it is essential to keep in mind the internal audit function: To give stakeholders in the company the information that they need to make an informed decision about how to move forward with the company. To reach that end, a good audit report will:

• State the quality objectives of the internal audit that was conducted

• Mention the scope of the internal audit, including any important limitations that confined it or any gaps in information that could make it incomplete

• Clearly and thoroughly state the findings of the internal audit, focusing on the company’s shortcomings that can be improved

• Providing recommendations for fixing those shortcomings that were detected in the internal audit

Varying from these goals can lead to an audit report that is not all-encompassing and that proves to be unsatisfactory for the stakeholders, who will then struggle to take the corrective actions needed to make their company's operations run more efficiently or to insulate the business from legal liability.

An Internal Audit Checklist for Both Required and Recommended Content in the Audit Reports

The content that gets included in the internal audit report is the most important part of the entire internal audit process. This is what the internal auditors have deemed to be key points and worthy for the stakeholders to know about the state of their business. The findings summary should reflect all of the important findings from the internal audit, should state them clearly and accurately, should explain why they are important, and should make recommendations for significant changes to any of the current processes that pose an inherent risk to the company’s success.

To satisfy stakeholders, audit reports generally should cover at least the elements in the following internal audit checklist:

• The scope, professional standards and quality objectives of the internal audit

• The results of the internal audit, including a performance evaluation, compliance needs, and particular assertions regarding company policy

• Any recommendations that the internal auditors have for correcting internal and external issues that were found

• Conclusions that provide an executive summary of the internal audit and its findings

Additionally, effective audit reports often include the opinions of the internal auditors concerning their findings. Some internal audit findings also include the company's processes that are working well.

According to Dr. Nick Oberheiden, an internal audit consultant and founding partner at the national law firm Oberheiden P.C., “Hitting all of the elements in this internal audit checklist is the basis for a good internal audit report. However, all internal audits are unique. Internal auditors need to make sure that they understand the concerns of the stakeholders and the company that they are dealing with and then craft an internal audit plan that reflects those concerns. The content of the resulting audit report should then focus on those points of importance.”

The Internal Audit’s Scope and Objectives

Generally, internal audit reports begin with the internal audit function, itself. This sets the groundwork for the rest of the report of the internal audit findings. Some things to include are often:

• What information or data was audited and what the internal audit requirements were

• The internal audit functions, or reasons why the internal audit was conducted (i.e. quality management, risk assessment, risk management, training programs, etc.)

• A list of people who were interviewed (i.e., top management, external parties through customer surveys, etc.)

• Who conducted the internal audit (i.e., audit committee, internal audit team, individual internal auditor, external providers, etc.)

It should also include limitations to the scope of the internal audit, like:

• Information that was not available

• Departments that were not targeted by the internal audit

Results

The meat of the report is generally the internal audit’s findings and business performance evaluation. This section compartmentalizes each of the business processes on their own and then often states whether they were satisfactory, unsatisfactory, or could use corrective actions. Audit evidence for the designation must be included, as well.

Recommendations

If the internal audit process found an enterprise risk or an inefficient system, the audit report should include a description of the corrective action that the internal auditors think would correct the issue. While stakeholders may choose to implement a different solution that they think is going to be a better fit for their company, including a recommendation is still extremely important because it sets the company on the path towards a corrective action, even if they choose to adopt a different one. Merely describing the problem without recommending a solution often leaves the audited entity unsatisfied with the final report and auditing procedures.

Conclusions

The conclusions section of the internal audit report provides the internal auditors with an opportunity to address issues or trends that are broader than any specific finding from the internal audit. For example, this could be where the internal auditor points out how one particular shortcoming is responsible for many of the negative findings in the audit report, and may also be responsible for problems that were outside the scope of the internal audit.

Internal Auditors' Opinions

Especially when the internal audit is being conducted by an outside agency or an experienced consultant, stakeholders benefit from hearing the informed opinions of their internal auditor. Those opinions can let the stakeholders know how their performance evaluation stacks up with other entities that the internal auditor or internal audit team has inspected in the past, and where general improvements can be made in the company.

Satisfactory Issues

Finally, many internal audit reports include a section at the end that covers issues and findings that were positive, rather than negative. This can help the stakeholders understand where they are doing well and having a positive business impact and therefore should not be touched.

How the Report Should Be Created

Creating a good internal audit report can be tricky. However, the process can be simplified by keeping the following points in mind:

• Stakeholders want to know how to take corrective action to improve their company; the writing style of the report should reflect that by being nonjudgmental and should provide insight for continuous improvement.

• The length of the report should be as short as possible; it should include all of the necessary, useful, and relevant information for corrective action, but no more

• The audience is generally not going to be fellow auditors; explain fundamental concepts simply, such as how the internal audit process works, and do not use jargon

By following these basic precepts, your final audit report should be useful and informative.