Internal Audit Report Example: Findings, Ratings, and Sign-Off

An internal audit report follows a standard skeleton: a title identifying what was reviewed, the objective, the scope, background on the area, an engagement rating, conclusions, individual findings written to a set format, management’s action plans, and a distribution list. Some organizations add an executive summary for the board or a recognition section acknowledging cooperation, but the components above are the professional baseline for internal audit report structure, and the Institute of Internal Auditors’ Global Internal Audit Standards require the finished document to be accurate, objective, clear, concise, constructive, complete, and timely.1The Institute of Internal Auditors. Global Internal Audit Standards – Standard 11.2 Effective Communication

The IIA’s Audit Report Writing Toolkit lists the typical sections in order:2The Institute of Internal Auditors. Audit Report Writing Toolkit

  • Report title identifying the department, process, or function reviewed.
  • Objective, stating the purpose of the engagement.
  • Scope, covering activities examined, work performed, and any limitations.
  • Background on the activity being audited.
  • Recognition of positive aspects or cooperation.
  • Engagement rating (for example, satisfactory, marginal, or unsatisfactory).
  • Conclusions summarizing the most important observations.
  • Observations or findings, listed by significance, each with a criticality rating, condition-criteria-cause-effect analysis, recommendations, and management’s action plan with a target date.
  • Distribution list.

Objective, Scope, and Background

The objective describes what the audit set out to accomplish. Common objectives include verifying the accuracy of financial reporting, testing access controls on sensitive systems, or confirming that a department follows its own policies. Every finding later in the report should trace back to at least one stated objective.

The scope section defines what the audit covered and, just as importantly, what it didn’t. It identifies the timeframe reviewed, the specific data sets examined, and any limitations the team encountered. If a system was unavailable or a department refused to produce records, the scope section is where that constraint gets documented. Readers need to know the boundaries before they can evaluate the findings.

Background gives context for readers who aren’t familiar with the area under review. Two short paragraphs on how the process works, how many transactions it handles, and how it fits into the organization’s risk profile give the audit committee enough orientation to understand what follows without a separate briefing.

The Engagement Rating

The engagement rating is usually the first thing senior leadership reads, and it sets the tone for everything that follows. A satisfactory rating means processes comply with applicable requirements and risks are adequately controlled. An unsatisfactory rating means the department failed to meet basic operational or compliance standards, and it typically triggers immediate escalation to the audit committee.

The rating reflects the collective weight of the findings, not just the count. A single high-risk finding can pull an otherwise clean audit into unsatisfactory territory. This is where auditor judgment matters most, and it’s also where disagreements with management tend to surface. If the audit team and management cannot agree on the results, the IIA standards require both positions to be documented in the final report.3The Institute of Internal Auditors. Global Internal Audit Standards – Standard 13.1 Engagement Communication

Building Each Finding With the Four C’s

Individual findings are the heart of the report. Every finding must trace back to verifiable evidence in the workpapers; if it can’t, it doesn’t belong in the document. The Four C’s framework — condition, criteria, cause, and effect — keeps the analysis consistent and makes it harder for management to dismiss a finding as vague.

Condition and Criteria

The condition describes what the auditor observed. It is strictly factual: “Twelve disbursements over $50,000 were approved by a single manager with no secondary review.” No interpretation, no editorializing.

The criteria is the standard that should have been followed. This might be an internal policy, an industry standard, or a law. For public companies, a common criteria reference is Sarbanes-Oxley Section 404, which requires management to maintain adequate internal controls over financial reporting and assess their effectiveness annually.4Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls The gap between the condition and the criteria is what makes the finding a finding.

Cause and Effect

The cause explains why the gap exists. Maybe the department never updated its procedures after a reorganization. Maybe a key control was built into software that was decommissioned. This is the part most auditors rush through, and it shows. A finding that says “management failed to follow the policy” without explaining why is useless for prevention. The cause drives the remedy: if the problem is a training gap, the fix is training; if the problem is a broken system, the fix is a system change.

The effect describes the risk or actual harm. Quantify it when possible. Instead of writing “this could lead to financial loss,” write “the unreviewed disbursements totaled $2.3 million over the audit period, with no compensating control to detect errors.” A finding that could trigger a daily regulatory penalty demands faster attention than one carrying only reputational risk, and stating that specific exposure helps management prioritize.

Rating the Risk of Each Finding

Every finding gets a risk rating built on two dimensions: how likely the risk is to materialize and how severe the impact would be. Labels vary, but the tiers are usually consistent:

  • High: the control failure is likely to result in significant financial loss, regulatory action, or operational disruption. These findings get escalated to the audit committee and typically require remediation within weeks.
  • Medium: either likelihood or impact is elevated, but not both. These findings need attention but allow a longer correction window.
  • Low: the issue is unlikely and would cause limited harm. Documented and tracked, but not urgent.

Rating is more art than science. Two reasonable auditors can look at the same condition and disagree. What matters is internal consistency: the same type of gap should get the same rating across different audits. Documenting the rationale in the workpapers protects the rating from being second-guessed later.

Management Action Plans

Every finding must include management’s formal response. The department head outlines the specific corrective steps, assigns an owner for each step, and commits to a target completion date. Vague responses like “we will review the process” aren’t acceptable. A good action plan reads like a project plan: discrete tasks, named individuals, firm deadlines.

Most action plans target completion within 30 to 90 days, though high-risk findings can demand faster turnarounds and systemic issues sometimes take longer. IIA standards require the final report to specify who is responsible for addressing each finding and when the actions should be complete.5The Institute of Internal Auditors. Global Internal Audit Standards – Standard 15.1 Final Engagement Communication If management started fixing the problem before the report was finalized, the standards also require the report to acknowledge that progress.

Exit Meeting and Final Sign-Off

Before the report is finalized, the audit team holds an exit meeting with department management. This is the forum for confirming facts, discussing context, and resolving disagreements. Management may provide information that changes a finding’s cause or effect, and occasionally a finding gets withdrawn entirely because additional evidence surfaces. Skipping the exit meeting signals that the team is more interested in issuing findings than getting them right, and it damages credibility quickly.

After the exit meeting, the chief audit executive reviews and approves the final report before it goes out.5The Institute of Internal Auditors. Global Internal Audit Standards – Standard 15.1 Final Engagement Communication If the report later turns out to contain a significant error or omission, corrected information must go to everyone who received the original.

Distribution and Confidentiality

Internal audit reports are confidential documents, and distribution should be limited to people who need the information. Typical recipients include process owners, senior management, the board or audit committee, and in some cases external auditors. The chief audit executive decides who receives the report and in what format. Board members often receive an executive summary rather than the full detailed report.2The Institute of Internal Auditors. Audit Report Writing Toolkit

Releasing results outside the organization requires extra caution. Unless a law or regulation mandates disclosure, the chief audit executive should assess the risk and consult with legal counsel before sharing findings externally. Reports are typically transmitted through secure email or an encrypted internal portal, and once submitted they become part of the organization’s permanent records.

Public-Company and Legal Considerations That Shape the Writing

Two outside pressures shape how carefully each finding should be worded. For publicly traded companies, an internal audit finding can feed into mandatory disclosure. SEC rules require management to report annually on internal controls over financial reporting and to disclose any material weakness; if even one exists, management cannot conclude that internal controls are effective.6eCFR. 17 CFR 229.308 – Internal Control Over Financial Reporting The PCAOB defines a material weakness as a control deficiency with a reasonable possibility that a material misstatement won’t be prevented or detected in time; a significant deficiency is less severe but still merits attention from those overseeing financial reporting.7Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting A finding that reveals a material weakness may end up in the public record.

The second pressure is discoverability. Attorney-client privilege can protect audit-related communications, but only when the work is directed by legal counsel for the purpose of providing legal advice, and sharing the report with external auditors waives that privilege because courts treat outside auditors as unaffiliated third parties. Work-product doctrine offers separate protection when the audit was conducted in anticipation of specific litigation, but claiming it after the fact rarely succeeds. Some states recognize a self-evaluative or self-critical analysis privilege; federal courts are split, and some have rejected it. The practical implication for the report: assume it could be discoverable, stick to facts, avoid speculation, and route findings that touch potential litigation through legal counsel before publication.