Five Best Practices for Creating Better Internal Audit Reports

May is Internal Audit Awareness Month. To celebrate the occasion, I am sharing my top five best practices for writing good internal audit reports.

Internal audit reports are changing rapidly, from a stodgy, long and boring report that is partly there to serve as evidence that you conducted an audit, to a shorter, more usable and compelling document planned to really address the needs of internal audit’s stakeholders. A good audit report isn’t just about ensuring that your reader doesn’t fall asleep, but that they can also find the information they need quickly and clearly and that the information is actionable.

Here are my top five best practices for creating better internal audit reports that hit the mark:

1Positive Assurance: Internal Auditors generally reports by exception. One of their role is provide assurance on the state of internal controls regarding their existence and effectiveness. When they include a page(s)/ slide(s) on “what is working properly” or “Controls found in order“, internal audit reports presents a balance view. It also help communicate “completely“, in a sense that a reader can compare the scope, “positive assurance” and “observations” and conclude the completeness of coverage of the Audit. I have seen that everyone appreciates it.

Related Article: “The Pros and Cons of Including Ratings in Internal Audit Reports“

2Short reports: Everyone prefer short reports, except internal auditors. Many wants to present a long list of observation as if their performance is measured in terms of number of observations raised. Observation can be combined to give it weight. low priority observations can be clubbed together, audit scope itself can be small (and frequent audits). This also allow internal auditors to focus on areas that matters.

3Follow the Five Cs: Institute of Internal Auditors have given 5Cs (Criteria, Conditions, Cause, Consequence and Corrective Action). By following these, your observation will never go haywire and you are able to defend your observations. If you find a situation where you are not able to find even one “C”, you need to work more.

4Corrective Action: Corrective action means corrective action + preventive action. Don’t restrict to correction of issues observed. Work with process owners and stakeholders and derive “permanent solutions” to the issues. If you have done your homework, you can convince everyone to examine a permanent solution, so that you are not fixing the symptoms every period and not addressing the underlying root cause. If you have worked our root cause properly, you will derive permanent solutions.

5Faster Reports: Issue your internal audit report fast. No one wants to wait for months to get an internal audit report. Having small and specific scope helps in issuing faster reports. Also don’t wait to report an issue in internal audit report, if you have found an issue which if not correctly immediately will lead to losses/ further losses. You can always communicate critical issues to process owners so that they can take appropriate action or provide appropriate feedback to you.

Good internal audit report writing is a vital skill that all internal auditors should be striving to improve on constantly. I’m hoping these practices can help make your internal audit reports just that much better. Your audit clients will thank you.  

Manoj Agarwal is head of internal audit and risk management at one of the largest retail companies in India.

(Disclaimer: The views expressed here constitute the opinion of the author and the author alone; they do not represent the views and opinions of the author ’s employers, supervisors, nor do they represent the views of any organizations, businesses, or institutions the author is, or has been, a part of.)