Audit Report Writing

Audit Report
STD 2400 - Communicating

results
STD 2400 - Communicating
results
The standard requires internal auditors to communicate engagement
results. Therefore, internal auditors must have a clear understanding of
engagement communication requirements. The chief audit executive
(CAE) also should understand the expectations of the board and senior
management regarding communication related to engagement results.
Internal auditors should understand the policies and procedures in the

audit manual — or any other stakeholder expectations — and the use of
any standard templates to ensure consistency in developing
observations and conclusions
In communicating:
format content timing
How do we decide these?
Organization Type of
engagement
Important notes – planning stage
How? When? Whom?

Business Significance, Challenges and Opportunities
Why is a written report significant ?
1. Provides a better understanding of process or function

audited in terms of;
Governance Risk Management Control

2. It also provides an opportunity to point
out the means by which potential impact of
significant risk is kept to an acceptable level
and/or acknowledge the engagement
client’s
satisfactory performance.
3.Opportunity to market audit function
Depth of Willingness Provide

knowledge to partner recommendation
So, what might make the client believe that the
important tasks performed by the audit is of no use?
Outdated Inaccurate Low quality

Some pitfalls to avoid!
Significant errors and omissions
Language that is too technical or filled with too much jargon
Observations and recommendations that are not well-formulated
Failing to acknowledge satisfactory performance
Omitting or not explaining the scope limitations
Issuing late reports or issuing them to inappropriate parties

Audit Report General Guidelines
Understanding the Stakeholders / Users of audit reports
Organizational Type of Related

Structure report Recommendatio
n
Process The board

Owners
Senior
Other stakeholders
Management
STD 2440 – Disseminating
Results
“The chief audit executive must communicate results to the
appropriate parties.”
STD 2440 – A1
“The chief audit executive is responsible for communicating the final results to
parties who can ensure that the results are given due consideration.”
STD 2440 – A2
“If not otherwise mandated by legal, statutory, or regulatory requirements, prior to
releasing results to parties outside the organization the chief audit executive must:
• assess the potential risk to the organization;

• consult with senior management and/or legal counsel as appropriate; and
• control dissemination by restricting the use of the results.”
Report content and structure
The style and format of written internal audit reports varies across
organizations. The internal audit report structure could be
consistent with the organization’s communication templates and
practices, reflect the organization’s culture, and/or incorporate
suggestions from senior management and the board.

STD 2420 – Quality of
Communications
Communications must be
accurate, objective, clear, concise, constructive, complete, and
timely.
The content and level of detail should be determined by the

needs of the audience. As such, some organizations may
deem it appropriate to utilize different formats/versions that
are customized for the audience.
Key questions to have in mind
1. Who are the most important readers?
2. How much do they know about the audited activity?
3. How do they plan to use the report?
4. How do the identified issues impact the reader?

Components of a report:
1. Report title 7. Conclusion
2. Objective (purpose of engagement) 8. Observations
3. Scope 9. Distribution list
4. Background 10. Annex
5. Recognition (positive aspects)
6. Engagement rating
8. Observations
Observations (also referred to as findings) — each
observation should be listed in order of significance
(grouped by activity if applicable) and often include:
• A title and reference.
• Criticality rating (measure of risk significance [i.e.,
high, medium, low, critical,
significant]).
• Statement of facts (condition, criteria, cause,
effect/risk), which can be
substantiated with relevant examples, data,
analytics, tables, or charts.
• Audit recommendations (corrective action to mitigate
the risk identified in the
observation).
• Management’s action plans (corrective action,
Report Issuance
Engagement results should be communicated according to the agreed
communication plan. Timely communication allows management to take
appropriate corrective action.
Interim
Engagement Communication Report
Type consideration Recipient
Engagement Type
Regular audit Special engagement Complex engagement

engagement
Audits in the annual Non in plan of urgent lengthy, of multiple
plan request functions
Draft a report, conduct Give priority over Interim or status
an exit meeting, write planned audits updates, as completes (
the final report after Usually address a branches, units or
exit meeting. higher risk related department)
situation
Interim Communication
High Risk Medium Risk Low Risk
1. Discuss verbally in 1. Could issue an 1. Issuing a verbal

advance interim report for report to the
2. Issuance an interim management to take management
report to timely action 2. Issuing a memo to
management 2. Can follow the the management
3. Prioritize the regular reporting
issuance of final procedures
report
Report Recipient
Management and The board Other, stakeholder

process owner
Other than verbal give a Frequency of meetings External auditors,
draft report with lawyers and others
observations and 1. Final report or
recommendations executive summary 1. Summary of relevant
1. Helps to build a 2. Status of recent parts/sections
partnering aspect reports results 2. Relevant time period
2. Reduces observation 3. Comprise of
errors, significant findings The written internal audit report
should be issued in a timely
misunderstanding 4. Progress of manner after the conclusion of the
and disagreements management follow- internal audit engagement and
should not contain any surprises.
up
Writing Style Consideration
Report should be well organized
Place observation in chronological order, by significance
Grouping of topics, cause, or effect
Simple wording, less technical jargons Tone of the

report should
Short sentences, to the point be
constructive,
Charts, graphs, diagrams, tables, not
illustration and other graphics adversarial.
Task one:
Based on the topic given prepare the
following:
1. Formulate audit objectives
2. Audit risks in relation to those objectives
3. Set a scope for the audit
Be ready to justify your points !

Thank you

Audit Report Writing

Uploaded by

Copyright:

Available Formats

Audit Report Writing

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Audit Report Writing

Uploaded by

Copyright:

Available Formats

Audit Report

STD 2400 - Communicating

Internal auditors should understand the policies and procedures in the

format content timing

How do we decide these?

How? When? Whom?

1. Provides a better understanding of process or function

Governance Risk Management Control

3.Opportunity to market audit function

Depth of Willingness Provide

Outdated Inaccurate Low quality

Language that is too technical or filled with too much jargon

Observations and recommendations that are not well-formulated

Failing to acknowledge satisfactory performance

Omitting or not explaining the scope limitations

Issuing late reports or issuing them to inappropriate parties

Organizational Type of Related

Process The board

• assess the potential risk to the organization;

organizations. The internal audit report structure could be

consistent with the organization’s communication templates and

practices, reflect the organization’s culture, and/or incorporate

suggestions from senior management and the board.

The content and level of detail should be determined by the

1. Who are the most important readers?

2. How much do they know about the audited activity?

3. How do they plan to use the report?

4. How do the identified issues impact the reader?

1. Report title 7. Conclusion

2. Objective (purpose of engagement) 8. Observations

3. Scope 9. Distribution list

4. Background 10. Annex

5. Recognition (positive aspects)

communication plan. Timely communication allows management to take

appropriate corrective action.

Regular audit Special engagement Complex engagement

High Risk Medium Risk Low Risk

1. Discuss verbally in 1. Could issue an 1. Issuing a verbal

Management and The board Other, stakeholder

Place observation in chronological order, by significance

Grouping of topics, cause, or effect

Simple wording, less technical jargons Tone of the

Be ready to justify your points !

You might also like