Audit Reporting
The principal product of the audit is the audit report in which audit opinions are expressed, audit findings are presented, and recommendations for improvements are articulated. To ensure that the recommendations presented in the final report are practicable and value adding, the Internal Audit team discusses the draft with the audit client prior to issuing the final report. The audit report can come in different formats depending on what has been adopted by the internal audit department but there are generally accepted reporting formats for audit report. Typically, the audit report generally consists of the following.
- Cover memo
- Executive summary
- Full report
- Rating sheeting
- Consequence management
- Appendices.
Cover memo highlights the objectives and scope of the audit exercise, the distribution list for the report (i.e. persons to receive the report). It is sent to the person responsible for attending to the issues noted in the report as well as coordinating resolution of all audit findings.
Executive summary highlights the high-level issue requiring management and board audit committee’s attention. It is a summary of the audit findings with the most critical issues that need to be communicated to management and board for action. It is writing in concise, clear and non-technical language for ease of understanding for the audience.
The full report contains all issues noted during the audit in detail, the risk implications of issues raised, auditee/management responses to the findings and recommendations proffered by the auditors to close the identified gaps. Other documentations required to support the audit work and report are:
- Audit terms of reference (TOR).
- Audit working paper (AWP).
- Walk-through test document (WTD).
- Test of control (TOC).
- Issue summary (IS).
At the reporting stage of the audit, the audit team reviews and analyze the audit findings, consolidate all findings into a single report as well as supporting documents, logs, transaction reports into appendices, classify all findings in line with the department risk scoring/rating criteria, prepare audit recommendations and the final audit report. Audit finding should be supported by objective evidence. The Team Leader is responsible for the consolidation all the audit findings and preparation of the audit report. The auditors should follow professional code of conduct in the preparation of the reporting.
To get our IT audit programs/checklists, Click here To get our risk assessment templates, Click here
Back To Internal Audit Leading Practices