How to Write an Effective Internal Audit Report: Findings, Risk Ratings and Action Plans

An internal audit report is useful only when it converts evidence into a clear management decision. A long list of exceptions may prove that testing was performed, but it does not by itself tell management what failed, why it matters, what should change, or who should act. For CA and finance professionals, strong report writing therefore starts before the final drafting stage: the observation must be supported by evidence, discussed with the process owner, linked to the underlying risk, and converted into a practical action.

What a good internal audit report should achieve

A good report should allow a reader who was not part of fieldwork to understand the issue without reconstructing the audit file. ICAI’s current Internal Audit Standards Board publications page places reporting within a wider assignment framework that includes planning, evidence, documentation, communication with management, reporting results and monitoring prior audit issues. That sequence is important: reporting is the output of a disciplined audit process, not a substitute for one.

ICAI also provides a Compendium of Standards on Internal Audit; the page identifies a February 2026 compendium as applicable from 1 April 2026. Practitioners should use the current compendium and the relevant standards when designing their reporting methodology.

The anatomy of a useful audit observation

A practical observation can be built around six questions.

1. What should happen? State the expected control, policy, process or requirement.
2. What actually happened? Describe the exception factually and quantify it where the evidence permits.
3. Why did it happen? Identify the root cause rather than merely repeating the symptom.
4. Why does it matter? Explain the business, financial, compliance, operational or reputational risk.
5. What should change? Recommend a proportionate control or process improvement.
6. Who will do what by when? Capture management’s agreed action, owner and target date.

This structure prevents two common extremes: a report that is so brief that management cannot understand the issue, and a report that reproduces pages of testing detail without a decision-ready conclusion.

Condition, criteria, cause and consequence

A useful drafting discipline is to separate the condition from the criteria. The condition is what the auditor found. The criteria is the expected state. Mixing the two can make an observation sound accusatory or vague.

For example, “vendor controls are weak” is a conclusion, not a well-supported observation. A stronger formulation would explain that specified vendor-master changes were processed without the approval evidence required by the organisation’s documented process. The report can then explain the cause identified during discussion, the risk created by uncontrolled master-data changes, and the corrective action.

How to rate findings without turning ratings into decoration

Risk ratings should help readers prioritise, not merely add colour to a report. The organisation should define its rating logic in advance and apply it consistently. A practical framework considers both the potential impact of a control failure and the likelihood or exposure indicated by the evidence. Other factors may include regulatory significance, fraud exposure, transaction value, number of locations affected, duration of the weakness and whether the issue is recurring.

A high rating should not be assigned simply because an observation sounds serious, and a low rating should not be used merely because no loss has yet occurred. The question is the risk created by the control gap in its actual business context.

Worked example: vendor master changes

Assume an internal audit tests 40 vendor-master amendments and finds that 7 changes to bank details do not contain the second-level approval required by the company’s procedure. Further discussion shows that the workflow was temporarily bypassed after a system migration and the manual compensating review was not consistently evidenced.

A weak report might say: “Approvals were missing in 7 cases. Management should ensure compliance.” A decision-ready observation would distinguish the elements:

• Condition: 7 of 40 tested bank-detail amendments lacked evidence of the prescribed second approval.
• Criteria: the documented vendor-master process requires the specified approval before the amendment is completed.
• Cause: the automated workflow was unavailable after migration and the temporary manual control was not consistently performed or retained.
• Risk: unauthorised bank-detail changes can increase the risk of incorrect or fraudulent payments.
• Action: restore the system workflow, restrict amendment rights, define an exception process and retain evidence of independent review until automation is stable.

The auditor should not invent the root cause or management action. Both should be grounded in evidence and discussion with responsible personnel.

Recommendations should address causes, not symptoms

“Ensure compliance” and “management should be careful” are rarely sufficient recommendations. If the cause is unclear ownership, define ownership. If the cause is an ERP configuration gap, address the configuration or compensating control. If the cause is poor exception visibility, introduce an exception report and review mechanism. A recommendation should be specific enough to guide remediation while avoiding unnecessary management of the process by the auditor.

Management responses and action plans

The final report should make it easy to distinguish the auditor’s observation from management’s response. Where management agrees, the action plan should normally identify the corrective step, accountable owner and target completion date. Where management disagrees, the report should preserve the factual basis of the finding and clearly record the response rather than silently weakening the observation.

ICAI’s current publications architecture separately identifies standards dealing with communication with management, reporting results, and monitoring and reporting of prior audit issues. This reinforces a practical point: issuing the report is not the end of the control-improvement cycle.

Common internal audit reporting mistakes

• Writing the finding before confirming that the evidence supports it.
• Reporting isolated exceptions as systemic failures without analysing the population or cause.
• Using dramatic risk language that is not proportionate to the evidence.
• Giving generic recommendations that do not address the root cause.
• Combining several unrelated weaknesses into one observation, making ownership unclear.
• Leaving agreed actions without a named owner or target date.
• Closing an issue based only on management confirmation instead of appropriate evidence of remediation.

Pre-issue checklist for the auditor

1. Can a reader understand the observation without opening the working papers?
2. Is every factual statement traceable to audit evidence?
3. Are condition and criteria clearly separated?
4. Has the likely root cause been discussed and supported?
5. Is the risk statement specific to the control failure?
6. Is the rating consistent with the organisation’s methodology?
7. Does the recommendation address the cause rather than the symptom?
8. Are management action, owner and target date clear?
9. Are significant disagreements or limitations transparent?
10. Is there a defined follow-up mechanism for open issues?

Practical takeaway

An effective internal audit report is not a catalogue of errors. It is a structured bridge from evidence to action. Build each material observation around the expected state, actual condition, root cause, risk and practical response; use ratings consistently; separate the auditor’s conclusion from management’s action plan; and follow issues through to evidenced closure. That makes the report shorter to consume, easier to govern and more useful to the people responsible for fixing the underlying risk.