An internal audit report is judged by what happens after it is read. A long list of exceptions with no context, risk, owner or deadline may be accurate and still fail the people who must act on it. The Institute of Chartered Accountants of India deals with assignment-level reporting in SIA 370, Reporting Results, which its Internal Audit Standards Board lists among the current Standards on Internal Audit. The full text sits in the Compendium of Standards on Internal Audit (as on 1 October 2022), which covers all SIAs issued up to September 2022.
This guide sets out what SIA 370 requires, how to build each part of the report, how to rate and word findings, and a pre-issue check that a reviewer can run in ten minutes.
What SIA 370 covers
SIA 370 recognises that internal audit results are usually reported in two stages: an internal audit report at the end of each assignment, and a summary at the end of a period covering the whole audit plan. The standard deals only with the first, the report on a specific assignment. Periodic, entity-wide reporting and any overall assurance opinion are left to other standards in the series.
Its stated objectives are for the report to share with the auditee all significant findings based on the audit procedures performed, and to allow management to understand the issues and take corrective action in a methodical and comprehensive way. The report is therefore the end of an evidence chain, not a fresh set of opinions. Every conclusion in it should trace back to working papers prepared under SIA 330 on documentation.
The five elements the report must contain
The ICAI Board of Studies' internal audit notes for students list the contents of the report under SIA 370:
- an overview of the objectives, scope and approach of the audit assignment;
- the fact that the internal audit has been conducted in accordance with the Standards on Internal Audit;
- an executive summary of key observations covering all important aspects;
- a summary of the corrective actions required, or agreed by management;
- the nature of assurance, if any, that can be derived from the observations.
The nature of assurance must be consistent with what was agreed at the planning stage under SIA 110, Nature of Assurance. A report cannot quietly widen the assurance through its wording.
Three rules on issuing the report
- Draft before final. No internal audit report is to be issued in final form unless a written draft has first been shared with the auditee.
- Timeliness. The report is to be issued within a reasonable time from the completion of the internal audit work.
- Records. The audit file keeps copies of the draft and the final report, and where used, management action plans counter-signed by the responsible managers.
The draft stage lets management confirm facts, supply missing evidence and agree realistic actions. It does not give management a veto. Disagreement alone is not a reason to drop a supported finding. If a finding is changed or removed after the draft, the file should show the evidence that justified the change. Where management disagrees and the auditor stands by the finding, the report can record both positions.
Building each section
Objective, scope and approach
State what was reviewed, why, for which period, and which locations, processes or systems were covered. "Procurement audit completed" says nothing. A useful scope reads: "Vendor onboarding, purchase order approval, three-way matching and payment release for the Pune and Chennai plants, 1 April to 30 September; 60 vendor creations and 120 payments tested." Also state what was excluded, so that silence is not read as comfort.
Executive summary
Write this for someone who will read nothing else. Give the two or three themes that matter, the highest-rated findings, any control that worked well and should be kept, and the overall direction of remediation. Keep it to one page. Do not repeat every observation.
Detailed observations
Use the same five-part format for every significant finding:
| Part | Question it answers |
|---|---|
| Condition | What did we find, with numbers? |
| Criteria | What should have happened: policy, law, SOP or control design? |
| Cause | Why did it happen, where established? |
| Effect or risk | What loss, error or exposure does it create? |
| Action | What will change, who owns it and by when? |
Keep three things visibly apart: the facts found, management's explanation and the auditor's conclusion.
Worked example: turning an exception into a finding
Weak version: "Vendor master controls are weak."
Stronger version:
- Condition: 7 of 60 vendors created during the period (11.7%) were activated without the independent approval required by the vendor onboarding SOP. Payments of Rs 38.4 lakh were made to these 7 vendors, 7.4% of the Rs 5.2 crore paid to new vendors in the period.
- Criteria: the SOP requires approval by the procurement head, separate from the person who creates the vendor, before activation.
- Cause: the ERP workflow allows the creator to activate a vendor when the approver is on leave, and no alternate approver is set.
- Risk: payments to fictitious or unverified vendors, and duplicate vendor records.
- Agreed action: IT to remove self-activation rights and configure an alternate approver by 31 December; procurement to re-verify the 7 vendors' bank and GST details by 15 November. Owner: Head of Procurement.
The percentages give the reader proportion. The action is specific enough that a follow-up review can test whether it happened.
Rating findings
SIA 370 does not prescribe a rating scale, so the scale should be agreed with the audit committee or management at planning and applied the same way every time. A common approach scores likelihood and impact from 1 to 3 each and multiplies them:
| Score (likelihood x impact) | Rating | Expected response |
|---|---|---|
| 6 to 9 | High | Action within 30 to 60 days; reported to the audit committee |
| 3 to 4 | Medium | Action within the quarter |
| 1 to 2 | Low | Action at management's discretion; tracked |
In the vendor example, likelihood 2 (the gap has already been exploited seven times) and impact 3 (direct cash loss is possible) give a score of 6, a High rating. Write down the reasoning for each rating in the working papers so that the rating can be defended if challenged.
Management response and action plan
Each observation needs a corrective action, an owner by designation and a target date. Do not accept "noted" or "will take care" where a control change is needed. Where the organisation uses counter-signed action plans, attach them to the final report.
Checklist before the report is issued
- Every significant observation traces to working-paper evidence.
- Objective, scope, approach and exclusions are stated.
- The report states that the audit was conducted in accordance with the Standards on Internal Audit.
- The executive summary fits on one page and leads with the highest-rated issues.
- Facts, management explanations and auditor conclusions are kept apart.
- Each finding explains why it matters, with numbers where available.
- Each action is testable and has an owner and a date.
- Ratings follow the agreed scale.
- Any assurance statement matches what was agreed at planning.
- A written draft was shared with the auditee, and changes after the draft are documented.
- Draft and final versions are filed and cross-referenced.
Reporting feeds follow-up
An agreed action is not a closed risk. SIA 390, Monitoring and Reporting of Prior Audit Issues, deals with checking whether actions were carried out. Clear, dated actions in the SIA 370 report are what make that follow-up possible.
Common reporting mistakes
- Exception dumping: listing every deviation with equal weight instead of ranking by risk.
- Unsupported impact: describing a possible loss as if it had occurred.
- Generic recommendations: "strengthen controls" without naming the control.
- No owner: an action with no accountable person.
- Overstated assurance: wording that goes beyond the scope and evidence.
- Late reports: issuing so long after fieldwork that the issue is stale.
Updated on 27 September 2026: retitled; added the five SIA 370 report elements as listed by the ICAI Board of Studies, a finding-writing format with a worked vendor example, a rating scale, and documentation requirements.
