Internal Audit Report: Structure, Example, and How to Write It

The report is the only part of an audit read by people outside the audit team. Testing can be done with great care, but if the report is unclear, the findings are not understood, the recommendations are not carried out, and the value of the engagement is lost on the reader's desk.

This article is a practical guide to preparing an internal audit report: who the readers are, the components it needs, how to write and rate findings, a short example, the workflow from draft to issuance, and follow-up monitoring. References to standards and regulations were checked as of 13 November 2026.

The basic concepts and types of reports are covered in the article on audit report, while the quality characteristics and how to assess them are covered in the article on quality standards of internal audit reports. This page focuses on how to prepare the report.

What Is an Internal Audit Report and What Is Its Purpose?

An internal audit report is a formal document that communicates the results of one internal audit engagement: what was examined, what was found, what the conclusion is, and what needs to be corrected. In the Global Internal Audit Standards (GIAS), in effect since 9 January 2025, the term used is final engagement communication (final engagement communication). Standard 15.1 requires auditors to prepare one for every engagement, and it may take the form of a written report or a presentation supported by a written copy.

The report serves four purposes:

• Communicates results. Readers learn the conclusion on the effectiveness of governance, risk management, and internal control in the activity examined.
• Drives action. Findings and recommendations form the basis of management's follow-up plan.
• Serves as the official record. The report shows what was examined and on what basis conclusions were drawn, so it can be reviewed again.
• Supports monitoring. Each recommendation, together with its owner and deadline, is tracked until completion (Standard 15.2).

For listed companies and public companies, this report is also a regulatory obligation. POJK 56/POJK.04/2015 Article 7 letter e states that the internal audit unit's duties include preparing audit reports and submitting them to the president director and the Board of Commissioners. Letter f adds the duty to monitor, analyze, and report on the implementation of recommended corrective follow-up. This provision applies to issuers and public companies; government agencies have their own internal oversight basis.

Who Reads an Internal Audit Report?

A single report is read by several groups with different needs. GIAS Standard 11.2 requires communication to be adapted to the needs of its recipients: what is delivered to the board and senior management may differ from what the management of the activity under review receives.

• Directors and the Board of Commissioners. They want to know the conclusion, the level of risk, and the most significant findings. The executive summary is the most important section for them.
• Audit committee. They assess whether internal control is working and whether management follows up. They need finding ratings and follow-up status.
• Auditee management. The head of the audited unit needs detail: what deviated, why, and what is being asked of them.
• Other interested parties. For example the risk management unit or external examiners, depending on the chief audit executive's decision on distribution.

Standard 15.1 states that several versions of the final communication may be issued, with different formats and levels of detail for each audience. The chief audit executive decides to whom and how the report is delivered.

What Are the Components of an Internal Audit Report?

Standard 15.1 sets the minimum content, while style and format are left to the organization. For assurance engagements, the final communication must include the objectives, scope, findings with their significance and prioritization, scope limitations if any, recommendations and/or action plans, and a conclusion on the effectiveness of governance, risk management, and control. The report must also name the persons responsible and the planned completion date for actions. A commonly used layout in practice is as follows.

Two other provisions should be kept in mind. If an engagement is not conducted in conformance with the standards, the report must disclose the standards not met, the reasons, and the impact on the findings and conclusions. If management has already started or completed corrective action on a finding before the report is issued, that action must be acknowledged in the report.

How Do You Write Clear Audit Findings?

What Are the Elements of a Finding?

GIAS Standards 14.2 to 14.4 form the basis for writing findings: compare the criteria with the condition, trace the cause and effect, then determine recommendations or action plans. Standard 14.3 notes that a finding template covers the criteria, condition, root cause where possible, effect as risk or potential exposure, and significance and prioritization. In the report, these elements are written as follows:

• Condition. The actual situation found, supported by evidence. State the numbers, sample size, and period.
• Criteria. The benchmark for comparison: regulations, policies, SOPs, contracts, or standards.
• Cause. The reason the condition deviates from the criteria. The standards ask auditors to identify the root cause together with management, by repeatedly asking why.
• Effect. The impact or risk if the condition is left as is. Quantify where possible; estimates based on professional judgment and management input are acceptable.
• Recommendation. Action that closes the gap between condition and criteria, reduces risk to an acceptable level, and addresses the cause. Recommendations must be discussed with management (Standard 14.4).
• Management response. Whether management agrees, the action plan, the responsible person, and the deadline. The standards stress that carrying out the actions is management's responsibility.

Evidence for the condition is collected throughout the engagement and cross-referenced to the workpapers. It is covered in the articles on audit evidence and audit working papers.

How Do You Rate Findings?

Standard 14.3 requires each finding to be prioritized according to its significance, using a methodology set by the chief audit executive so that it is consistent across engagements. Significance is determined from the likelihood and impact of the risk, taking into account risk tolerance and existing controls (residual risk). The standards do not prescribe a particular scale. The three-level scale below is only an illustration:

• High. Residual risk exceeds tolerance; immediate action is needed and it is reported to the audit committee.
• Medium. Controls exist but are not yet adequate; improvement is scheduled within a reasonable period.
• Low. Minor deviation with limited impact; can be fixed within routine operations.

A finding rating differs from the engagement conclusion. Standard 14.5 gives an example of a conclusion scale: satisfactory, partially satisfactory, needs improvement, and unsatisfactory. Whether to use such a scale depends on the organization's methodology.

What Is the Difference Between a Weak and a Good Finding?

A weak finding contains only an opinion: “Purchase approval controls are weak.” The reader does not know how weak, by what measure, or what should be done. A good finding includes numbers, criteria, and period: “Of 25 purchase orders tested for the January to June period, three orders (12%) were approved after the goods were received, even though the Procurement SOP requires approval before an order is issued.” This example is illustrative.

What Does a Short Internal Audit Report Example Look Like?

The following example is entirely fictional and illustrative. The company name, figures, and dates were created to show the layout of a report, not to record a real audit.

• Title: Internal Audit Report on the Goods Procurement Process (illustrative)
• Unit examined: Procurement Division, PT Contoh Nusantara (fictional)
• Period: 1 January to 30 June 2026
• Purpose: assess whether goods procurement is carried out in accordance with the Procurement SOP and whether its approval controls operate effectively
• Ruang lingkup: purchase orders for goods above IDR 50 million; sample of 25 orders from a population of 140 orders; services procurement excluded
• Positive aspects: a comparison of three quotations documented for the whole sample
• Conclusion: procurement controls are generally partially satisfactory, except for order approval, which needs immediate improvement

In an actual report, each finding is described one by one with evidence and workpaper references, while a summary table like this one is placed in the executive summary or an appendix. The executive summary for the example above could read: goods procurement controls are generally partially satisfactory, but order approval needs immediate improvement; there is one high-rated finding, one medium, and one low, and management agrees with all of them with the last deadline on 30 November 2026.

What Is the Workflow from Draft to Issuance?

A good report is not written once at the end. The workflow below shows the usual working points; the detailed order follows the organization's methodology.

1. Prepare the framework from the planning stage. The objectives, scope, and criteria written in the internal audit work program become the opening section of the report.
2. Write draft findings during testing. Condition, criteria, cause, and effect are filled in from the workpapers as soon as testing of an area is finished. How this stage fits into the whole engagement is covered in the article on audit stages.
3. Supervisor reviewed. The supervisor checks whether every statement can be traced to relevant, reliable, and sufficient evidence, and whether the draft is consistent with the objectives and scope.
4. Discuss with the auditee. In a closing meeting (exit meeting), findings and recommendations are discussed with the management who have authority to change the activity under review. If there is a disagreement, Standard 14.4 requires a methodology that gives both parties the opportunity to state their positions; a formal statement from each can be attached to the report.
5. Receive management's response. Record the agreement, action plan, responsible person, and completion date, then correct the draft if any facts need correcting.
6. Approve the final report. Standard 15.1 requires the chief audit executive to review and approve the report before it is issued.
7. Distribute. The chief audit executive delivers the report to parties who can ensure its results are considered, for example the audit committee, directors, and those responsible for actions.

How Do You Monitor Follow-Up After the Report Is Issued?

A report is not finished working when it is issued. Standard 15.2 requires auditors to confirm that management implements the recommendations or its action plans, using an established methodology that covers three things:

• inquiring about the progress of implementation;
• performing follow-up assessments using a risk-based approach; and
• updating the status of management's actions in a tracking system.

The extent of procedures takes the significance of the finding into account. If management does not progress by the agreed dates, the auditor obtains and documents the explanation and discusses it with the chief audit executive. The chief audit executive determines whether senior management, through delay or inaction, has accepted a risk that exceeds the risk tolerance.

The standards note that tracking can use software, a spreadsheet, or another system that shows whether actions are still open or past due. For listed companies, monitoring and reporting on follow-up is also a duty named in POJK 56/POJK.04/2015 Article 7 letter f.

What Makes an Internal Audit Report High Quality?

GIAS Standard 11.2 names seven characteristics of audit communication. In the practice of writing reports, they mean:

• Accurate. Free from errors and distortion; figures and terms can be traced to evidence.
• Objective. Fair and balanced; avoid terms that may be seen as biased, such as “negligent” or “careless”, without a factual basis.
• Clear. Uses language readers understand, and explains uncommon technical terms.
• Concise. Removes detail and repetition unrelated to the engagement.
• Constructive. Collaborative in tone and helpful for improvement, not merely pointing out mistakes.
• Complete. Enough information and evidence for readers to reach the same conclusion as the auditor.
• Timely. Issued in line with the urgency of the issue so management has time to fix it.

The standards name methodologies such as style guides, templates, and supervisory review as ways to keep communication quality consistent. A fuller description of each characteristic and how to assess it is in the article on quality standards of internal audit reports.

What Are Common Mistakes in Preparing an Internal Audit Report?

• Findings without criteria. Without a benchmark, a finding reads only as the auditor's opinion.
• Stopping at symptoms. The root cause is not explored, so recommendations only patch things up.
• Vague recommendations. A sentence such as “improve supervision” names no action, owner, or deadline.
• All findings weighted equally. Without ratings, readers do not know which to address first.
• Surprises for the auditee. New findings appear in the final report without ever having been discussed.
• An executive summary that cannot stand alone. Directors have to open the whole report to understand the results.
• Ignoring what is already good. Good practices and improvements already made by management are not acknowledged, even though the standards require actions already taken to be included.
• Issued late and without monitoring. Findings go stale before they are read, and no one checks whether improvement happens.

How Does It Differ from an External Audit Report?

Both are called audit reports, but the preparer, readers, and purpose differ.

An internal audit report contains a conclusion on control effectiveness and recommendations for improvement, not an opinion on the fairness of the financial statements. The types of opinion and how to read them are covered in the article on audit opinion, while the overall function of internal audit is covered in the article on internal audit.

How Does Internal Audit Software Help Prepare Reports?

Audithink is internal audit management software with six features: risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. For reporting, follow-up monitoring keeps recommendations and their deadlines tracked, notifications remind users of approaching deadlines, and automated reports help prepare reports from data already recorded. Determining findings, ratings, and conclusions remains the auditor's job. Audithink is not an audit executor.

FAQ on Internal Audit Reports

Conclusion

A good internal audit report answers three questions for the reader: what was found, how important it is, and what should be done. With a complete structure, findings written on the basis of criteria and evidence, and disciplined follow-up monitoring, the report becomes a tool for improvement, not just an archive.

If your internal audit team wants to consolidate planning, follow-up, and reporting in one place, schedule an Audithink demo.