Reporting under Internal Audit: formula sheet

Key formulas

Meaning in one line

Internal audit report = scope + findings + risk rating + recommendations + management response

Use this as your skeleton when defining the report.

Core objectives

Inform → assess controls → recommend → obtain action plan → enable follow-up

Write these as bullet points in the answer.

Coordination with external auditor (SA 610 Revised, A25)

Effective when the external auditor has access to relevant internal audit reports and is told of significant matters affecting the audit

The external auditor keeps sole responsibility for the audit opinion.

Core qualities (memory aid)

Clear + Accurate + Objective + Concise + Complete + Constructive + Timely

Use as the skeleton of any answer. Add extra qualities only if you can explain them.

Test of a good report

Understood + Trusted + Acted on

Link each quality to one of these three aims to show depth.

Finding structure

Condition + Criteria + Cause + Effect + Recommendation

A widely used way to make a finding accurate, complete and constructive. It is a practice framework, not a rule from the SA text supplied.

Interim report

Interim report = findings so far, issued during the engagement

Used for long engagements or when early action is needed. It is not the final conclusion and may be revised.

Final report

Final report = full findings + conclusion + recommendations + management response

Issued at the end of fieldwork after discussion with the auditee. It closes the engagement.

Periodic report

Periodic report = regular summary for a fixed period (month, quarter, year)

Often goes to the audit committee. It shows progress, themes and open items.

Special report

Special report = one named matter + a specific request

Examples: a suspected loss, a policy breach, a one-off review asked by the board.

Flash report

Flash report = urgent issue + immediate communication

Short and fast. A fuller report follows later.

Exception report

Exception report = only items that deviate from the standard or limit

Management by exception. It saves reading time and focuses on what needs action.

Choosing the type

Type = f(timing, scope, urgency, audience)

A memory aid, not a legal rule. Use it to justify your choice in an answer.

Structure of an observation

Criteria + Condition + Cause + Effect + Recommendation (+ Management response)

Use this order for every finding. It is the standard answer to 'criteria, cause, effect, recommendation' questions.

Order of the report

Title and addressee → Background → Objectives → Scope → Executive summary → Observations → Recommendations → Management response → Annexures

Layout varies by entity; the elements stay the same. Say so in your answer.

Risk rating logic

Risk rating = Likelihood × Impact (assessed as High / Medium / Low)

A common practice, not a fixed rule. State the scale you use.

Report process sequence

Draft → Internal review → Exit meeting → Management comments → Finalise → Issue → Distribute → Follow-up

Learn this order. Exam answers lose marks when steps are shuffled.

Elements of a finding

Condition + Criteria + Cause + Effect + Recommendation

Use these five headings to structure any observation you write.

Management comment content

Agree or disagree + Action plan + Responsible person + Target date

A comment without owner and date is weak and hard to follow up.

Reading reports under SA 610 (Revised), para 22

External auditor reads internal audit reports on work it plans to use

Purpose: understand the nature and extent of procedures performed and related findings.

Status of a recommendation

Closed (verified) | Partly implemented | Not implemented | Overdue | Risk accepted by management

Use clear status categories. Close an item only on evidence, not on a verbal assurance.

Action plan record

Finding + Risk rating + Recommendation + Owner + Target date + Status + Evidence

Every tracked item needs all seven elements. Missing owner or date is the usual cause of drift.

Implementation rate

Implementation rate (%) = Recommendations implemented ÷ Total recommendations due × 100

A simple tracking measure. Count only items that are due and verified, and show overdue items separately.

SA 610 (Revised) para 22

Read the internal audit reports on the work you plan to use

The external auditor reads them to understand the nature and extent of procedures performed and the findings.

SA 610 (Revised) para 23

Evaluate whether work was properly planned, performed, supervised, reviewed and documented; evidence was sufficient and appropriate; conclusions and reports were appropriate and consistent

Explains why follow-up documentation and consistent reporting matter.

Law layer

Section 138 Companies Act, 2013 + Rules: who must appoint, who may be appointed, to whom the auditor reports

Report goes to the audit committee or board as the board decides. Quote thresholds only from the Rules text.

Standards layer

ICAI SIAs: planning, evidence, documentation, communication of results

Give the SIA number only if you are sure of it from your study material.

IIA quality of communication

Accurate, objective, clear, concise, constructive, complete, timely

Use this as a checklist when asked what a good report must be.

SA 610 (Revised) para 23 test

Work properly planned, performed, supervised, reviewed, documented + sufficient evidence + conclusions appropriate and reports consistent with work

This is what the external auditor tests before using internal audit reports.

Independence rule

A statutory auditor of an entity cannot be its internal auditor

Quoted in SA 610 (Revised) from the ICAI Code of Ethics, para 290.173, because of self-review threat.

Quick revision

• An internal audit report communicates findings, risks and recommendations to management and the audit committee.
• A good report is clear, concise, accurate, objective, timely, constructive and complete.
• Reports can be written or oral, and interim or final. Know when each suits.
• Each finding should show condition, criteria, cause, effect and recommendation.
• Include objective, scope, methodology, findings, conclusion and action plan in the structure.
• Discuss the draft with the auditee before issue so facts are agreed.
• Review the draft internally before it leaves the audit team.
• Management responses and agreed action dates belong in the final report.
• Follow-up checks whether agreed actions were actually implemented.
• Report significant findings to the audit committee, not only to line managers.
• Support every finding with evidence from working papers.
• Apply standards and legal requirements exactly as in the ICSI material.

Common mistakes

• Treating the internal audit report as an opinion on true and fair view Fix: State that it is a management and governance tool covering controls, risk, operations and compliance.
• Listing objectives without explaining them Fix: Add one line of reasoning to each objective, as case-based answers reward analysis.
• Listing the qualities without explaining them. Fix: Add a one-line meaning and a short example for each quality.
• Treating conciseness as meaning a short report. Fix: Conciseness means no unnecessary content. A report must still be complete on significant matters.
• Treating interim and final reports as the same thing. Fix: Remember that interim comes during the engagement and may change. Final comes at the end and closes it with the conclusion and management response.
• Calling a flash report a full report. Fix: Describe it as short, urgent and followed by a detailed report later.
• Listing findings without criteria Fix: Always name the policy, law or procedure first, then the deviation.
• Confusing cause with effect Fix: Cause is why it happened (for example no maker-checker); effect is the risk that follows (for example duplicate payments).
• Treating the exit meeting as a chance to negotiate away findings. Fix: State that the meeting confirms facts and agrees practical actions. Valid findings stay in the report even if management disagrees, with its view recorded.
• Skipping internal review and sending the draft straight to the auditee. Fix: Always place review by a senior or the head of internal audit before the exit meeting.

Exam tips

• Open with a two-line definition; it is easy marks.
• Use bullets for objectives and add a reason to each.
• Always mention both management and the audit committee.
• In case questions, follow provision, analysis, conclusion: define the report, apply the facts, then advise.
• Cite SA 610 (Revised) only for coordination with the external auditor, and do not overstate it.
• Always give meaning plus an example for each quality. A bare list earns few marks.
• In case questions, map each fault in the given report to a named quality. This shows the analysis examiners look for.
• For objectivity, mention the reporting line to the audit committee and freedom from conflicting duties, as SA 610 (Revised) sets out.