Advanced Auditing, Assurance and Professional Ethics · Internal Audit

Internal Audit Reporting and Follow-up for CA Final

Updated 5 October 2026 · Fact-checked

An internal audit report communicates the scope, findings, risks, recommendations and management responses of an engagement to those charged with oversight, usually the Audit Committee or Board. To answer questions, state the report contents, the reporting line, the management response, and how the auditor tracks recommendations until closure.

Understand Internal Audit Reporting and Follow-up

Internal audit adds value only when its findings reach the right people and lead to action. Reporting is how findings reach them. Follow-up is how you check that action happened.

An internal audit report is a written communication at the end of an engagement. It tells the reader what was audited, why, what was found, how serious it is, what should change, and what management has agreed to do. A good report is clear, accurate, objective, concise, constructive, complete and timely.

The internal auditor reports on two levels. Administratively, the auditor may report to the CEO or a senior executive for day-to-day matters. Functionally, the auditor reports to the Audit Committee or Board, which approves the plan, receives the reports and oversees management action. Where Section 138 of the Companies Act, 2013 applies, the internal auditor can be a chartered accountant, a cost accountant or another professional the Board decides, and the Audit Committee or Board decides the scope, functions, periodicity and methodology. Independence depends on this functional line.

Management response is management's reply to each finding. It says whether management agrees, what action it will take, who is responsible and by what date. The auditor includes it in the report, so the Board sees both views. If management disagrees, the auditor records the disagreement. Where the risk of not acting appears unacceptable, the auditor escalates it to the Audit Committee.

Follow-up is the process of checking whether agreed actions were implemented, were effective, or whether management has accepted the risk of not acting. The auditor keeps a tracker of open points, verifies evidence of closure and reports status to the Audit Committee regularly. Unresolved high-risk points are escalated.

Key rules to remember

Typical contents of an internal audit report: Title and addressee + Scope and objectives + Period covered + Methodology + Findings (criteria, condition, cause, effect) + Risk rating + Recommendations + Management response (action, owner, date) + Conclusion; Use this as a checklist. The finding structure criteria-condition-cause-effect is a common framework for writing each observation.
Qualities of a good report: Clear, Accurate, Objective, Concise, Constructive, Complete, Timely; Examiners often ask for these in a list. Add one line of meaning for each.
Reporting lines: Functional line: Audit Committee or Board. Administrative line: senior management.; The functional line protects independence. Name both when asked.
Follow-up cycle: Recommendation, Management response, Action plan with owner and date, Tracking, Verification, Status report to Audit Committee, Escalation if overdue or unaccepted; Follow-up covers verification of implementation, not only collecting management's assurance.
Section 138 position: Prescribed classes of companies must appoint an internal auditor. The Audit Committee or Board decides scope, functions, periodicity and methodology in consultation with the internal auditor.; State the classes only if the question gives them or you are sure of the Rules.

How to solve Internal Audit Reporting and Follow-up questions

Use this method for any question on internal audit reports, communication or follow-up, whether theory or a case scenario.

1Identify what is asked: report content, reporting line, management response, follow-up, or a mix.
2Pick the heading you will use for each part of the answer, such as report contents, communication, management response, follow-up.
3State the rule or principle in one line, for example the report goes to the Audit Committee or Board and includes management's response.
4Apply it to the facts. Name the finding, its risk, the person to whom it is reported and the action needed.
5For follow-up, state who tracks, what evidence is verified, how often status is reported and when you escalate.
6Conclude with a clear recommendation or the action the internal auditor should take.
7Check that you have tied the answer to independence and timeliness where relevant.

Quickest way: R-F-M-F: Report, Forward, Management, Follow

When to use it: Use it when time is short in a written answer or when eliminating MCQ options.

Report: list what the report must contain, scope, findings, risk, recommendation.
Forward: send it to the Audit Committee or Board, the functional line, with a copy to management.
Management: include the management response with action, owner and date, or record disagreement.
Follow: track, verify, report status and escalate unresolved high-risk items.
In MCQs, reject options where the auditor drops a finding because management objects, or closes a point only on management's word.

Common mistakes in Internal Audit Reporting and Follow-up

Treating management as the final recipient of the report.
Students think the auditee is the main audience because it receives the draft.
Fix: Say the report goes to the Audit Committee or Board on the functional line. Management gets the draft to respond and acts on it.
Leaving out the management response.
Students focus on findings and recommendations only.
Fix: Always list the response with action, owner and date. Mention the auditor records any disagreement.
Dropping a finding because management disagrees.
Students confuse cooperation with independence.
Fix: The auditor keeps a supported finding, records management's view and escalates if the risk is significant.
Treating follow-up as optional or as a one-time email.
Students stop the story at the report.
Fix: Describe a tracker, verification of evidence, periodic status reports and escalation.
Confusing the internal audit report with the statutory auditor's report under SA 700.
Both are called audit reports.
Fix: The internal report has no prescribed opinion format and serves management and governance. The statutory report gives an opinion on financial statements to members.
Writing a vague report with no risk rating or cause.
Students list symptoms without analysis.
Fix: For each finding give criteria, condition, cause, effect, risk rating and a practical recommendation.

Worked examples

Example 1

The internal auditor of a listed manufacturing company finds that purchase orders above the approved limit were released without the second approval. The purchase head says the delays were due to urgent production needs and asks that the finding be removed from the report. What should the internal auditor do?

Show the solution

Identify the issue: a control breach supported by evidence, and a request to suppress the finding.
State the principle: the report must be objective and complete. The auditor's independence is protected by the functional line to the Audit Committee.
Apply: the auditor keeps the finding with criteria (approval policy), condition (orders without second approval), cause (urgency, weak enforcement) and effect (unauthorised commitments).
Record the purchase head's explanation as the management response, along with proposed action, owner and date.
If the head does not agree to act and the risk is significant, escalate to the Audit Committee.
Add the point to the follow-up tracker.

Answer: The auditor should not remove the finding. The finding stays in the report with management's explanation recorded as the response. Any unresolved significant risk goes to the Audit Committee, and the point is tracked until closed.

Example 2

An internal audit report in January recommended automated three-way matching of invoices. Management agreed to implement it by March. In June, the internal auditor learns that implementation has not begun. Explain the follow-up steps.

Show the solution

Identify: an agreed action is overdue, so the follow-up process applies.
Check the tracker for the owner, date and any revised date. Ask management for the reason for delay.
Verify through evidence, such as system configuration or a test of recent invoices, instead of relying only on assurance.
Assess the risk of the delay, such as continued duplicate or unmatched payments.
Report the status as overdue to the Audit Committee with the reason and new date proposed.
If management accepts the risk of not acting, record that it is management's decision and inform the Audit Committee. Continue to track the point.

Answer: The auditor treats the point as open and overdue, verifies the actual position with evidence, and reports the status to the Audit Committee with a revised date or an accepted risk decision. The item stays on the tracker until implementation is verified or the Committee decides otherwise.

Exam tips

For a 'draft a report' question, give a short format with headings: scope, findings, recommendations, management response, conclusion.
In case scenarios, check whether management is pressing to change a finding. The answer usually turns on independence and escalation.
Always mention the Audit Committee or Board as the functional reporting line.
Write follow-up as a cycle with tracking, verification and escalation, not as one line.
Link to Section 138 only in plain words unless the question gives details of the Rules.

Practice questions from Internal Audit

Internal Audit Reporting and Follow-up in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Reporting and Follow-up: frequently asked questions

To whom does an internal auditor report under Section 138?

The internal auditor reports as the Audit Committee or Board decides. In practice the functional report goes to the Audit Committee or Board, which protects independence. Day-to-day administrative matters may go through senior management.

What should an internal audit report contain?

It should state the scope, objectives, period, methodology, findings, risk ratings, recommendations and management responses, with a conclusion. For each finding, explain the criteria, condition, cause and effect.

What is the purpose of follow-up in internal audit?

Follow-up checks that agreed actions are carried out and are effective. It gives the Audit Committee assurance that risks are being addressed. Overdue or unaccepted high-risk items are escalated.

Is the internal audit report the same as the statutory audit report?

No. The statutory auditor gives an opinion on the financial statements under the SAs for members. The internal audit report is a governance and management tool with no prescribed opinion format.