Internal and Forensic Audit · Practices related to Internal Auditing

Internal Audit Reporting and Follow-up: Format, Findings and Tracking

Updated 11 October 2026 · Fact-checked

Internal audit reporting is the formal communication of audit results, findings and recommendations to management and the audit committee. Follow-up is the tracking of agreed actions until they are implemented. To answer a question, state the finding in a structured way, give the risk, the recommendation, management's response, and the tracking status.

Understand Internal Audit Reporting and Follow-up

An internal audit is useful only if its results reach the right people and lead to action. The internal audit report is the main output of an engagement. It tells management and the audit committee what was examined, what was found, how serious it is and what should be done.

A good finding is built from five parts, often remembered as the five Cs: Criteria (what should be), Condition (what is), Cause (why the gap exists), Consequence (the risk or effect), and Corrective action (the recommendation). If you can write these five points for each issue, your answer will be complete.

A typical report has a title and addressee, the objective and scope, the period covered, a summary of the overall conclusion, detailed findings with ratings, recommendations, management's response with action owners and target dates, and any limitations. Findings are usually rated by risk, for example high, medium or low, so that readers can focus on what matters most.

Communication does not end with a final report. Auditors usually discuss draft findings with the auditee first, to confirm facts and obtain management responses. Then the report goes to senior management and, for significant matters, to the audit committee. For listed companies and certain other companies, the Companies Act, 2013 requires an audit committee, and the internal auditor commonly reports to it on findings and on progress of actions.

A follow-up is the process of checking whether management has implemented the agreed actions. The internal auditor keeps a tracker listing each recommendation, owner, due date and status. Overdue or high-risk items are escalated. Follow-up closes the loop: without it, reports gather dust and risks stay open.

Key rules to remember

Elements of a finding (5 Cs): Criteria + Condition + Cause + Consequence + Corrective action; Use this as a checklist for every finding you write in an answer.
Core contents of a report: Objective + Scope + Period + Conclusion + Findings + Recommendations + Management response + Limitations; Adapt the order to the question, but cover each element.
Follow-up tracker fields: Issue ref + Risk rating + Recommendation + Owner + Target date + Status; Status is typically open, in progress, implemented or overdue.
Reporting line: Auditee discussion → Management → Audit committee; Administrative reporting may be to management; functional reporting should be to the audit committee to protect independence.

How to solve Internal Audit Reporting and Follow-up questions

Use this method for any question on report writing, communication or follow-up.

1Read the question and identify whether it asks for report contents, a finding, communication or follow-up.
2State the purpose briefly: informing management and the audit committee and driving corrective action.
3Structure the answer with headings that match the report elements or the 5 Cs.
4Apply the facts given: name the issue, the control gap, the risk in rupees or impact if stated, and the recommendation.
5Add management's response, owner and target date, and a risk rating where relevant.
6Explain the follow-up: tracker, verification of implementation, escalation of overdue items.
7Conclude with who receives the report, especially the audit committee, and why independence matters.

Quickest way: 5 Cs plus tracker

When to use it: Use when time is short and the question gives a scenario with an issue to report on.

Write the finding in five lines: criteria, condition, cause, consequence, corrective action.
Add one line for management response with owner and date.
Add one line for follow-up and escalation to the audit committee if high risk or overdue.

Common mistakes in Internal Audit Reporting and Follow-up

Writing findings as only a description of what went wrong.
Students forget that a finding needs cause, risk and recommendation.
Fix: Use the 5 Cs every time so the finding is complete.
Skipping discussion with the auditee before issuing the report.
Students treat reporting as a one-way step.
Fix: Mention the draft discussion to confirm facts and obtain management responses.
Ignoring follow-up and ending the answer at the report.
Students see the report as the final output.
Fix: Always add tracking, verification and escalation of unresolved items.
Giving vague recommendations such as 'improve controls'.
Students avoid specifics for fear of being wrong.
Fix: Make recommendations specific, practical and linked to the cause, for example 'introduce a second-level approval for payments above a set limit'.
Reporting only to the line manager and not the audit committee.
Students overlook the independence aspect.
Fix: State that significant findings go to the audit committee, which supports the independence of internal audit.

Worked examples

Example 1

During an internal audit of Sundaram Textiles Ltd., you find that vendor bank details were changed in the master file without any independent approval. Three payments totalling ₹18,40,000 went to the changed accounts. Draft the finding.

Show the solution

Criteria: changes to vendor master data should be approved by a person independent of the payment process.
Condition: bank details were changed without independent approval, and three payments totalling ₹18,40,000 were made to the changed accounts.
Cause: no workflow control in the system and no maker-checker procedure for master data changes.
Consequence: risk of fraudulent or wrong payments and financial loss; rate the finding as high.
Corrective action: introduce maker-checker approval for master changes, review the three payments and confirm recipients, and produce a monthly report of changes for independent review.

Answer: The finding is rated high risk and states criteria, condition (₹18,40,000 paid after unapproved changes), cause (no maker-checker), consequence (fraud and loss risk) and recommended actions with an owner and date, then goes to management and the audit committee.

Example 2

Explain how an internal auditor should follow up on a report where management agreed to five recommendations, two of which are high risk and overdue.

Show the solution

Record all five recommendations in a tracker with owner, target date and status.
Obtain evidence of implementation from owners, and test it by checking documents or re-performing the control.
Update the status of each item as implemented, in progress or overdue.
For the two overdue high-risk items, discuss reasons with management and agree a revised date or support for the delay.
Escalate the unresolved high-risk items to the audit committee in the next report, noting the risk of leaving them open.
Close items only after verification and report the overall status.

Answer: The auditor tracks all five actions, verifies implementation with evidence, and escalates the two overdue high-risk items to the audit committee until they are resolved.

Exam tips

Use the 5 Cs as a template; it is the quickest way to show structure.
Link every recommendation to a cause so it does not look generic.
Always mention the audit committee and independence when a question asks about communication.
Add one line on follow-up in any reporting answer; many students leave it out.
If figures are given in the case, quote them in the condition and consequence.

Practice questions from Practices related to Internal Auditing

Internal Audit Reporting and Follow-up in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Reporting and Follow-up: frequently asked questions

What should an internal audit report contain?

It should contain the objective, scope and period, overall conclusion, detailed findings with risk ratings, recommendations, management responses with owners and dates, and any limitations. Keep the structure clear so readers can act on it.

How do I write an internal audit finding?

Write the criteria, condition, cause, consequence and corrective action. Keep each point short and tie the recommendation to the cause.

What is the internal audit follow-up process?

The auditor tracks each agreed recommendation with an owner and date, verifies implementation with evidence, updates the status and escalates overdue or high-risk items. The process continues until items are closed.

Why does internal audit report to the audit committee?

Reporting to the audit committee supports independence and gives the board-level oversight body visibility of significant risks and unresolved issues. Management still receives the report for action.