Internal and Forensic Audit · Reporting under Internal Audit

Contents and Structure of an Internal Audit Report

Updated 11 October 2026 · Fact-checked

An internal audit report is the written output of an engagement. It states the scope and objectives, summarises the conclusion, and sets out each observation with criteria, condition, cause, effect, a risk rating, a recommendation and management's response with owner and date. Answer exam questions in that order.

Understand Contents and Structure of an Internal Audit Report

An internal audit report is how the internal auditor communicates the results of an engagement to management and those charged with governance. Fieldwork has no value until findings reach people who can act on them. The report is also your record of what was examined and what was concluded.

There is no single mandatory format for every entity. SA 610 (Revised) itself notes that the objectives, scope and status of internal audit functions vary widely with the size and structure of the entity and the needs of management. So the layout differs, but a sound report always carries the same building blocks.

The usual blocks are: title, addressee and date; background; objectives and scope (including period covered and any limitations); an executive summary with the overall conclusion or rating; detailed observations; recommendations; management response with action owner and target date; and annexures such as data tables or the list of documents reviewed.

Each observation is built in a fixed pattern. Criteria is what should be (policy, law, standard). Condition is what you found. Cause is why it happened. Effect is the risk or loss that results. Then comes the recommendation, which should fix the cause, not only the symptom. Many students remember this as the five Cs: criteria, condition, cause, consequence (effect), corrective action.

A risk rating (for example high, medium, low) helps readers prioritise. The rating depends on likelihood and impact, and the scale should be defined in the report or the audit charter. Management response closes the loop: agree, partly agree or disagree, with reasons, a responsible person and a date. This feeds the follow-up process.

Key rules to remember

Structure of an observation: Criteria + Condition + Cause + Effect + Recommendation (+ Management response); Use this order for every finding. It is the standard answer to 'criteria, cause, effect, recommendation' questions.
Order of the report: Title and addressee → Background → Objectives → Scope → Executive summary → Observations → Recommendations → Management response → Annexures; Layout varies by entity; the elements stay the same. Say so in your answer.
Risk rating logic: Risk rating = Likelihood × Impact (assessed as High / Medium / Low); A common practice, not a fixed rule. State the scale you use.

How to solve Contents and Structure of an Internal Audit Report questions

For any question on contents or structure, answer in the order the reader would meet the report, then illustrate with the facts given.

1Read the question to see whether it asks for the full report layout, one observation, or a critique of a given report.
2State in one line what the report is for: communicating results to management and those charged with governance.
3List the header elements: title, addressee, period, date, and the engagement objectives and scope with limitations.
4Give the executive summary and overall conclusion or rating, then the detailed observations.
5For each observation write criteria, condition, cause, effect and a risk rating using the facts in the case.
6Add practical recommendations that address the cause, then management response with owner and target date.
7Mention annexures and the link to follow-up and the audit committee.
8Close with a short conclusion that matches the facts, for example which element was missing in the report given.

Quickest way: Five-C checklist

When to use it: Use it when time is short or when the question gives a fact pattern and asks you to draft or fix an observation.

Write the headings: Objective, Scope, Summary, Observations, Recommendations, Response.
Under Observations write Criteria, Condition, Cause, Effect for each finding.
Tag each finding High, Medium or Low with a one-line reason.
Write one recommendation per cause with an owner and date.
Add one line on follow-up.

Common mistakes in Contents and Structure of an Internal Audit Report

Listing findings without criteria
Students describe what went wrong but not the standard it breaches.
Fix: Always name the policy, law or procedure first, then the deviation.
Confusing cause with effect
Both sound like consequences of the problem.
Fix: Cause is why it happened (for example no maker-checker); effect is the risk that follows (for example duplicate payments).
Vague recommendations
Writing 'improve controls' feels safe.
Fix: State a specific action, who does it and by when, aimed at the root cause.
Omitting scope limitations
Scope is treated as a formality.
Fix: State the period, locations and areas covered, and anything not examined or restricted.
Leaving out management response
The auditor thinks the report ends with recommendations.
Fix: Include agreed action, owner and timeline, or reasons for disagreement; this drives follow-up.
Rating risk without reasons
Ratings seem obvious to the writer.
Fix: Tie the rating to likelihood and impact, and use a defined scale.

Worked examples

Example 1

During an internal audit of Sagar Traders Ltd, you find that 14 vendor payments in the quarter were made without three-way matching of purchase order, goods receipt note and invoice. Two payments totalling ₹3,40,000 were duplicated. The procurement policy requires three-way matching. Draft the observation.

Show the solution

Criteria: the procurement policy requires three-way matching before any vendor payment.
Condition: 14 payments in the quarter were released without matching; two payments totalling ₹3,40,000 were paid twice.
Cause: the accounts system lets payment be released without a matching check, and there is no independent review of the payment run.
Effect: financial loss from duplicate payment, risk of fictitious or inflated invoices, and weak control over cash.
Risk rating: High, because the likelihood is demonstrated by actual loss and the impact on cash and control is significant.
Recommendation: recover the ₹3,40,000 from the vendor, enforce a system block on payment without matching, and add a review of the payment run by a person who did not prepare it.
Management response: to be recorded with owner (Head of Accounts) and a target date.

Answer: The observation sets out the policy requirement, the 14 unmatched and two duplicate payments, the missing system and review controls, the loss and fraud risk, a High rating, specific recommendations and a recorded management response with owner and date.

Example 2

A junior auditor's report on a branch review contains only a list of exceptions and a recommendation to 'strengthen controls'. List what is missing from the report and why it matters.

Show the solution

Header and context: no addressee, period, background, objectives or scope, so the reader cannot tell what was covered or its limits.
No executive summary or overall conclusion, so senior readers cannot see the main message quickly.
Observations lack criteria, cause and effect, so the reader cannot judge significance or the root problem.
No risk rating, so management cannot prioritise action.
Recommendation is vague; it should be specific and address the cause.
No management response, owner or target date, so follow-up has no baseline.
Annexures supporting the exceptions are not attached.

Answer: The report is missing objectives, scope, executive summary, criteria, cause and effect for each finding, risk ratings, specific recommendations, management response with owner and date, and annexures. Without these it is hard to act on and hard to follow up.

Exam tips

Write the observation pattern (criteria, condition, cause, effect, recommendation) whenever a case gives a finding.
Say that formats vary by entity but the core elements stay the same; this earns the conclusion mark.
Use short headings and bullets in a 3-hour written paper so the structure is visible to the examiner.
Always include a risk rating and management response, as students often skip them.
Use the case facts and rupee figures in your drafted observation rather than generic wording.

Practice questions from Reporting under Internal Audit

Contents and Structure of an Internal Audit Report in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Contents and Structure of an Internal Audit Report: frequently asked questions

What are the main contents of an internal audit report?

Title and addressee, background, objectives, scope, executive summary and conclusion, detailed observations, recommendations, management response and annexures. Observations carry criteria, condition, cause, effect and a risk rating.

Is there a prescribed format for an internal audit report?

No single format applies to every entity. Internal audit functions vary widely in objectives, scope and status, so the layout follows the engagement and the needs of management and those charged with governance. The core elements stay the same.

What is the difference between cause and effect in an observation?

Cause is the reason the gap exists, such as a missing review step. Effect is the risk or loss that follows, such as duplicate payment. The recommendation should target the cause.

Why is management response part of the report?

It records whether management agrees, what action it will take, who owns it and by when. This gives the auditor a clear base for follow-up and for reporting to the audit committee.