Internal and Forensic Audit · Reporting under Internal Audit

Internal Audit Report Preparation, Review and Communication

Updated 11 October 2026 · Fact-checked

Internal audit report preparation is a sequence: draft findings from working papers, review the draft internally, discuss it with the auditee (exit meeting), record management comments, finalise, issue to the right authority and distribute. Each step protects accuracy, fairness and usefulness of the report.

Understand Report Preparation, Review and Communication

An internal audit report is the main product of the engagement. Fieldwork only has value when findings reach people who can act on them. So the report process is as important as the testing.

The process starts with drafting. The auditor goes through working papers and picks the observations that matter. Each observation should state the condition found, the criteria it was tested against, the cause, the effect or risk, and a recommendation. Every statement must be backed by evidence in the working papers.

Next comes internal review. A senior team member or the head of internal audit checks the draft for accuracy, evidence, tone, clarity and consistency with the audit programme. Nothing should leave the audit team before this review.

Then the draft is discussed with the auditee, usually in an exit meeting (closing meeting). Its purpose is to confirm facts, remove misunderstandings, and agree practical recommendations. It is not a negotiation to drop valid findings. The auditee then gives management comments: agreement or disagreement, the action planned, the person responsible and a target date. Where management disagrees, the report records both views fairly.

Finally the report is finalised, issued and distributed. It goes to the authority that commissioned the audit, such as the audit committee or senior management, with copies to the auditee and others who need it. Distribution is limited to those with a need to know, because reports may contain sensitive information. Follow-up on agreed actions comes after issue.

A useful link from SA 610 (Revised): the external auditor reads internal audit reports on work it plans to use, to understand the nature and extent of procedures performed and the related findings. A clear, evidence-based report therefore also serves the external auditor.

Key rules to remember

Report process sequence: Draft → Internal review → Exit meeting → Management comments → Finalise → Issue → Distribute → Follow-up; Learn this order. Exam answers lose marks when steps are shuffled.
Elements of a finding: Condition + Criteria + Cause + Effect + Recommendation; Use these five headings to structure any observation you write.
Management comment content: Agree or disagree + Action plan + Responsible person + Target date; A comment without owner and date is weak and hard to follow up.
Reading reports under SA 610 (Revised), para 22: External auditor reads internal audit reports on work it plans to use; Purpose: understand the nature and extent of procedures performed and related findings.

How to solve Report Preparation, Review and Communication questions

For any question on report preparation, review or communication, build your answer around the process and apply it to the facts given.

1Read the facts and identify which stage of the process the question tests: drafting, review, exit meeting, comments, issue or distribution.
2State the purpose of that stage in one or two lines.
3List what must be done at that stage, linking each point to the facts in the case.
4Point out any weakness in the facts, such as unsupported findings, skipped review, or missing management comments.
5Explain how disagreements with the auditee should be handled: facts verified, both views recorded, auditor's independent judgment retained.
6Cover distribution: who receives the report and why, keeping confidentiality in mind.
7Conclude with a clear recommendation and mention follow-up of agreed actions.

Quickest way: Stage-purpose-action method

When to use it: Use when time is short or the question simply asks you to explain the process or the exit meeting.

Write the sequence in one line: draft, review, exit meeting, comments, finalise, issue, distribute.
Add one line of purpose for each stage.
For the exit meeting, add agenda: confirm facts, discuss recommendations, obtain comments, agree timelines.
Add one line on distribution and confidentiality.
Close with follow-up.

Common mistakes in Report Preparation, Review and Communication

Treating the exit meeting as a chance to negotiate away findings.
Students assume cooperation with the auditee means giving in.
Fix: State that the meeting confirms facts and agrees practical actions. Valid findings stay in the report even if management disagrees, with its view recorded.
Skipping internal review and sending the draft straight to the auditee.
Students focus on the auditee discussion and forget quality control.
Fix: Always place review by a senior or the head of internal audit before the exit meeting.
Listing findings without evidence or cause.
Students write only the observation and recommendation.
Fix: Use condition, criteria, cause, effect and recommendation, each tied to working papers.
Writing management comments without action owner or date.
Students think agreement alone is enough.
Fix: Mention responsible person and target date so follow-up is possible.
Distributing the report widely to everyone.
Students equate communication with openness.
Fix: Limit distribution to the commissioning authority, the auditee and those with a need to know, protecting sensitive information.
Confusing internal audit reports with the external auditor's report.
Both are called audit reports.
Fix: Internal audit reports go to management or the audit committee. The external auditor only reads them when planning to use that work, as SA 610 (Revised) requires.

Worked examples

Example 1

During an internal audit of Sundaram Textiles Ltd, the auditor finds that purchase orders above the approved limit were released without approval. Explain how this finding should be taken from draft to final report.

Show the solution

Draft: record condition (orders above limit released without approval), criteria (delegation of authority), cause (no system block), effect (risk of unauthorised commitments) and recommendation (system-enforced approval), with working paper references.
Review: the audit manager checks that evidence supports the finding, amounts are accurate and the tone is factual.
Exit meeting: discuss the finding with the purchase head and finance head to confirm facts and agree a workable control.
Management comments: obtain agreement or disagreement, the action plan, the responsible person and a target date.
Finalise: incorporate comments. If management disputes the facts, re-verify; if the finding stands, keep it and record management's view.
Issue to the audit committee or the authority that commissioned the audit, with a copy to the auditee, and then follow up on the action.

Answer: The finding moves through draft, internal review, exit meeting, management comments, finalisation and issue, after which implementation is followed up.

Example 2

Why should the internal auditor hold an exit meeting, and what should be discussed? Can management's disagreement remove a finding?

Show the solution

Purpose: to ensure the report is factually accurate, avoid surprises, and obtain commitment to action.
Agenda: confirm facts and figures, discuss causes and risks, review recommendations for practicality, obtain management comments and agree timelines and responsibility.
Disagreement: the auditor re-examines the evidence. If the facts were wrong, the finding is corrected or withdrawn.
If the evidence supports the finding, it remains in the report, and management's disagreement and reasons are recorded alongside it.
The auditor keeps independent judgment, as objectivity means not allowing bias or undue influence to override professional judgment.

Answer: The exit meeting confirms facts and agrees action. Management disagreement alone does not remove a finding; only evidence can, otherwise both views are reported.

Exam tips

Write the process in correct order and give a one-line purpose for each stage.
In case questions, apply the stage to the facts given and name the people involved.
Always mention that management comments include action, owner and date.
Mention confidentiality and need-to-know when discussing distribution.
If asked about the external auditor, link to SA 610 (Revised), para 22: reading reports of work it plans to use.

Practice questions from Reporting under Internal Audit

Report Preparation, Review and Communication: frequently asked questions

What is an exit meeting in internal audit?

It is the closing discussion between the internal auditor and the auditee before the report is finalised. Facts are confirmed, recommendations are discussed and management comments and timelines are agreed.

Can the auditee change the audit findings?

Not on its own. If the auditee proves a fact wrong, the auditor corrects the finding. If the evidence supports it, the finding stays and management's view is recorded.

Who receives the internal audit report?

Usually the authority that commissioned the audit, such as the audit committee or senior management, and the auditee. Others receive it only if they need it.

Does the external auditor read internal audit reports?

Yes, where it plans to use the internal audit function's work. SA 610 (Revised), para 22 requires reading those reports to understand the procedures performed and the findings.