How to Structure an Internal Audit Report
Most audit reports are read by people who will never reach page four. Structure the report so the first page carries the decision, and the detail supports it for those who need it.
Lead with the conclusion
The executive summary should state the overall opinion, the number of findings by rating, and the two or three things the reader must act on. If a busy director reads only this page, they should still know what is wrong and who owns it.
State scope and, just as importantly, what was excluded
Record the period, the entities, the processes, and the criteria. Then state what was not covered. Explicit exclusions protect the function later, when something surfaces in an area the audit never examined.
Write findings in a fixed order
Condition, criteria, cause, consequence, recommendation. Condition is what you found; criteria is the standard it breached; cause is why it happened; consequence is what it risks; recommendation is what should change. Findings written in a consistent order are faster to review and much harder to argue with.
Rate findings against a published scale
Ratings only mean something if the scale is defined in the report and applied consistently across engagements. Otherwise a "high" in one report and a "high" in another are not comparable, and trend reporting across the year becomes meaningless.
Management response belongs to management
Each recommendation needs a named owner, an agreed action, and a date — written by management, not by audit. Where management accepts the risk instead, record that as an accepted risk with the reasoning, and escalate it in the committee pack.
Close the loop in the next report
Open recommendations from prior audits should appear in the follow-up section with current status. A report that never revisits prior commitments teaches the organisation that recommendations expire quietly.