Internal Audit Report

Internal Audit Report

Report Information

Use note: This is an internal audit communication, not a contract between the internal audit function and management. Remove sections that do not fit the organization's charter, methodology, industry, or applicable law.

1. Executive Summary

1.1 Engagement Objective

The objective of this engagement was to [ASSESS / REVIEW / EVALUATE]:

[____________________________________________________________]

1.2 Overall Conclusion

Conclusion or rating: [________________________________]

Summary basis:

[____________________________________________________________]

[____________________________________________________________]

1.3 Results at a Glance

1.4 Significant Matters

• Matter: [________________________________]
• Why it matters: [________________________________]
• Management response: [________________________________]

• Target date: [__/__/____]

• Matter: [________________________________]

• Why it matters: [________________________________]
• Management response: [________________________________]
• Target date: [__/__/____]

1.5 Positive Practices Observed

[____________________________________________________________]

2. Background and Context

2.1 Process Overview

[Describe the audited activity, responsible functions, systems, transaction volume, locations, and material changes during the audit period.]

[____________________________________________________________]

2.2 Reason for the Engagement

☐ Approved risk-based audit plan

☐ Board or audit committee request

☐ Management request

☐ Regulatory or contractual commitment

☐ Follow-up engagement

☐ Incident or emerging risk

☐ Other: [________________________________]

2.3 Relevant Criteria

List only criteria actually used to evaluate the activity.

3. Objectives, Scope, and Approach

3.1 Objectives

1. [____________________________________________________________]
2. [____________________________________________________________]
3. [____________________________________________________________]

3.2 Scope

Included processes, entities, systems, and locations:

[____________________________________________________________]

Period tested: [__/__/____] through [__/__/____]

Population: [________________________________]

Sample selected: [________________________________]

3.3 Exclusions and Scope Limitations

☐ No material scope limitation

☐ Scope limitation identified:

• Limitation: [________________________________]
• Reason: [________________________________]
• Effect on procedures or conclusion: [________________________________]
• Escalated to: [________________________________]
• Date escalated: [__/__/____]

3.4 Procedures Performed

☐ Process walkthroughs

☐ Interviews or inquiry

☐ Document inspection

☐ Control design assessment

☐ Control operating-effectiveness testing

☐ Transaction or substantive testing

☐ Data analytics

☐ System-configuration review

☐ Physical observation

☐ Third-party confirmation

☐ Other: [________________________________]

3.5 Standards and Methodology Statement

Select one and explain any qualification.

☐ The engagement was performed in conformance with the organization's approved internal audit methodology and the Global Internal Audit Standards.

☐ The Global Internal Audit Standards informed the engagement, but this report does not assert full conformance.

☐ Other standards or methodology applied: [________________________________]

Known departures and their effect: [________________________________]

4. Rating Methodology

The organization should use its approved rating definitions. Do not imply that the following labels are required by the Global Internal Audit Standards.

5. Detailed Findings

Repeat this section for each finding.

Finding [____]: [TITLE]

Observation:

[____________________________________________________________]

Recommendation or agreed outcome:

[____________________________________________________________]

Management response:

☐ Agreed ☐ Partially agreed ☐ Not agreed ☐ Risk accepted subject to approval

[____________________________________________________________]

Action plan:

Residual-risk or disagreement escalation:

[____________________________________________________________]

Required approver for risk acceptance: [________________________________]

Approval date: [__/__/____]

6. Management Action Plan Summary

7. Follow-Up and Monitoring

Follow-up owner: [________________________________]

Reporting cadence: [________________________________]

First follow-up date: [__/__/____]

Validation approach:

☐ Document review

☐ Retesting

☐ Data analysis

☐ Management certification

☐ Separate follow-up engagement

☐ Other: [________________________________]

Closure criteria: [________________________________]

Overdue-action escalation path: [________________________________]

8. Distribution and Records

8.1 Authorized Distribution

Restrictions on use or redistribution: [________________________________]

8.2 Sensitive Information Review

☐ Personal information minimized or redacted

☐ Security-sensitive details limited to need-to-know recipients

☐ Trade secrets and confidential business information classified appropriately

☐ Allegations and investigation materials reviewed with counsel or the responsible investigations function

☐ Privilege label used only if authorized by counsel

8.3 Workpaper and Report Retention

Applicable retention policy: [________________________________]

Retention period: [________________________________]

Legal hold checked: ☐ Yes ☐ No ☐ Not applicable

System of record: [________________________________]

9. Conditional Legal and Regulatory Overlays

Complete only after counsel or compliance confirms applicability.

9.1 SEC Reporting Company

☐ Confirm whether the audited organization is subject to Exchange Act Rule 13a-15.

☐ If in scope, distinguish internal audit testing from management's required evaluations of disclosure controls and procedures and internal control over financial reporting.

☐ Route potential material control issues through the organization's disclosure, certification, and escalation procedures.

9.2 Listed Issuer Audit Committee

☐ Confirm the applicable exchange listing standards, audit committee charter, and Rule 10A-3 requirements.

☐ Confirm that the report's recipient, escalation route, and access restrictions are consistent with the audit committee's authority and responsibilities.

9.3 External Auditor Independence

☐ If a registered public accounting firm audits an issuer's financial statements, assess whether any proposed internal-audit outsourcing service is prohibited by 15 U.S.C. § 78j-1(g).

☐ Obtain audit committee, legal, and independence review before engaging the external auditor or an affiliate for additional services.

9.4 Other Regulated Entities

☐ Identify industry-specific reporting, escalation, examination, retention, and notification duties.

☐ Record each current official source in Section 2.3 before making a legal-compliance conclusion.

10. Quality Review and Finalization

☐ Objectives and scope are stated clearly.

☐ Findings are supported by sufficient, reliable, relevant, and useful evidence.

☐ Each finding links condition, criterion, cause, effect or risk, and action.

☐ Factual accuracy was checked with responsible management.

☐ Management responses and target dates are included or the absence is explained.

☐ Scope limitations and their effect are disclosed.

☐ Ratings follow the approved methodology.

☐ Legal and regulatory citations were checked against current official sources.

☐ Sensitive information and distribution restrictions were reviewed.

☐ Supervisory and chief audit executive review is documented.

11. Approval and Acknowledgment

Approval indicates authorization to issue the report. Management acknowledgment records receipt and does not convert the report into a contract.

Appendices

• Appendix A: Detailed testing schedule
• Appendix B: Evidence index
• Appendix C: Process map or control matrix
• Appendix D: Rating methodology
• Appendix E: Management action plan
• Appendix F: Distribution list

Sources and References

• The Institute of Internal Auditors, 2024 Global Internal Audit Standards: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
• GovInfo, 15 U.S.C. § 78j-1: https://www.govinfo.gov/app/details/USCODE-2024-title15/USCODE-2024-title15-chap2B-sec78j-1
• eCFR, 17 C.F.R. § 240.10A-3: https://www.ecfr.gov/current/title-17/part-240/section-240.10A-3
• eCFR, 17 C.F.R. § 240.13a-15: https://www.ecfr.gov/current/title-17/part-240/section-240.13a-15