What an internal audit report should give management
Management or the audit committee needs the opinion, the findings that matter, and which actions are still open. They do not need the work papers pasted into a slide.
A report that is rebuilt from three files will be out of date on the day it is printed. The useful report is a view of the same records the team is already working from.
What to include
- The engagement, the scope, and the opinion.
- Significant findings, each with the agreed action, the owner, and the date.
- Risks management has accepted, stated as such.
- Actions from earlier reports that are overdue.
- Plan progress for the year: done, in progress, deferred.
What to leave in the file
Sample sizes, exception lists, and review notes belong in the work papers. The report points at them. It does not copy them. A finding that was never agreed does not belong in the pack. See what an internal audit finding is before it is raised.
One pack, two readers
The same leadership pack serves management and, where you have one, the audit committee. Do not keep a second version for the committee. If the numbers differ, one of them is wrong.
In Scrutive that pack is printed from the live records. In Excel it is copied into a document the night before the meeting.