Connect Support Advance

Internal Audit Report Types

What is Internal Audit? › Internal audit planning.

Internal audit is: › Provision of a range of internal audit services
encompassing assurance / consulting / management
An independent, objective assurance and consulting
requested services.
activity designed to add value and improve an
organisation’s operations. It helps an organisation › Internal audit quality assurance and improvement
accomplish its objectives by bringing a systematic, program
disciplined approach to evaluate and improve the
› Monitoring and follow-up of timely audit action
effectiveness of risk management, control and governance
implementation.
processes.
› Secretariat service to the audit committee.
For further information on Internal Audit, refer the IIA-Australia
Factsheet ‘Internal Auditing’ (2022a). › Internal audit strategy to improve internal audit function
capability.
The key reference document for internal audit practice is
the ‘International Professional Practices Framework’ (IPPF) Internal audit reporting is the mechanism by which the CAE
published by the Internal Audit Foundation (The Institute of provides assurance to senior management and the audit
Internal Auditors, Inc., 2017). committee these management obligations are being fulfilled
and the organisation is receiving appropriate internal audit
What is Internal Audit Reporting? services that result in improvements to risk management,
control and governance processes.
The ‘International Standards for the Professional Practice
of Internal Auditing’ (Internal Audit Standards) (International
Why is Internal Audit Reporting Important?
Internal Auditing Standards Board, 2016) assign responsibility
for the quality of internal audit reporting to the chief audit Organisations make significant investment in internal audit, so
executive1 (CAE): the CAE needs to prepare an evidence-based plan to justify
that investment – refer Internal Audit Standard 2010 ‘Planning’.
Internal Audit Standard 2440 ‘Disseminating Results’
Budgets and resourcing should be derived from an internal
The chief audit executive must communicate results to the
audit strategy that directly relates to the organisation’s
appropriate parties.
strategic objectives – refer Internal Audit Standard 2030
Interpretation: ‘Resource Management’.
The chief audit executive is responsible for reviewing and
If a CAE does not have a clear and defensible internal audit
approving the final engagement communication before
strategy, the question needs to be asked how the internal
issuance and for deciding to whom and how it will be
audit budget is formulated.
disseminated. When the chief audit executive delegates
these duties, he or she retains overall responsibility. The audit committee must ensure there is appropriate
oversight of internal audit delivery and accountability for use
The CAE is allocated budget and resources to provide an
of resources. Internal audit reporting directly supports this.
internal audit service to the organisation. The service should
be aligned to the organisation’s strategic objectives. The CAE
What are Internal Audit Reporting Types?
is generally expected to manage:
Given the CAE is the primary Line 3 assurance resource, and
› Budget and other resources:
often the only independent assurance activity, there should be
› Internal audit staff. robust internal audit reporting:
› Internal audit service providers. › Internal audit engagement reports.
› Vendor support – audit management system / data › Internal audit quarterly reports.
analytics software.
› Internal audit annual report.

1 The term chief audit executive describes the role of a person in a senior position responsible for effectively managing the internal audit activity in accordance with
the internal audit charter and the mandatory elements of the ‘International Professional Practices Framework’. The chief audit executive or others reporting to the
chief audit executive will have appropriate professional certifications and qualifications. The specific job title and/or responsibilities of the chief audit executive may
vary across organisations.

For more information, please call +61 2 9267 9155 or visit www.iia.org.au
© 2024 - The Institute of Internal Auditors - Australia
 Connect Support Advance
Internal Audit Report Type Description Target Audience Suggested Frequency

Internal audit engagement Results of each internal audit › Senior management audit › At completion of
reports engagement: sponsor each internal audit
engagement
› Assurance › Chief executive officer
› Consulting › Audit committee
› Management requested
services
Internal audit quarterly › Progress against internal › Audit committee › Quarterly aligning with
reports audit plan audit committee meetings
› Issues and insights
› Audit action
implementation
Internal audit annual report › Progress against internal › Audit committee › Annual
audit plan
› Chief executive officer
› Wraps up and showcases
› Senior management
the internal audit story for
the year
› Audit action
implementation

Internal audit reports should use as few words as possible, audit was ‘conducted in accordance with the International
with audit-style terms and jargon removed. They are key Standards for the Professional Practice of Internal
advice and accountability documents within the organisation Auditing’.
and, regardless of the way in which they are produced, they
› The actual cost of the engagement is sometimes included
belong to the organisation and are the responsibility of the
to show how well the audit budget was spent.
CAE.
Benefits include:
Internal Audit Engagement Reports
› A value-adding and improvement focused internal audit
Contains such things as: report.
› A format that invites the reader to read the report. › A comprehensive report format and not just a list of
exceptions discovered by the audit.
› Outcomes of the internal audit engagement conducted.
Note that internal audit engagement reports may vary in style
› A report dashboard that tells the story of the audit in one
and content for:
page.
› Assurance engagements.
› A focusing question – ‘Why did we do this audit?’
› Consulting engagements.
› The value proposition from the audit to show what value
was added. › Management requested services.
› A rated overall conclusion or opinion.
Internal Audit Quarterly Reports
› A clear conclusion for each audit objective.
Contains such things as:
› Observation risk ratings aligned to the organisation risk
› Progress of internal audit plan execution.
framework.
› Audit action implementation progress summary,
› A maturity assessment for the topic audited.
especially overdue audit actions.
› The audit criteria clearly stated and includes a detailed
› For the audit committee meeting before the new financial
assessment against the criteria components.
year, the proposed internal audit plan.
› Tabular formats, especially for detailed observations and
Benefits include:
agreed actions.
› Shows accountability for the budget allocated to the CAE.
› Tables, graphs, diagrams and photographs.
› Reports whether internal audit plan execution is in line
› A table of contents, and a glossary of terms and
with the schedule.
acronyms.
› Provides a snapshot of audit action implementation,
› Positive commentary on satisfactory performance and
especially overdue actions.
what is being done well.
› A statement of assurance that includes a declaration the

For more information, please call +61 2 9267 9155 or visit www.iia.org.au
© 2024 - The Institute of Internal Auditors - Australia
 Connect Support Advance
Internal Audit Annual Report Useful References
Contains such things as: International Internal Auditing Standards Board, 2016.
International Standards for the Professional Practice of Internal
› Performance against internal audit strategy.
Auditing. [Online]
› Internal audit structure and reporting. Available at: https://www.theiia.org/en/standards/what-are-the-
standards/mandatory-guidance/standards/
› Resourcing summary and forward budget.
The Institute of Internal Auditors - Australia, 2022a. Factsheet:
› Achievements.
Internal Auditing. [Online]
› How internal audit added value including significant Available at: https://iia.org.au/technical-resources/fact-sheet/
systemic issues and trends. iia-australia-factsheet-internal-auditing
› Internal audit scorecard / performance measures (KPIs). The Institute of Internal Auditors - Australia, 2022b. The 20
Critical Questions Series: What Directors should ask about
› Results of internal audit activities including internal audit
Internal Audit. [Online]
plan delivery summary.
Available at: https://iia.org.au/technical-resources/20-critical-
› Number and type of management requested services questions/what-directors-should-ask-about-internal-audit
provided.
The Institute of Internal Auditors, Inc., 2017. International
› Audit action implementation progress summary, Professional Practices Framework. Lake Mary, FL, USA:
especially overdue audit actions. Internal Audit Foundation.
› CAE statement of assurance including opinion on the
state of internal controls.
› CAE attestation on independence and conformance to
internal audit standards.
› Internal audit maturity assessment.
› Risks and challenges.
› Internal audit work plan – high-level forward work plan of
internal audit initiatives going forward (different from the
internal audit plan of engagements and services).
Benefits include:
› Reports progress against the internal audit strategy.
› Wraps up and showcases the internal audit story for the
year.
› Shows accountability for the budget allocated to the CAE
and whether expenditure was in line with forecasts at
year-end.
› Provides informative data on the state of control within
the organisation.
› Provides a snapshot of audit action implementation,
especially overdue actions.

Conclusion
The CAE has responsibility to ensure the internal audit budget
and deployment of resources is designed to help achieve the
organisation’s strategic objectives.
The key question to be answered is:
How does management and the audit committee clearly
know internal audit is operating effectively and the internal
audit budget has been well-spent?

For more information, please call +61 2 9267 9155 or visit www.iia.org.au
© 2024 - The Institute of Internal Auditors - Australia