There is no prescribed standard or quality expectation for internal audit reports, or a list of what is required to be contained in an audit report, apart from what the relevant 2400 series Standards say. So, reports can vary considerably in the way audit results are presented.
Adverse feedback from clients who receive audit reports includes:
- The report tells us what we already know.
- The report makes it sound worse than it is.
- There is no recognition of good work in the report; only negative by exception commentary.
- The report is too long and too wordy.
- The report does not give an overall conclusion or opinion; what am I to make of that?
The issue to be discussed is:
How can Internal Audit better report on the results of audits?
This White Paper from IIA Australia look into: Good practice internal audit reports