Practical guide · Stage: Message
Internal audit reporting to the Audit Committee: examples that support decisions
By Tim Buckley, Founder of Beyond the Lines™ ·
An effective internal audit report helps the Audit Committee understand what the evidence means, what remains uncertain and what needs attention. Connect each significant issue to its business consequence, management’s response, accountable ownership and the decision or challenge required. Make the limits of the assurance equally clear.
A committee can receive every finding and still struggle to see what matters. That is one place where the Assurance Impact Gap appears: completed assurance work has not yet translated into a useful management response or stronger oversight.
Start with the committee’s job
Before writing the executive summary, ask what members should understand or do differently after reading it. Possible purposes include challenging an unresolved exposure, seeking a more credible management response, approving an audit-plan change within their remit, or escalating a matter to the board.
Be precise about authority. Management normally owns operational corrective action. The committee oversees and challenges within its terms of reference. A request to “approve the action plan” can blur those responsibilities unless that approval actually belongs to the committee.
Keep the audit rating, but explain the judgement behind it. “Needs improvement” is a category. Members also need to know which business objective is exposed, how substantial the weakness is and whether the response addresses its cause.
Worked example: supplier bank-detail changes
Illustrative example only. The organisation, figures and responses below are fictional.
An audit selects 40 supplier bank-detail changes for review. Eight lack evidence of the required independent verification. Management agrees to issue a reminder, but an earlier reminder did not resolve the problem. The sample was judgemental, so the exception rate cannot be projected across every supplier change.
| Reporting element | Limited account | More useful account |
|---|---|---|
| Finding | Eight exceptions identified. | Independent verification was not evidenced for eight of 40 selected bank-detail changes. Distinguish missing records from confirmed non-performance. |
| Business implication | Fraud risk exists. | Payment instructions could be redirected without the intended challenge. The review has not established whether any fraudulent payment occurred. |
| Management response | A reminder will be issued. | Management should explain why another reminder would work and address the process or system conditions behind the recurrence. |
| Ownership | Finance to resolve. | The Finance Director owns the response, with a named operational lead and agreed milestones. |
| Committee attention | Note the report. | Challenge whether the response is credible and whether interim protection is sufficient while the weakness remains. |
| Follow-up | Action marked complete. | Review evidence that verification operates on subsequent changes and that exceptions reach the accountable manager. |
The stronger account gives members something specific to examine. It also prevents an unsupported leap from missing documentation to a conclusion that fraud has occurred.
A practical executive-summary example
Using that fictional case, the opening could read:
We cannot yet conclude that supplier bank-detail verification operates consistently in the area reviewed. Eight of 40 selected changes lacked verification evidence, following an earlier management reminder. Our judgemental sample does not establish the population-wide failure rate. The Finance Director owns the response. Management should explain how it will address recurrence and protect payments in the interim. We invite the Committee to challenge that response and request an update supported by evidence of operation.
Support this with the scope, period, evidence, unresolved facts and management’s position. If management disagrees with the conclusion, explain the substance of the disagreement and its implications.
Show movement between meetings
At the next meeting, report what has changed since the previous discussion. Has the proposed response been implemented? Is it operating? What evidence supports the updated conclusion? Which uncertainties remain?
Keep those questions separate. A completed training session shows that training happened. It does not, by itself, establish that supplier changes are now checked. Similarly, a falling overdue-action count may reflect revised deadlines or administrative closures. Explain the cause of movement before presenting it as progress. The guide on internal audit action closure evidence sets out what to examine before an action is treated as complete.
Link recurring issues where the evidence supports a shared cause. Three findings about unclear accountability may deserve one discussion about ownership. Avoid grouping them merely because they share similar wording.
Questions about Audit Committee reporting
Should every finding appear in the committee paper?
Use the agreed reporting arrangements and significance criteria. Summarise matters requiring oversight while keeping supporting detail accessible. Do not hide a significant issue simply to meet a page limit. Routine detail can sit in an appendix or linked report.
Should every paper ask for a decision?
No. Some papers provide assurance or enable oversight. State their purpose accurately. Where a decision, challenge or escalation is needed, name it and identify who has authority to act.
Can this replace our formal reporting requirements?
This is a practical communication approach. Apply it alongside your audit methodology, professional obligations, confidentiality requirements and committee terms of reference. A clear summary cannot compensate for weak evidence or missing required information.
Use the Assurance to Action Toolkit™ to work on the connection between audit insight, clearer messages, ownership and effective action.