Audit Reporting, Communication of Results and Follow-Up
The report
Candidates must know the structure of an audit report: objectives, scope, approach, criteria, findings (condition, criteria, cause, effect), conclusions, recommendations and management responses. Findings must be supported by evidence and rated by significance. The report is addressed to management and the head of the organisation, with distribution defined by the charter and law. Communication is a process, not an event: it includes engagement-level communication, progress updates, and the final report.
Follow-up
Follow-up verifies whether management has implemented agreed actions within the agreed timeframe. The internal audit function monitors implementation, escalates unresolved high-risk findings, and reports the status to the head of the organisation and the audit committee. Management owns the corrective action; internal audit does not implement it.
Traps
A common trap: the auditor prescribing the solution rather than recommending an outcome - the recommendation should state what must be achieved, leaving management to decide how. Another: closing a finding without evidence of implementation, or accepting a management response as implementation. Questions may also test that the report must be balanced (acknowledging strengths) and that disagreement with management is disclosed rather than suppressed.
Rule of thumb
Every finding needs four elements: condition, criteria, cause and effect. Every recommendation needs an owner and a deadline. Follow-up needs evidence, not assurances.
Worked example
A finding states that 12 of 30 contracts lacked documented competition (condition), contrary to procurement rules (criteria), because the checklist was not used (cause), increasing the risk of overpayment (effect). Management commits to a checklist with a deadline; follow-up verifies use through file testing.