A good internal audit report fits on a few pages. It says what was reviewed, what was found, how serious it is, what management will do and by when. Below is a short sample for a procure-to-pay review. The company, figures and findings are invented. They show the writing, not any real organisation.
Last reviewed: 17 October 2026. Facts checked. This post shows a writing style and does not rely on a statute or a published standard. We did not open the ICAI Standards on Internal Audit or any regulator's format. There is no single prescribed report format in the sources we reviewed on our own site. Adapt to your engagement letter and audit committee preferences. All names and numbers are fictional.
For the full format, rating matrix and action taken report, see internal audit report format in India. For the review programme behind this sample, see our P2P checklist.
Sample report: Procure to Pay review, Sample Components Ltd
Period reviewed: 1 April 2025 to 31 March 2026
Report date: [date]
Prepared for: Audit Committee
Overall rating: Needs improvement
1. Summary
We reviewed how the company buys goods and services and pays suppliers. The core approvals work. We found three matters needing management action: purchase orders raised after the invoice date, supplier bank detail changes without independent checking, and duplicate invoice payments. One payment of ₹1.8 lakh was made twice and has been recovered. We recommend management act on the two higher-rated findings first.
Why it reads this way: the audit committee should know the answer in the first paragraph, including what works.
2. Scope and approach
- In scope: purchase requisitions, purchase orders, goods receipt, invoice matching, supplier master changes and payments.
- Out of scope: capital purchases, which are covered in the fixed assets review.
- Approach: walkthroughs with purchasing and accounts payable; testing of 60 purchase orders selected across the year; analysis of all payments for duplicates; review of 25 supplier master changes.
Why it reads this way: the reader needs to know what the work covered and did not, so they do not assume more assurance than exists.
3. Findings
Finding 1: Purchase orders raised after the invoice (High)
What we found: Of 60 purchase orders tested, 14 were dated after the supplier's invoice. All were approved at the correct level, but the approval came after the goods had been received.
What should happen: The company's purchase policy requires approval before commitment.
Why it matters: Prices were not agreed in advance, and approvals after the event weaken control over spending.
Why it happened: The plant team told us urgent purchases are raised verbally and regularised later. There is no emergency purchase route.
Recommendation: Introduce a documented emergency purchase procedure with a retrospective approval limit and a monthly report of exceptions to the finance head.
Management response: Agreed. Emergency purchase procedure to be issued by the finance head by [date]. Monthly exception report from the following month.
Finding 2: Supplier bank details changed without independent confirmation (High)
What we found: 25 supplier master changes were reviewed. In 9 cases, the bank account change was entered on an emailed request, with no call-back to a known contact and no second person checking.
What should happen: A bank detail change should be confirmed through an independent channel and reviewed by a second person before payment.
Why it matters: This is a common route for payment fraud. No loss was identified in our testing.
Recommendation: Add a call-back check to a known contact, a second-person review and a system report of bank changes before each payment run.
Management response: Agreed. To be implemented by [date], owned by the accounts payable manager.
Finding 3: Duplicate invoice payment (Medium)
What we found: Analysis of all payments found two invoices from the same supplier with the same amount and reference, differing only by a trailing space. Both were paid, a total of ₹1.8 lakh in duplicate. The supplier refunded the excess during our fieldwork.
Recommendation: Add a duplicate check on supplier, invoice number and amount, ignoring spaces and case, before posting.
Management response: Agreed. Change request raised with the system team.
Why the findings read this way: each states the fact, the expected position, the consequence, the cause and a specific action with an owner. Compare with the structure in our format guide.
4. Matters that worked well
- Three-way match between purchase order, goods receipt and invoice was operating in the sample tested.
- Payment approvals followed the delegation of authority.
- The vendor master was reviewed for inactive suppliers twice during the year.
Why include this: balance builds trust and helps the audit committee see where not to spend effort.
5. Rating key
- High: could cause a material loss or breach, or a control is not operating.
- Medium: a control gap with limited exposure or a compensating check.
- Low: a housekeeping improvement.
6. Action tracker
| No. | Finding | Rating | Owner | Due | Status |
|---|---|---|---|---|---|
| 1 | Purchase orders after invoice | High | Finance head | [date] | Open |
| 2 | Bank detail changes | High | AP manager | [date] | Open |
| 3 | Duplicate payments | Medium | Systems manager | [date] | Open |
What makes a sample like this work
- Short sentences, plain terms. Avoid jargon the committee would need to decode.
- Numbers that tie. 14 of 60 is clearer than "several".
- Facts before opinions. Give the evidence, then the rating.
- Specific recommendations. "Add a call-back check" beats "strengthen controls".
- Named owner and date. An action without an owner will not close.
- No blame. Describe the process gap, not the person.
What to avoid
- Reporting every small exception. Group low items in an appendix.
- Burying the conclusion on page six.
- Adding recommendations the audit did not support with evidence.
- Letting management edit a rating without a reasoned discussion. See our guide on audit committee questions for how committees challenge reports.
Frequently asked questions
What should an internal audit report include?
A summary, scope, findings with evidence and recommendations, management responses, ratings and an action tracker.
Is there a prescribed internal audit report format?
We did not find a single prescribed format in the sources we reviewed. Use the format agreed in the engagement letter and with the audit committee.
How long should an internal audit report be?
As short as the findings allow. Many reports for a single process fit in a few pages plus an appendix.
Should the report include good news?
Yes. Say what works, so the reader knows where assurance exists.
Who gets the report?
Usually the audit committee and the process owners, as the audit charter says.
Last reviewed: 17 October 2026. Facts checked. Opened: our own site posts on report format and checklists. Could not open: ICAI Standards on Internal Audit or any regulator's report format. The example is invented.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error