High
Trigger: Likely financial loss, compliance exposure, fraud pathway, management override or repeat failure.
Response: Immediate owner, agreed action date, escalation to senior management or audit committee.
Internal audit reporting breaks when observations, management responses and action tracking live in separate files. This pack keeps the issued report, observation format, ATR and follow-up tracker connected to the same RCM evidence trail.
Interactive report pack builder with PDF and Excel export.
Cover, executive summary, observation register, audit committee summary, management response and ATR-ready follow-up sheets.
Issued report for the engagement or quarter.
Executive summary, scope, methodology, work performed, observations by rating, recommendation, management response and conclusion.
Single-finding workpaper before report roll-up.
Condition, criteria, cause, effect, recommendation, risk rating, owner, management response and target date.
Management commitment and current action status.
Observation reference, committed action, owner, due date, revised date, status, closure evidence and auditor comment.
Later-period verification of whether action was actually implemented.
Original observation, original target date, current status, follow-up testing, repeat-observation flag and closure conclusion.
Excel/PDF tracker for observations and follow-up.
Interactive observation register with rating, owner, due date, status, closure evidence and summary counts.
Source link for report observations.
Every observation should trace back to a cycle, risk, control, test, result and evidence source.
Conclude the RCM test and evidence review.
Draft observation only for validated exceptions.
Write condition, criteria, cause, effect and recommendation separately.
Agree management response, owner and target date.
Roll observations into the internal audit report and audit committee summary.
Move open items into ATR and SIA 390 follow-up tracking.
Trigger: Likely financial loss, compliance exposure, fraud pathway, management override or repeat failure.
Response: Immediate owner, agreed action date, escalation to senior management or audit committee.
Trigger: Control gap that can cause process leakage, incorrect reporting, avoidable penalties or recurring inefficiency.
Response: Time-bound corrective action, process owner response and follow-up in the next cycle.
Trigger: Documentation weakness, minor process improvement or isolated exception without material impact.
Response: Management acknowledgement, target date where relevant and closure through documentary confirmation.
ICAI’s 2026 SIA framework separates communication, reporting and prior-issue follow-up. In practice, that means every observation should carry enough evidence to support the report, enough management response detail to create accountability, and enough follow-up detail to prove whether the action was closed later.
A complete report pack should include the issued report, observation sheets, management responses, an action taken report, closure evidence tracker and follow-up status for prior observations.
ATR records what management has agreed to do and its current status. Follow-up is the later internal-audit procedure that verifies whether the action was actually implemented with evidence.
No. Only validated exceptions with evidence, root-cause assessment and risk impact should become observations. False positives and approved exceptions should be cleared in the working paper.