CORAA University · Free tool

Internal audit observation report generator

Draft the report pack auditors actually need: executive summary, condition-criteria-cause-effect-recommendation observations, audit committee summary, management response tracker and ATR-ready Excel workbook.

Open report pack guide

Report profile

EntityReview periodAssignment / scopePrepared byReport date

High

Medium

Low

Open

Observation drafting table

Condition	Criteria	Cause	Effect	Recommendation
Duplicate-invoice exception report is not reviewed before payment release.	Payment controls should detect duplicate vendor, invoice number, date and amount combinations before approval.	The AP team reviews invoices manually and the ERP duplicate check is not configured for vendor-bank and amount/date combinations.	Duplicate or unsupported vendor payments may remain undetected until vendor reconciliation or recovery.	Configure a weekly duplicate-invoice exception report and require AP lead review before payment run approval.
Manual journals posted after close date do not consistently carry independent review evidence.	Manual journals should include support, preparer identity, independent reviewer sign-off and posting rationale.	Close checklist requires journal review but does not block posting when support is incomplete.	Unsupported late journals can affect period-close accuracy and create management override exposure.	Add a close-control gate for late journals and report unsupported postings to the controller before books are locked.
Separated users remained active in finance applications beyond the exit date.	Application access should be removed on or before the employee exit date unless a documented exception is approved.	HR exit data is not reconciled to application user listings on a fixed cadence.	Unauthorised post-exit access to financial systems may permit data change, approval misuse or report extraction.	Run a weekly HR leaver-to-access match and require IT to retain closure evidence for each removed user.

Start from the RCM builder, validate recurring issues through monitoring rules, then move agreed actions to the ATR tracker.

How it works

An internal audit observation should separate condition, criteria, cause, effect and recommendation. Keeping those fields separate prevents vague findings and makes management response, ownership and follow-up easier to track.

This generator turns observations into a report pack rather than a single note. The Excel export includes cover, executive summary, observation register, audit committee summary and management response / ATR sheets.

Worked example

A quarterly internal audit identifies one high-risk journal review gap, one medium-risk P2P duplicate-invoice gap and one high-risk ITGC leaver-access gap.

Inputs

Observations3

High-risk items2

Output

PDFDraft report summary

ExcelFive-sheet report and ATR pack

Common mistakes

Weak observation wording

Do not combine condition, cause and recommendation into one paragraph. Separate them so the finding can be reviewed and defended.

No evidence reference

Every report observation should trace back to an RCM test, source report, sample or monitoring exception.

No management owner

A finding without owner, due date and response is not ready for action tracking.

Frequently asked questions

What is the best format for an internal audit observation?+

A practical observation format separates condition, criteria, cause, effect, recommendation, risk rating, management response, owner and target date.

Can this be used as an internal audit report template?+

Yes, as a drafting pack. The exported workbook includes a report summary and observation register, but the final report should be reviewed against evidence and the approved reporting format.

Should all exceptions become report observations?+

No. Only validated exceptions with evidence, root-cause analysis and risk impact should become report observations.

Authoritative sources

ICAI

ICAI IASB - Compendium of Standards on Internal Audit — The SIA framework covers internal audit documentation, reporting, communication and follow-up expectations.

MCA

Companies (Accounts) Rules, 2014 - Rule 13 — Rule 13 requires the Audit Committee or Board to formulate the scope, functioning, periodicity and methodology of internal audit.

Always confirm against the latest version of the source. Regulations evolve and amendments are common.

Related calculators

Internal audit report pack →Internal audit ATR tracker →Internal audit control repository →

Share this tool

Last reviewed: 2026-08-29 · For informational purposes only — not professional advice.