Internal Audit Report Format in Word — Observations, ATR & Management Response
INTERNAL AUDIT REPORT
Entity: {{client_name}}
Audit period: {{audit_period}}
Functional area / process:
Report addressed to: {{reporting_to}}
Date of report: 10 October 2026
1. Executive Summary
This report presents the results of the internal audit conducted in respect of the area of {{client_name}} for the period {{audit_period}}. The audit was performed in accordance with the Standards on Internal Audit (SIA) issued by the Institute of Chartered Accountants of India and the Internal Audit Charter approved by the Audit Committee.
Overall, the systems and controls in the audited area were found to be [Adequate / Adequate with exceptions / Requiring improvement]. The detailed findings, ranked by severity, are set out in Section 4 below. Management agreed to corrective actions for all findings raised; targeted closure dates appear against each.
2. Scope and Objectives
The internal audit scope covered the following:
- Review of the policies, procedures and controls applicable to the audited area
- Testing of the design and operating effectiveness of key controls during the audit period
- Verification of compliance with applicable laws, regulations, accounting standards and internal policies
- Identification of process inefficiencies, control gaps and risk exposures
- Recommendations for improvement and remediation
The scope did not include verification of the financial statements, which is the responsibility of the statutory auditor.
3. Methodology
The audit was carried out applying a risk-based approach. The methodology included:
- Walkthroughs of key processes with process owners
- Review of process documentation, policies and procedures
- Test of controls — design and operating effectiveness on a sample basis
- Substantive testing of transactions where indicated by control test results
- Data analytics on full populations where data was available
- Interviews with management and process operators
- Review of system access, segregation of duties and IT general controls supporting the process
Sample sizes and testing thresholds were determined considering the population size, risk assessment, and prior audit findings.
4. Findings and Observations
Findings are classified by severity as follows:
- High — Material control weakness requiring immediate corrective action
- Medium — Significant deficiency requiring action within 60 days
- Low — Process improvement opportunity
| # | Finding (with risk) | Severity | Recommendation | Management Response | Target Closure |
|---|
| 1 | [Brief description of finding and the risk it creates] | [H/M/L] | [Specific recommended action] | [Management agreed / partially agreed / disagreed with rationale] | [DD-MM-YYYY] |
| 2 | | | | | |
| 3 | | | | | |
| 4 | | | | | |
| 5 | | | | | |
5. Status of Previous Audit Findings
| # | Prior finding | Status | Auditor remarks |
|---|
| 1 | [Carry-over from previous internal audit report] | [Closed / In progress / Open] | |
| 2 | | | |
6. Auditor's Opinion
Based on the work performed and the findings set out above, in our opinion the systems and controls in the area of {{client_name}}, taken as a whole, [were operating effectively during the audit period / were operating effectively, subject to the matters reported above / were operating with significant weaknesses as reported above].
This report is intended solely for the use of the Audit Committee and management of {{client_name}} and should not be relied upon by any third party.
For {{firm_name}}
Chartered Accountants — Internal Auditors
Firm Registration No.:
_______________________________
{{engagement_partner}}
Partner / Engagement Lead
Membership No.: {{icai_membership_no}}
UDIN: ____________________
Place: ____________________
Date: 10 October 2026
