Standard 15.1 of the IIA Global Internal Audit Standards lists what a final engagement communication must contain. It is a short list, and a report that satisfies it is easy to review. This post sets out the required elements, the quality attributes the standards add, and a skeleton you can adapt.
Required elements
Every final communication must include the engagement's objectives, scope, recommendations or action plans if applicable, and conclusions. A final communication for an assurance engagement must also include:
- The findings, with their significance and prioritization.
- An explanation of scope limitations, if any.
- A conclusion on the effectiveness of the governance, risk management and control processes of the activity reviewed.
Further requirements apply to every report:
- It must specify the individuals responsible for addressing the findings and the planned date by which actions should be completed.
- If management started or completed actions before the report was issued, those actions must be acknowledged.
- The chief audit executive must review and approve the report before it is issued, and must disseminate it to parties who can ensure the results are given due consideration.
- If the engagement was not conducted in conformance with the Standards, the report must disclose which standards were not met, why, and the effect on the findings and conclusions.
Quality attributes
Standard 15.1 requires the final communication to be accurate, objective, clear, concise, constructive, complete and timely, as described in Standard 11.2, which requires the chief audit executive to establish methodologies that promote those attributes. The implementation text of Standard 12.3 is useful for the reviewer: the engagement supervisor reviews communications and workpapers for those attributes because the workpapers are the primary support for the communication, and review notes are cleared once evidence is supplied or workpapers are amended, or a separate record of review notes and their resolution may be kept.
A one-page skeleton
- Header. Engagement name, period covered, report date, distribution list.
- Objectives and scope. Two short paragraphs taken from the approved scope memo (see /us/blog/engagement-risk-assessment-and-scoping-standards-13-2-and-13-3). State exclusions and any scope limitation and how it was handled.
- Conclusion. One paragraph stating whether controls over the activity are effective, effective with exceptions, or not effective, and why. Acknowledge what worked.
- Findings table. Rating, one-line title, criteria, condition, cause, effect, recommendation, owner, due date. Rank by significance.
- Actions already taken. The items management fixed during fieldwork.
- Nonconformance disclosure. Present only if needed.
Worked example
In this hypothetical, an engagement on payroll controls at a 600-employee company reaches these results: 2 high findings (no independent review of master file changes; terminated employees paid after separation in four cases), 3 medium findings, 4 low findings. The conclusion reads: "Controls over payroll processing and tax deposits are effective. Controls over employee master file changes and terminations are not effective for the period reviewed." The report names the director of human resources as owner of the termination finding with a completion date of the end of the next quarter, and the controller as owner of the master file review. It acknowledges that human resources already began sending terminations to payroll through a ticket workflow before the report was issued.
Notice what the report does not do. It does not hide the two high findings in an appendix, and it does not give a single "satisfactory" rating that blends effective and ineffective areas. Standard 14.5 says the conclusion must reflect the overall significance of the aggregated findings, and Standard 15.1 requires a conclusion on effectiveness, so a split conclusion is the honest one.
Scope limitations and nonconformance
A report that leaves out a scope limitation fails the standard. If access to the payroll register for one subsidiary was denied, the report says so, states the effect on the conclusion, and records that the chief audit executive escalated it. Likewise, if a work program step was dropped for lack of time and the engagement was therefore not conducted in conformance with the Standards (for example 13.6 or 14.6), Standard 15.1 requires the report to disclose it.
Distribution and sensitive findings
Standard 11.3 requires the chief audit executive to review and approve final communications and to decide to whom and how they are disseminated, and to seek the advice of legal counsel or senior management as required before releasing communications outside the organization, unless laws or regulations say otherwise. Findings involving suspected fraud or personnel matters often need a restricted distribution list. Document the decision.
Writing the conclusion paragraph
The conclusion is the part boards read first, so draft it before the findings table. A workable pattern has three sentences. The first states the overall judgment on the control processes for the activity and period. The second names the areas where controls are effective, which Standard 14.5 requires the conclusion to acknowledge. The third names the areas where they are not and points to the high-rated findings. If the engagement had advisory components, say which parts were assurance and which were advice, because the standards treat stakeholder expectations differently for each and the report should not blur them.
For the same payroll engagement, a poor conclusion reads "Payroll controls were generally satisfactory with some opportunities for improvement." It hides two high findings behind a blended word. The better version names termination and master file controls as not effective for the period and says why that matters: pay after separation and unreviewed rate changes both create direct loss exposure. The reader should be able to decide what to do from that paragraph alone.
Reviewer checklist
- Does every finding have criteria, condition, cause, effect, owner and date?
- Is the conclusion on effectiveness stated, and does it match the findings?
- Are scope limitations and early management actions disclosed?
- Has the chief audit executive's approval been documented before issue?
- Can each statement be traced to a workpaper?
Follow-through on the dates in the report is covered in /us/blog/internal-audit-follow-up-and-action-plan-tracking-standard-15-2.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- The IIA, Global Internal Audit Standards (2024), Standards 11.2, 11.3, 12.3, 13.6, 14.5, 14.6, 15.1: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error