After three weeks in the stores department, an internal auditor writes a forty-page report that lists every finding in the same tone and buries the one serious weakness on page 31. The managing director reads the first page, sees nothing alarming and puts it aside. A report is only as useful as its structure.
This topic shows how an internal audit report should be set out, who regulates internal auditors, what ethics bind them, and when a company should outsource the whole function to an outside firm.
The previous topics covered what internal audit is and what it does. This topic completes the internal audit group before audit planning begins.
In 30 seconds
Report: a private report to management; no legal form; title, addressee, author, date and status, then executive summary, main text and appendices. Regulation: none by law; ISAs are guidance only; membership of a body is not compulsory. Ethics: members of ICAN are bound by the Code; independence comes from reporting to the audit committee, no non-audit tasks, unrestricted access and top-level support.
Outsourcing: cheaper and quicker for small entities, with specialist skills; risks are changing staff, cost, confidentiality, control and conflicts of interest.
Key terms in plain English
| Term | What it means |
|---|---|
| Private report | A report to management, not published |
| Executive summary | A short summary of purpose, findings and recommendations |
| Appendix | Supporting detail attached to a report |
| Outsourcing | Giving work to an outside firm |
| Institute of Internal Auditors | The global body for internal auditors |
| Unrestricted access | Right to see any records and people needed |
Syllabus check
This topic is in syllabus area A, introduction to assurance, legal and regulatory frameworks, and audit process (20% of marks). It covers:
- the role of the internal audit department in maintaining an effective internal control system
- the comparison of internal and external audit
- the ethical issues for internal auditors
CAMA 2020 and internal audit reporting
The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.
| Section | What it says | Link to this topic |
|---|---|---|
| s. 404(7)(c) | The audit committee reviews findings on management matters with the external auditor and departmental responses | Where internal audit findings are discussed |
| s. 404(7)(f) | The committee authorises the internal auditor to carry out investigations | The reporting line to the committee |
| s. 404(7)(e) | The committee recommends the appointment, removal and fees of the external auditor | Relevant when internal audit is outsourced to the external auditor |
The rules in more depth
The status of internal audit reports
Internal auditors are employees who work for management, so they report their findings to management. Reports of this kind are sometimes called private reports. No law or formal rule governs their form, so a report may take any appropriate form and should be written like any other internal business report. This differs from the external auditor's report, which is a public document governed by law and standards.
The structure of the report
| Part | Contents |
|---|---|
| Introductory items | Title; the person or group addressed; the person or department that prepared it; date; and possibly status such as "Confidential" |
| Executive summary | The purpose of the report and of the audit, how the audit was done, the main findings, the conclusions and the recommendations. A busy reader should understand the main content from it, and a reader of the full report gets a structured context for the detail. |
| Main text | Longer than the summary but structured in the same order of findings and conclusions. It avoids excessive detail. |
| Appendices | Supporting detail and analysis for readers who want it. Vital information must also be in the main text and the summary. |
Good practice is also to rank findings by risk, say what the evidence is, say who should act and by when, and include management's response. A short report that puts the serious point first is more likely to lead to action than a long one that treats every point alike.
Regulation of internal audit
No specific law regulates the internal audit process. Management controls internal audit as it controls any other department. International Standards on Auditing do not bind internal auditors, but they show good practice and many departments adopt them. Internal auditors need not belong to a body such as the Institute of Chartered Accountants of Nigeria (ICAN).
Management usually looks for qualified accountants or expects recruits to become student members of a professional body. The Institute of Internal Auditors (IIA) is a global body to which internal auditors may belong, though membership is not compulsory.
Ethics of internal audit
Every ICAN member is bound by its ethical rules, so objectivity and confidentiality matter as much to an ICAN member who is an internal auditor as to an external auditor. The International Federation of Accountants guidance is similar. Because an internal auditor is usually an employee, there is a risk to objectivity and independence.
To work well, internal auditors need a degree of independence within the organisation, which can be achieved by:
- making the department responsible to senior managers without financial responsibilities, for example reporting directly to the audit committee, or reporting to a senior executive such as the finance director while also reporting periodically to the audit committee;
- keeping internal auditors out of non-audit tasks, so that they are audit specialists;
- giving them unrestricted access to the information they need; and
- making sure the department has the support of management at all levels.
Outsourcing internal audit
Outsourcing means giving work that the entity's own employees did to an outside body. Internal audit is usually given to the entity's external audit firm or to another firm of accountants. The reasons are that a permanent function can be very costly, and a smaller company may need internal audit but not full-time.
Benefits:
- Staff: no need to recruit and train internal auditors, and a function is available at once.
- Skills: the firm has specialists, such as computer audit experts, who are hard to recruit as full-time staff.
- Cost and flexibility: a variable cost, paid for only when used.
- Economy for small entities: there is not enough work to justify a full-time team.
Problems:
- Changing personnel: staff may change often, with a lack of continuity and understanding of the business.
- Cost: firms charge high fees.
- Confidentiality: the risk of a leak may be higher than with employees.
- Control: the entity has less control over outsourced work.
- Conflict of interest: if the work is given to the external auditors, independence and objectivity of the external audit may be affected, and the ethical rules on non-assurance services apply, including the rule that the client keeps responsibility for the internal audit activities and the audit committee approves the scope.
Choosing between an in-house and an outsourced function
| Factor | Favours in-house | Favours outsourcing |
|---|---|---|
| Size of workload | Large and continuous | Small or irregular |
| Specialist skills | General business skills | IT or other specialist skills needed |
| Knowledge of the business | Deep, built up over years | Less, unless the same team stays |
| Independence | Lower, since employees | Higher if the firm is not the external auditor |
| Cost | Fixed | Variable |
Worked examples
Example 1: the executive summary. A report on the stores finds that stock records are ₦25 million different from the physical count, but the finding is on page 31.
- The executive summary should state this serious finding and the recommendation.
- The detail stays in the main text and the appendix.
Example 2: independence. The internal audit department reports to the finance director and is also asked to prepare the monthly management accounts.
- Preparing accounts is a non-audit task that threatens objectivity.
- Remove it, and have the department report periodically to the audit committee.
Example 3: outsourcing. A company with 30 staff wants some internal audit work, about 20 days a year.
- The work is too small for a full-time employee, so outsourcing is economical.
- If the external auditor is chosen, the ethical rules on internal audit services for an audit client apply.
Example 4: the reader of the report. The audit report on a branch is addressed to the branch manager.
- The report should go to the person with the power to act, normally the head of the department and the audit committee.
- If it goes only to the manager whose area is criticised, the findings may never be acted on.
How to score full marks
- Set out the four parts of the report and the purpose of each.
- Say no law regulates internal audit, then give the four ways to protect independence.
- For outsourcing give benefits and problems in separate lists.
- Link outsourcing to the external auditor with the independence rules.
Common mistakes in the exam
- Saying ISAs are compulsory for internal auditors.
- Saying internal auditors must belong to ICAN.
- Putting vital findings only in the appendices.
- Ignoring the ethical issue when outsourcing to the external auditor.
Quick revision
- Private report; no legal form.
- Title and addressee; executive summary; main text; appendices.
- No statutory regulation; ISAs are guidance; membership not compulsory.
- Independence: audit committee, no non-audit tasks, access, support.
- Outsourcing: cost, skills, flexibility v continuity, confidentiality, control, conflict.
Practice questions
Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.
Question 1. An internal audit report is addressed mainly to:
- Shareholders
- Management
- The public
- The registrar
Show the answer
B. It is a private report to management.
Question 2. The executive summary should:
- Repeat the whole report
- Let a busy reader grasp the main content
- Contain only appendices
- Be left out
Show the answer
B. Purpose, findings, conclusions, recommendations.
Question 3. Vital information in an internal audit report must NOT be only in the:
- Executive summary
- Main text
- Appendices
- Title
Show the answer
C. Appendices hold supporting detail.
Question 4. Internal auditors in Nigeria:
- Must belong to ICAN
- Need not belong to ICAN
- Must be lawyers
- Must be directors
Show the answer
B. Membership is not compulsory.
Question 5. ISAs for internal auditors are:
- Mandatory
- Indicative of good practice
- Illegal
- Replaced by CAMA
Show the answer
B. They are guidance.
Question 6. Independence of internal audit is improved by reporting to the:
- Audit committee
- Sales manager
- Customer
- Bank
Show the answer
A. Highest level.
Question 7. A reason for outsourcing internal audit is:
- It is a variable cost
- It guarantees independence
- It is free
- It is required by law
Show the answer
A. Pay only for time used.
Question 8. A problem with outsourcing is:
- Continuity of staff
- Lower fees
- Better control
- No conflict
Show the answer
A. Changing personnel.
Question 9. Outsourcing internal audit to the external auditor raises:
- No issues
- Conflict of interest and independence issues
- A tax issue only
- A stock issue
Show the answer
B. The ethical rules apply.
Question 10. The IIA is the:
- Institute of Internal Auditors
- International Inland Authority
- Institute of Insurance Agents
- Internal Income Agency
Show the answer
A. A global body for internal auditors.
Question 11 (10 marks). Describe the structure and content of an internal audit report. (6 marks)
Question 12 (10 marks). Explain how the independence of internal auditors can be protected. (5 marks)
Question 13 (10 marks). Discuss the advantages and disadvantages of outsourcing internal audit. (9 marks)
Model answers
Show the model answer to Question 11
Introductory items: title, addressee, author, date, status. (1.5) Executive summary: purpose, how the audit was done, findings, conclusions, recommendations. (2) Main text: more detail in the same order, avoiding excess. (1.5) Appendices: supporting detail, no vital information only there. (1)
Show the model answer to Question 12
Report to the audit committee or to a senior executive with periodic reports to the committee; no non-audit tasks; unrestricted access to information; support of management at all levels. (1.25 each)
Show the model answer to Question 13
Advantages: no recruitment or training; specialist skills; variable cost; economical for small entities. (4) Disadvantages: changing staff and loss of continuity; high fees; confidentiality; less control; conflict of interest if the external auditor does it. (5)
Spotted a mistake? Tell us and we will check it.
