Internal audit report example and template: how to write findings, evidence and actions

Your audit report contains this line: “Disorder observed in the warehouse.” Three weeks later the department manager asks: which warehouse, which shelf, disorganised by what standard? The auditor does not remember the shelf, and the photo is still on their own phone. No action is raised, because there is nothing concrete to act on. The problem is not the audit itself but the way the finding was written. A well-written finding tells the reader at a glance what happened, why it counts as a problem, what it is based on and what needs to be done. Below is a report skeleton that achieves this and a fictional internal audit report example.

An internal audit report is the document that records the scope of an audit, the criteria used, the conditions found and their evidence, with an owner and a due date for each issue. A quality internal audit and a company’s general internal audit can use the same skeleton. The only thing that changes is the criterion: one is based on the standard and procedures, the other on company policies and internal controls.

How to write an internal audit report, and what sections does it have?

How do you write an audit finding?

The hardest part of the report is the finding statement. Every finding should answer four questions:

1. Condition: what was seen, where and when?
2. Criterion: against which procedure, work instruction or clause of a standard does it count as a problem?
3. Evidence: which record, photo or observation shows this?
4. Effect: what risk does this condition create?

In the table below you can see weak and strong wording of the same issue. The numbers and document names in the examples are fictional.

Wording to avoid when writing findings

Vague words such as “generally”, “some”, “inadequate” or “disorganised” open the finding to debate; the department manager can raise a separate objection to each one. Use numbers, locations and record references instead. Tie the finding to the condition, not the person: writing “Three pallets are unlabelled” instead of “The warehouse supervisor did not label them” is more accurate and moves the fix from the person to the process. Also separate interpretation from observation: write what you saw and what you conclude from it in separate sentences.

Internal audit report template you can copy and adapt (fictional)

The summary below was written for a warehouse audit at a fictional food packaging plant. You can adapt the headings and sentence patterns to your own departments.

• Scope and criteria: Warehouse and shipping department, January–February. Criteria: Warehouse Procedure and Stock Recording Instruction.
• Method: Interview with the warehouse supervisor, site observation on two shifts, comparison of 10 stock cards with the system record.
• Finding 1 (nonconformity): In warehouse B, 3 pallets were found without labels and with no matching stock cards. Criterion: Warehouse Procedure clause 4.1. Effect: risk of shipping the wrong product.
• Evidence: Photo P-3, stock card comparison list.
• Finding 2 (observation): On the night shift, the shipping form is filled in late; this has not yet led to missing records.
• Action 1: Label the pallets and update the stock cards; analyse the cause and add the labelling step to the work instruction.
• Owner and due date: Warehouse supervisor; the due date is written in the report as a specific day.
• Evidence of closure: Photo of the labelled pallets and the updated stock cards.

Checklist before issuing the report

• Is the criterion (clause or procedure name) written next to every finding?
• Is the evidence for every nonconformity in the report or its annex, with the record number?
• Does the finding statement include location, quantity and date?
• Were the findings confirmed with the department manager at the closing meeting?
• Does every action have a single owner and a date?
• Are observations and improvement suggestions written separately from nonconformities?
• Are positive findings recorded too?
• Are the distribution list and report version shown in the header?

Is a company internal audit report the same as a quality internal audit report?

The skeleton is the same; the criterion changes. In a quality internal audit report, the criteria are the relevant clause of the ISO standard and the company’s procedures; the clause number is written next to the finding. In a company’s general internal audit, the criteria may be internal controls such as the authority matrix, approval rules or retention practices. In both cases, the finding statement consists of the same four parts: condition, criterion, evidence and effect. Write positive findings briefly too: what works well becomes a point of comparison in the next audit. The criteria section should come before the findings and stay the same throughout the report; otherwise the same finding can mean two different things to two readers, and the discussion turns to which yardstick it was written against rather than to the finding itself.

What happens if the report stays a PDF?

A Word or PDF report is read, signed and archived; a list of findings kept in Excel also works when there is one auditor and few findings. The difficulty is that the report is a closed document, not a living record:

• Actions are copied out of the report into another spreadsheet by hand; the two lists drift apart over time.
• Due dates are in nobody’s calendar, and reminding people is left to the auditor.
• Evidence is scattered across email and personal folders.
• Whether the same issue comes up again the following year cannot be seen without opening old reports one by one.

How is a finding linked to an action in KurumsalPortal?

In the Internal Audit Management module, the audit is tied to a plan and carried out using a checklist. Findings and nonconformities are recorded against the relevant audit; the finding does not stay in the report but becomes a traceable record. For each finding, a corrective action with a clear owner and due date is raised, and the action is closed by attaching evidence that it was completed. The finding, evidence, action and owner columns of the report thus become links in a single chain rather than disconnected files.

In practice, the report has two parts: the narrative people read and the record the system keeps. Keeping the narrative part (scope, method, summary conclusion) short and filling in the finding, evidence and action fields in the record chain makes the report both readable and traceable. Which actions are open and which are closed can be seen from the record without opening old reports. Differences in style between auditors also shrink, because everyone fills in the same fields and every finding is written with the same four-part pattern.

If you would like to see the other modules alongside the audit and action chain, continue on the KurumsalPortal page.