G.2 Practice Review and Internal Audit Report Format

The purpose/objective of this procedure is to define the format of the Practice Review and Internal Audit (PRIA) reports. This procedure also provides guidelines regarding report writing and report characteristics. PRIA reports should include the engagement’s objectives and scope as well as applicable conclusions, recommendations, and action plans.
The PRIA team of the Office of the Auditor General of Canada (Office) provides the Auditor General with independent and objective information, advice, and assurance. The format of both practice review and internal audit reports will include the following items.
The report will include:
1. The date of the report, the title or subject of the audit.
2. An introduction on the first page. Background information should be present in the Introduction when the auditor believes the various report readers do not have the firsthand knowledge necessary to correctly interpret the audit report.
3. The next section should include Findings, Recommendations, and Responses.
4. The "About the Internal Audit" section should include the following:
  1. the review or the audit objective(s);
  2. the systems and practices examined, and criteria;
  3. the period of time covered;
  4. the date of the audit report;
  5. the date approved by the Auditor General; and
  6. the name of the auditor(s) who performed the audit.
5. If all findings included in the report were not accepted or committed to future improvement action that is judged satisfactory to internal audit, a paragraph should be included to address such matters.
6. An executive summary outlining the importance of the internal audit and its results.
7. Engagement communications should acknowledge satisfactory performance. If the report does not contain significant matters, the favourable results should be stated.
8. An opinion (such as adequate, requires improvement, or requires management attention) on the specific audit subjects. The internal audit opinion should be specific to the audit objective(s) so that the report readers can understand the correct breadth of the opinion.
9. A request for a written follow‑up reply by a specific date. The follow‑up date should allow for submission to the Audit Committee with the audit report. Internal audit should meet with management responsible for the area under audit to fully understand the action plan and be in a position to comment on its adequacy (see item e above).
10. Use of “Conducted in Accordance with the Standards” in internal audit reports. Internal auditing Standard 2430 encourages internal auditors to report that their activities are “conducted in accordance with the International Standards for the Professional Practice of Internal Auditing (Standards).” However, the use of this statement is appropriate only if assessments of the quality improvement program demonstrate that the PRIA activity is in compliance with the Standards.
The following sections are applicable to both internal audits and practice reviews:
1. Significant Findings—The significant findings requiring corrective action should be discussed in detail in the appropriate examination section of TeamMate. Data presented for each finding should include a statement of the adverse condition, supporting facts and test results, effect of the condition, and, if appropriate, the cause of the condition, and a recommendation for corrective action or a statement of action proposed by the personnel responsible.
2. Less Significant Findings—Findings and comments that can be categorized as less significant should be included in a separate working paper. A statement should be made at the end of the audit report that indicates "a separate listing of less significant findings was provided to concerned management for their consideration/improvement action."
3. These findings would be documented in the appropriate examination section of TeamMate and noted as less significant. Less significant audit findings may not require a management response for report purposes; however, they should be provided to the appropriate management for resolution.
4. Determination of whether a finding or comment is included in the report is based on the auditor's judgment on the impact and/or exposure of the finding. This will be clearly documented in TeamMate in the discussion of the finding. Further review and assessment of the auditor's judgment will be made by the Chief Audit Executive (CAE).
All reports should incorporate the following characteristics:
1. Accuracy—All reports must be supported with facts. It is extremely important that the credibility of the internal audit activity and each internal auditor be maintained at the highest level by factual, unbiased, and objective reporting.
2. Objectivity—Objective communication is factual, unbiased, and free from distortion. Audit report observations, conclusions, and recommendations should be included without prejudice.
3. Clarity—All reports must be understandable, clear, and use plain language. Clear communication is easily understood and logical. Clarity is improved by avoiding unnecessary technical language or audit terminology and providing sufficient supportive information. Use of Office terms is recommended.
4. Quantification—All comments must be quantified to the maximum extent possible to identify the significance and impact of the points made. Examples of quantification are dollar amounts, quantities, number of test exceptions, and scope of testing.
5. Conciseness—All reports must be to the point. This does not necessarily mean short.
6. Constructive—All reports should maintain a diplomatic balance with respect to the sensibilities of all readers. Emphasis should be on improvement, not on criticism of processes, people, or the past.
7. Complete—Internal audit reports should be complete. It is important that our reports do not require interpretation or oral comment to fill in the gaps. The report should stand by itself.
8. Timeliness—All reports must be issued in a timely manner upon completion of the assignment. Once the Audit Committee recommends reports for approval by the Auditor General, internal audit reports and summary practice review reports should be sent for edit and translation and layout for publication, if not already done. Auditors should monitor the progress for each internal audit report in TeamMate. Note: Not all reports produced by PRIA follow this process (for example, the individual practice review report to the engagement leader).
9. Resolution—All internal audit or summary reports must have associated management action plans: cite the who, what, and when of remedial action. Without specific responses and assignment of responsibility, effectiveness is lost.
Guidelines concerning the preparation and distribution of PRIA reports follow:
1. The internal auditor is expected to have a draft report completed before the CAE’s final review of the working papers is completed.
2. A draft report should generally be provided to the management of the area audited or the engagement leader before the review meeting date. All drafts that are distributed should be dated, and all in attendance at the review meeting should have the same draft. All draft reports should be spell checked and checked for grammar. Because this may be management's first complete exposure to all findings, it is important to present a professional looking product.
3. Before the review meeting, at a minimum, the high-risk sections of the draft report should be referenced to the audit working papers.
4. Final internal audit and summary reports will be distributed by the CAE to the applicable management personnel with direct responsibility for the area audited. The practice review report to the engagement leader will be provided to the engagement leader for final sign off. Additional distribution to higher-level management personnel will be determined by the CAE.
5. Internal audit and summary reports will be published on the Office’s internal and external website.

Last modified:: 2018-03-22

Global INTRAnet Links

Menu

G.2 Practice Review and Internal Audit Report Format