Internal auditing is usually commissioned by the company management or the group management. Internal auditing can also be commissioned by individual areas of the company or the group in coordination with the company or group management. The results of an audit by the internal audit department must be presented to the client. The internal audit can summarize the results during the audit in an interim report and after completion of the audit in a final report. Special reports can be used to pass on confidential or particularly important information.
Final reports must be drawn up in writing in accordance with the Standards for the Professional Practice of Internal Auditing and must be signed. Interim reports and special reports, on the other hand, can be presented orally and passed on formally or non-formally.
The task of reporting by the internal auditing department is to report established facts and circumstances and to justify the audit results. The reporting of the internal audit is to be adapted to the needs of the company or group management. Depending on the type of audit assignment and the company or group, there may be differences in the form and scope of the reporting.
The reporting of the internal auditing department must comply with the principles of proper reporting. The principles of proper reporting define basic requirements in order to always present the essential information in the reports of the internal audit in a clear, objective, comparable and timely form.
The following principles of proper reporting therefore apply to the internal audit's reporting:
• Principle of clarity
• Principle of objectivity
• Principle of comparability
• Principle of materiality
• Principle of timeliness
The principle of clarity calls for an understandable and unambiguous presentation of the content of the report. The report must be prepared in a simple and factual style and clearly structured. Unnecessary technical terms and rarely used foreign words are to be avoided. Of course
This should not be mentioned and extensive statistics and other lists are to be presented in the annexes to the report.
The principle of objectivity requires that reports be factual, unbiased and truthful. The report must contain a full, conscientious, fair and complete assessment of all findings, conclusions and recommendations. Unfounded personal expressions of opinion are not part of a report. The principle of objectivity includes the principles of impartiality, completeness and truth.
The principle of comparability requires the presentation of a report in a uniform concept. The audit assignments are very different depending on the type and scope, so that there is scope for designing the audit report. A standardized structure of the report, however, has the advantage that both the reports of similar audit assignments and the reports of the same audit assignments can be compared with one another over time.
The principle of materiality means that reports should only be made on essential facts that the audit has produced. Significant facts are those facts that are important for the recipients of the report to be adequately informed. By observing the principle of materiality, reporting is limited to the required scope and is therefore more informative.
The principle of timeliness requires that the reports are drawn up in good time and forwarded to the appropriate addressees. Timely reporting enables an immediate and effective reaction to determined facts.
The internal audit reports should be coordinated with the audited body before they are released. If the coordination between the audited body and the internal audit takes a long time, the company or group management should be informed in advance verbally or in writing by means of a special report of important findings.
The reports of the internal audit must show the purpose, scope and results of the audit. The reports can contain recommendations for improvement and, if necessary, also take into account the opinions of the internal auditor and the opinions of the audited person on certain issues. The inclusion of positive performance and the implementation of suggestions for improvement in the report of the internal audit is recommended. In this comprehensive reporting, the internal auditing department is not only accepted by the company or group management as an auditor, but also as an advisory body.
The content and form of reporting will vary greatly in different companies and groups. The content-related statements and the external form should, however, be designed uniformly within a company or group. A uniform concept enables comparability and promotes comprehensibility of the reports. The reports must be approved by the management of the internal audit; they are then to be distributed to the various recipients. The report distribution determines to whom reports are forwarded and the scope of reports for individual recipients. The distribution of the reports depends on the size of a company, the number of members of management and the organizational integration of the reporting institution. The system of report distribution must be established before the reports are prepared. This is the only way to ensure a comprehensive supply of information and guarantee the necessary confidentiality.
The reports are generally distributed to the people or institutions in a company who pay the necessary attention to the information. The potential recipients of reports from Internal Audit can be divided into the following groups:
• Company or group management
• Managing the audited area of a company
• Persons or institutions of a company who can either initiate or initiate corrective measures
• Persons who are interested in the report or who are affected by it (e.g. auditors)
The level of detail in the reports usually decreases with the increasing hierarchy level of the company. The company or group management should only receive a summarized report in order to avoid information overload for management.
The reports must give a comprehensive, reliable and objective overview of the result of the audit at every hierarchical level of the company. The report should therefore not only contain serious negative findings, even at the highest level, but should also take into account positive findings and reactions to earlier suggestions for improvement.
Confidential information is not intended for all report recipients. Reports and information of extraordinary importance should be distributed directly to the company or group management, if necessary as special reports.
The internal audit reports are monitored as part of the report review. The report criticism is connected to the topic of audit monitoring, which is discussed nationally and internationally in connection with the problems of the auditing profession. The process-dependent control and the process-independent test are subdivided. The report criticism is part of the process-independent measures of the audit monitoring.
The report review has the task of improving the quality of the audit reports and standardizing them. The term report criticism is used both functionally and institutional.
In a functional sense, report criticism means the review and revision of the draft of the audit report by a person who is not involved in the audit (process independence). The general criteria for carrying out the review of the report result from the principles of proper reporting. The report critique comprises the following two main areas of activity:
1) Formal review of the report
Formal report criticism focuses on formal criteria, such as the standardization of the structure and structure of the audit reports to improve clarity, the uniform presentation of tables and figures, ensuring clear and precise language and checking the spelling.
2) Material review of the report
The substantive review of the report has the task of checking the content of the audit report. Criteria for the material criticism of the report are, for example, the mathematical correctness and completeness of the information in the audit report, the logical consistency of the individual information with one another and the admissibility of conclusions.
In the institutional sense, the term report review is used for the position or department in the company that is responsible for carrying out the report review. From an organizational point of view, the position or department for report criticism can be classified as a staff unit or staff department subordinate to the head of corporate auditing. In this case, the report criticism has no authority to issue instructions to the individual auditors. If the internal auditing department in a company consists of only one auditor or a single audit team, the report criticism cannot be separated from the report preparation. In this case, the auditor or the audit team itself must critically review the audit report at a sufficient interval.