An internal audit report is a documented assessment of findings, evidence and conclusions, supported by clear management responses and follow-up responsibilities.
In South African institutions, a remediation tracker connects reported findings to action owners and verification evidence. Management records progress; internal audit assesses that progress independently within its agreed methodology. A completed administrative task is not, by itself, proof that a control works.
Structuring engagement evidence through core finding elements
The operation of internal control systems is the responsibility of the relevant line managers.
— National Treasury Internal Audit Framework2009, section1.3.2.5, page8
A rigorous internal audit report translates complex field evaluations into structured, actionable findings. A useful reporting template distinguishes criteria, condition, cause and effect; the team should establish which elements the evidence supports. Criteria define the expected standard, such as statutory mandates, approved policies, or operational benchmarks.
Condition describes the actual state observed during fieldwork, established through relevant, reliable, and sufficient audit evidence. Cause identifies the underlying root issue or control breakdown responsible for the gap between criteria and condition, developed in collaboration with management where feasible. Effect articulates the potential or realised impact and exposure, enabling leadership to prioritise risk significance.
Compiling these elements logically helps establish whether engagement conclusions reflect balanced professional judgment regarding governance, risk management, and control adequacy. Reports must avoid vague assertions, grounding every observation in verified working paper evidence.
Incorporating scope limitations and management responses
A robust final communication must present a complete picture of the engagement environment, including operational boundaries and administrative feedback. Under global standards, any restriction on access to records, physical property, or personnel must be explicitly disclosed as a scope limitation, detailing its impact on audit conclusions.
Management responses represent an integral component of the final report, reflecting operational commitments to address identified gaps. The report must record agreed corrective action plans, target completion dates, and designated operational owners. Where management and internal audit disagree on findings or recommendations, the report must reflect both positions objectively.
Dissemination of final communications must follow established governance protocols, reaching executive authorities and audit committees empowered to enforce accountability.
Differentiating management progress tracking from independent confirmation
A fundamental distinction exists between management's operational progress tracking and internal audit's independent follow-up verification. Management maintains routine progress trackers to record self-reported milestones, operational updates, and implementation status across business units. While essential for daily administration, self-reported updates do not constitute objective assurance.
Conversely, internal audit conducts independent follow-up assessments using a risk-based approach to confirm whether implemented actions have effectively mitigated the root cause. Under National Treasury guidance, monitoring progress requires evaluating management responses, verifying physical implementation, and performing formal follow-up audits where risk significance warrants re-testing.
Internal audit records the outcome of its follow-up work, including unresolved actions, evidence limitations and any risk acceptance requiring escalation. This separation prevents premature sign-off based solely on administrative assertions.
Mandatory requirements versus recommended implementation practices
Differentiating mandatory standard requirements from recommended implementation practices is essential for sound audit methodology. Mandatory requirements dictate that final engagement communications must include engagement objectives, scope, findings, conclusions, and agreed action plans with implementation timelines.
In contrast, implementation practices represent flexible, advisory guidance designed to enhance operational efficiency. Recommended practices include deploying automated tracking software, issuing interim dashboard reports to executive committees, and conducting pre-closing meetings to refine action plan feasibility.
To operationalise these standards effectively, internal audit functions should embed several key practical measures:
- Establish standardised reporting templates that enforce the inclusion of criteria, condition, cause, and effect across all findings.
- Maintain a central, risk-prioritised remediation database to log management action plan milestones and monitor target completion dates.
- Schedule risk-based follow-up testing cycles aligned with statutory reporting timelines and audit committee calendars.
- Enforce formal dispute-resolution procedures to record management's alternative perspectives where consensus cannot be achieved.
It is crucial to note that while the National Treasury Internal Audit Framework (Revised 2009) provides valuable contextual guidance for South African public service institutions, it represents historical framework guidance rather than the current global standards. The Institute of Internal Auditors issued the Global Internal Audit Standards in January 2024, which became effective in January 2025.
An annotated report and remediation tracker crosswalk
The following four-column crosswalk illustrates the alignment between engagement report findings and independent remediation tracking. For hypothetical and illustrative purposes, a public entity might evaluate procurement controls to demonstrate how initial observations transition into verified remediation.
| Report Finding Element | Hypothetical Engagement Report Details | Remediation Tracker Verification Field | Hypothetical Tracker Verification Entry |
|---|---|---|---|
| Criteria | The institution's approved policy requires specified quotation and approval evidence for the transaction category; verify its actual terms. | Benchmark Reference & Authority | Verified against approved Supply Chain Management Policy criteria. |
| Condition | For hypothetical and illustrative purposes, a regional office purchased equipment without retaining the approval evidence required by its applicable policy. | Tested Physical Evidence | Record the population, selection method, files tested and missing evidence; do not infer untested results. |
| Root Cause & Effect | Absence of automated financial system thresholds permitted purchase order generation without supervisory approval, creating a compliance exposure that requires assessment against the applicable framework. | Risk Significance & Mitigation Target | Record the assessed exposure, agreed action owner and a feasible target date supported by management. |
| Recommendation & Action Plan | Implement automated workflow controls in the ERP system and conduct staff training on procurement thresholds. | Independent Audit Confirmation | Re-tested system controls; confirmed automated quotation block active and operational. |
This structured crosswalk demonstrates how factual report entries directly feed independent verification protocols, supporting traceability from initial finding to final risk resolution.
Sources
- National Treasury Internal Audit Framework, second edition March2009 — National Treasury
- IIA Global Internal Audit Standards2024, effective9January2025 — Institute of Internal Auditors
Frequently Asked Questions
What are the essential components required in a final internal audit engagement communication?
Under global standards, a final engagement communication must articulate the engagement objectives, scope, conclusions, recommendations, and agreed action plans. For assurance engagements, the report must detail individual findings, their risk significance and prioritisation, any scope limitations encountered, and a conclusion on the effectiveness of relevant governance, risk management and control processes within the engagement scope. National Treasury guidance adds that findings must clearly detail criteria, condition, cause, and effect.
How does an independent follow-up verification differ from management's action plan tracking?
Management's action plan tracking is an operational self-reporting process where business unit managers log progress, update implementation dates, and record administrative milestones. In contrast, internal audit's follow-up verification is an independent, objective assessment conducted using a risk-based approach. Internal audit inquires about progress, examines physical evidence, re-tests controls, and verifies that the underlying root cause has been resolved before updating the audit tracking system.
How should scope limitations or disagreements with management be documented in the audit report?
Scope limitations, such as restricted access to records, facilities, or personnel, must be explicitly disclosed in the final engagement communication, detailing their impact on audit conclusions. Where internal audit and management disagree on findings or recommendations, internal audit must follow established methodologies allowing both parties to state their positions objectively in the report. If management refuses to address significant risks, the chief audit executive must escalate the matter to senior management and the audit committee.
Why is the 2009 National Treasury Internal Audit Framework treated as contextual guidance rather than current standards?
The National Treasury Internal Audit Framework (Revised 2009) serves as practical contextual guidance tailored for South African public service institutions under the PFMA and MFMA. However, it represents a historical national framework rather than the latest international standards. The Institute of Internal Auditors issued the Global Internal Audit Standards in January 2024, which came into effect in January 2025 as the authoritative global framework. Internal audit activities should use National Treasury guidance for local public sector context while conforming to current IIA standards.
What mechanisms confirm that implemented corrective actions have mitigated identified risks?
Internal audit confirms risk mitigation through risk-based follow-up assessments, including re-performing control tests, inspecting updated policy documentation, and verifying automated system controls. Under National Treasury guidelines, follow-up audits evaluate whether management's actions have effectively addressed the identified deficiencies and reduced residual risk to acceptable levels. Closure should follow the approved methodology and evidence appropriate to the action. Where management delays action or accepts exposure, internal audit records and escalates the issue as appropriate rather than describing the risk as resolved.
For wider context, read the internal audit delivery models overview.