Reports promoters actually read: a structure that works.

Our practice, in detail.

1. Why short reports win.

The audit committee reads what fits in the meeting pack. The promoter reads the executive summary. The CFO reads the findings list. Nobody reads the appendices.

An eighty-page report is therefore exactly as informative as the first three pages most readers actually see, plus a lot of paper that signals diligence to anyone leafing through the file but adds no information to the decision-makers. The discipline of writing a shorter report forces the IA team to decide what matters before sending it, rather than offloading that decision to the reader.

A well-written quarterly internal-audit report runs 15 to 25 pages including annexures. The executive summary fits on one page. The findings list runs four to eight pages. The annexures take up the rest. Anything longer is padding.

2. The one-page executive summary.

One page, three sections, in this order:

• What we did. Two or three sentences describing the scope of this cycle's audit, the period covered, and the testing methodology. Not a recitation of standards; a description of what the team looked at.
• What we found. Three to six bullet points, each capturing one finding in its sharpest form. Quantified where possible. Categorised by significance (high, medium, low) so the reader can skim by priority.
• What we recommend. The structural changes that close the gap. Phrased as actions, with owners and target dates.

If the executive summary cannot be written in a page, the underlying audit has not been completed. The page-limit is a forcing function, not an aesthetic preference.

3. The fixed-grammar finding.

Every finding in the findings register follows the same structure. The reader learns the grammar after the first finding and can read the rest at speed.

• Observation: what we found, factually, with reference to the transaction, document or population. ("Vendor master entries for 12 vendors were created in the period without supporting KYC documentation, contrary to the vendor-onboarding SOP.")
• Root cause: why the gap exists. ("The approval workflow for new vendor creation in the ERP does not require KYC upload as a mandatory step.")
• Risk implication: what could go wrong because of the gap, stated in business terms. ("Risk of payments to non-existent or non-compliant vendors; risk of fictitious vendor fraud; risk of GST input-tax-credit reversal.")
• Quantified impact: where measurable, the monetary or operational exposure. ("Payments to the 12 vendors during the period: ₹1.4 Cr.")
• Recommendation: the change that closes the gap. ("Configure the ERP vendor-creation workflow to make KYC document upload mandatory; introduce a quarterly review by Finance of new vendors added.")
• Management response: management's view, including agreement, partial agreement, or disagreement with reasoning.
• Owner: the named position (not just a department).
• Target date.

This grammar is rigid on purpose. The discipline of writing every finding the same way exposes the findings that are weak. If the root cause cannot be articulated, the finding is not yet ready; if the risk implication cannot be stated in business terms, the finding is technical noise; if the recommendation cannot be phrased as an action with an owner, the recommendation is incomplete.

4. The management response column.

The management response is drafted by the audited unit and reviewed by the auditor. It is not edited by the auditor.

Where management agrees, the response captures the action plan, owner and date. Where management partially agrees, the response captures the modified action plan and the rationale for the modification. Where management disagrees, the response captures the disagreement and the auditor adds a brief rejoinder.

Disagreements are not failures of the audit. They are useful information for the audit committee. A finding marked "Disagreed by Management" with both sides recorded is a perfectly legitimate audit outcome; the committee can then form its own view.

5. Where the evidence lives.

Every finding in the report is supported by evidence in the working files. The evidence does not appear in the report.

The working files contain: data extracts used, exception lists produced from analytics, sample selections, screenshots of system states, copies of documents reviewed, interview notes. They are organised by finding number so any reviewer (the audit committee, the statutory auditor, an external quality reviewer) can trace from a finding to its evidence in under a minute.

A report that contains evidence (data tables, screenshots, lengthy citations) inflates without informing. Move it to the working files.

6. A reusable template.

A repeatable report has six sections in this order:

1. Cover and contents (one page).
2. Executive summary (one page, structured as above).
3. Scope and approach (one to two pages: period, processes, sample sizes, limitations).
4. Findings register (four to eight pages, fixed grammar per finding).
5. Status of prior-period findings (one to two pages, summarising what was open, what closed and what remains).
6. Annexures (everything else, as needed).

Use the same template every cycle. The audit committee learns the rhythm by the second report and can read the third report in twenty minutes.

CA Dheeraj Somani

Founder & Proprietor · D Somani & Associates · More about the firm →