Writing the internal audit report

An internal audit can be well planned and well run and still achieve little if the report is late, long or vague. The report is what management reads, what the process owner works from, and what a certification auditor samples to judge whether your audit programme works. This guide sets out what an internal audit report should contain, how to write it, and how its results reach management review, with a template outline based on a purchasing audit at Kestrel Metals, a fictional fabricator in Lagos and Ogun.

What the standards ask for

ISO 9001:2015 clause 9.2.2 expects the results of audits to be reported to relevant management and the audit results to be kept as documented information. ISO 14001, ISO/IEC 27001 and ISO 45001 make the same request; ISO 45001 also expects relevant results to be reported to workers and their representatives.

None of these standards prescribe a format. ISO 19011:2018 gives guidance on what an audit report typically covers: objectives, scope, the auditee, the audit team, dates and locations, criteria, findings and evidence, conclusions and any unresolved disagreements. It also suggests the report should be issued within an agreed period.

What goes in the report

A useful internal audit report answers six questions for a reader who was not there:

• What was audited? The audit scope: process, site, shifts and period. The audit criteria: clauses, procedures, customer and legal requirements.
• When and by whom? Audit dates, auditor names, and the auditee by role.
• What was looked at? The sample: how many records of each type, from what period, chosen how. This is the part most reports leave out, and it is what makes a conclusion credible.
• What was found? Nonconformities grouped by severity, then observations and opportunities for improvement. Each audit finding written as requirement, evidence and statement.
• What works? Positive findings with evidence.
• So what? A conclusion on whether the process conforms to the criteria and whether it is effective in achieving its intended results.

Add the agreed next steps: who responds to each finding and by when, and how actions will be verified.

Be careful with the conclusion. Conformity and effectiveness are different questions. A process can follow its procedure in every sampled record and still fail to achieve its intended result: every supplier evaluated on time, for example, while late deliveries keep rising because the evaluation criteria do not cover delivery. The reverse also happens. Say which applies, and on what evidence. A conclusion such as “the process conforms but its effectiveness could not be confirmed because performance data is not collected” is more useful to management than a general statement that the audit went well.

A template outline

Section	Content	Typical length
1. Header	Audit reference, process, site, dates, auditor(s), auditee (role), report date	A few lines
2. Objective, scope and criteria	Why this audit; what was in and out of scope; the clauses and documents audited against	One short paragraph
3. Summary and conclusion	Overall conclusion on conformity and effectiveness; count of findings by severity	Three to five sentences
4. Method and sample	Interviews by role, areas observed, records sampled with numbers and periods	A short list
5. Nonconformities	Each with grade, requirement, evidence, statement, owner and response date	Half a page each at most
6. Observations and OFIs	Same structure, clearly labelled as not nonconformities	A few lines each
7. Positive findings	What works, with evidence	A short list
8. Previous findings	Status of findings from the last audit of this process	A short table
9. Next steps and distribution	Response dates, follow-up method, who receives the report	A few lines

Section 8 is worth including. It shows whether earlier corrective actions held, which is the evidence certification auditors look for when they ask whether your internal audits lead to improvement.

How long, and in what tone

For a one-day audit of a single process, two to four pages is usually enough. The summary should fit on the first page, so a manager who reads nothing else knows the result. If the report runs much longer, it is usually because the auditor has narrated the day rather than reported the findings.

Keep the tone factual and neutral:

• Use numbers, record IDs and dates rather than adjectives.
• Name roles, not individuals, especially in connection with findings.
• Do not add findings at the report stage that were not raised at the closing meeting. If something new emerges, discuss it with the auditee first.
• Do not soften findings that were agreed on the day.
• Leave out recommendations in nonconformities; the process owner decides the action after investigating the cause.

Here is the summary from Tunde Bakare’s report on the Kestrel Metals purchasing audit:

Purchasing at the Ikeja plant was audited on 9 September 2026 against ISO 9001 clause 8.4 and procedure QP-08. Eleven active suppliers, twelve purchase orders from January to August and two goods-in rejections were sampled. Purchase orders stated requirements clearly and rejections were handled as required. One medium nonconformity was raised: three of eleven active suppliers had no evaluation since 2023. One observation was raised on the evaluation criteria. The process conforms in most respects but is not yet effective at keeping supplier evaluations current.

That is five sentences, and a reader knows what was audited, how much was looked at, what was found and what it means.

Who receives the report

ISO 9001 asks for results to reach relevant management, so the distribution should match the scope. Typically:

• The process owner, who must respond to the findings.
• The process owner’s manager, where findings need resources or decisions above the owner’s authority.
• The audit programme manager, usually the quality manager, who tracks responses and verifies actions.
• Top management, directly for serious findings, otherwise through the management review summary.

Agree in your audit procedure how reports are stored and who can see them. Reports for ISO/IEC 27001 audits may describe weaknesses in security controls, and reports that include personal data should be handled in line with the Nigeria Data Protection Act 2023.

In Orisynx, an audit summary is one of the report types, alongside finding trend and remediation status, and reports are created as drafts for the audit team to review.

When the corrective actions are verified, record the outcome against the original findings rather than issuing a new report. A short note on each finding, saying what was checked, when, by whom and whether the action was effective, completes the audit record. If a follow-up audit is needed, it gets its own short report that refers back to the original.

Feed the results into management review

ISO 9001 clause 9.3.2 lists audit results among the information management review must consider. Individual reports are too detailed for that meeting. Instead, the audit programme manager usually prepares a summary for the period:

• Audits planned, completed and postponed, with reasons.
• Findings by severity and by process, and how they compare with the previous period.
• Repeat findings, which suggest corrective actions are not working.
• Status of corrective actions: open, overdue and closed, and how many were verified effective.
• Themes across audits, such as document control gaps appearing in several processes.
• Any changes proposed to the audit programme as a result.

At Kestrel Metals, A. Mensah’s management review summary showed that supplier evaluation had produced findings in two consecutive years. That led management to fund a supplier performance dashboard and to raise purchasing to high risk in the next year’s programme. The guide on planning a risk-based audit programme explains how results like these change audit frequency.

Common report problems

• No sample stated. “Supplier records were reviewed” says nothing about how much was looked at.
• Findings that differ from the closing meeting. The fastest way to lose an auditee’s trust.
• No conclusion. A list of findings without a judgement on conformity and effectiveness leaves management to guess.
• No positives. A report that only lists problems suggests the auditor only looked for problems.
• Issued too late. A report that arrives a month after the audit delays every corrective action by a month.
• Copied text. Paragraphs carried over from last year’s report, with the dates changed, tell the reader that the audit was not looked at afresh.
• Unexplained grades. A finding graded high with no reference to the grading definitions invites a dispute that a single line of reasoning would have avoided.

For the structure of individual findings, see how to write an audit finding that gets fixed.

Sources

• ISO 19011:2018, Guidelines for auditing management systems: https://www.iso.org/standard/70017.html
• ISO 9001:2015, Quality management systems, Requirements: https://www.iso.org/standard/62085.html