Internal audit report IA-2026-03, payroll process, Haverleigh Home Care
Internal audit report template with rated findings and management responses
An internal audit report has to tell a committee how well a process is controlled, which gaps matter most, and what management has agreed to do by when. This six page payroll audit gives an overall rating, a findings table, six findings rated High, Medium or Low with a condition, risk, recommendation and response each, and the rating definitions behind them.
The document, page by page
Every page as it renders and as it prints, with nothing summarised. Read the wording before you reuse it.
Section by section
What each section is for, so you can keep the ones you need and drop the rest.
- Cover
- Report number, process, organisation, audit period, committee date and issue date.
- 1. Executive summary
- Population audited, the overall rating, the High finding in one sentence and findings counted by rating.
- 2. Scope and approach
- Objectives, what was out of scope, six areas tested with sample sizes, fieldwork dates and the closing meeting.
- 3. Findings at a glance
- Six findings with rating, owner and agreed date in one table.
- 4. Detailed findings and responses
- Each finding with condition, why it matters, recommendation and the management response.
- 5. Rating definitions
- What High, Medium and Low mean, how long each allows, and how actions are followed up.
How to adapt this document
First, change the scope table to the process you audited, keeping the sample column; for purchasing you might test new suppliers, purchase orders over a threshold and changes to supplier bank details. Second, if your committee prefers a four level scale, add Critical above High with action within a week, and update the definitions and every agreed date to match. Third, for a short audit with two or three findings, drop the findings at a glance table and let the executive summary list them, but keep the condition, risk, recommendation and response pattern for each.
What makes this document work
The sample sizes are on the page
The scope table shows what was tested and how much of it: all 38 bank detail changes, 60 of 412 employees, 25 of 71 starters. A committee can judge how far each finding reaches only when it can see whether it came from a full population or a sample.
Each finding says why it matters
F1 does not stop at seven changes made without a call back; it says one forged email would divert a full fortnightly net pay, on average $1,520, and that such losses are rarely recovered. The risk sentence is what makes a busy reader act.
Ratings carry a deadline
The definitions table ties High to action within one month, Medium to three and Low to six, and every agreed date fits: F1 by Friday 16 October against a report dated 25 September. A rating with no clock attached is only an opinion.
Questions people ask
What is the difference between internal and external audit?
External auditors give an opinion on whether the financial statements are fairly stated, for shareholders or regulators. Internal audit works for the board and management, testing whether processes and controls work across the whole organisation, payroll included. Internal audit can look at anything the committee asks; external audit mainly looks at what could misstate the accounts.
How should findings be rated?
Use a short scale the committee has approved, usually three or four levels, with a definition and a time to act for each. Rate on the consequence if the gap were exploited and how likely that is, not on how many exceptions were found. Seven bank changes without a call back outrank forty missing signatures on leave forms.
Can management disagree with a finding?
Yes, and the report should say so. Record the response as management wrote it, and if they decline a recommendation, note that they have accepted the risk and who accepted it. The committee then decides whether that is acceptable. A report where every finding is quietly agreed can hide a disagreement that matters.
Should an internal audit report name individuals?
Refer to roles, not names. Finding F4 describes the senior payroll officer's access rights because the role is what carries the risk, and the person may have done nothing wrong. If misconduct is suspected, that is handled through a separate, confidential investigation rather than in a report circulated to several managers.
How often should payroll be audited?
Payroll is often one of the largest costs and a common fraud target, so many organisations review it every two or three years, or every year where controls are weak or systems have changed. Data analytics can test every pay run continuously between full audits, flagging duplicate bank accounts or payments to leavers.
What happens after the report is issued?
Internal audit tracks each action and checks it after the agreed date, then reports progress to every committee meeting until all are closed. Checking means seeing the control work, such as the system hold on bank changes, not accepting an email saying it is done. Overdue actions are reported with a reason.
Build your own in about a minute
The button below opens the generator with this use case already described. Change the wording to match your own, generate, then edit anything you like.
Make one like thisOther document examples
Test report template with cases by area, a pass rate chart and open defects
A test report has to tell the people who decide on a release what was tested, what passed, what is still broken and whether the agreed exit criteria are met. This four page report for a payroll module release counts 378 cases by area, charts the pass rate, lists every open defect with a decision, and ends with sign off from QA and the product owner.
Survey results report template with response rate, question charts and comment themes
A survey results report has to show who answered, what they said question by question, what changed since last time, and what the organisation will do about it. This report on a staff engagement survey with 180 responses gives the response rate by department, ten questions in a table and three charts, coded comment themes with quotes, and five actions.
Training evaluation report on reaction, learning and behaviour after a course
A training evaluation report has to show whether a course was worth its cost: whether people turned up and rated it, whether they learned what it taught, and whether they did anything differently afterwards. This four page report on a first aid course for 24 staff measures all three, with attendance, a reaction chart, before and after test results, a four week follow up and five recommendations.
Want the steps in the builder? Read Create a document with AI, then Add a cover page to your document. For everything this generator can do, see the document maker.
Sources
Written and checked by the OneCraft team. Last checked .