Sample deliverables · Illustrative
What our audit output looks like
A results dashboard, a findings register with root causes and action plans, and the risk assessment behind an annual audit plan. Formats follow common internal audit practice and are adapted to each client.
01 · Audit results dashboard
One page for management to see where things stand
Used in the closing meeting and in monthly follow-up reporting.
- 10Observationsacross 4 processes
- 3High-ratedneed priority action
- 40%Actions closed4 of 10, verified
- 2Overdueescalated to management
- High
- Medium
- Low
- Control gap
- No control exists, or its design is inadequate
- Control lapse
- The control exists but is not performed consistently
- Control enhancement
- The control works but can be improved
- Closed
- In progress
- Open
- Overdue
02 · Findings register
Every finding, from condition to follow-up
Each observation records the condition, risk, root cause, recommendation, the action management agreed, the owner, the due date and the latest follow-up. Select a row to see the detail.
Rating
Status
10 of 10 findings shown
P2P-01 Vendors appointed above authority limits without approvalProcure-to-pay High
- Condition
- 7 of 40 purchase orders above Rp500 million were awarded by direct appointment without Director approval.
- Risk / impact
- Overpricing and conflicts of interest go undetected.
- Root cause
- No value-based approval matrix configured in the ERP.
- Recommendation
- Set approval limits by value in the ERP and block POs that exceed them.
- Management action plan
- Configure approval workflow and approve the authority matrix.
- Follow-up
- Workflow tested; go-live delayed pending ERP vendor support.
P2P-02 Vendor master contains duplicates and vendors sharing employee bank accountsProcure-to-pay High
- Condition
- 141 inactive or duplicate vendors; 2 vendor bank accounts matched employee payroll accounts.
- Risk / impact
- Payments to fictitious or related-party vendors.
- Root cause
- No periodic vendor master review or bank-account matching.
- Recommendation
- Cleanse the vendor master and match vendor bank accounts to employee data every quarter.
- Management action plan
- Block inactive vendors; run quarterly matching report.
- Follow-up
- Verified: 141 vendors blocked; Q3 matching report reviewed.
P2P-03 Payments released without goods receipt confirmationProcure-to-pay Medium
- Condition
- 18 of 60 sampled payments had no Goods Receiving Note signed by site staff.
- Risk / impact
- Paying for goods that were not delivered in full.
- Root cause
- Three-way match is not enforced before payment.
- Recommendation
- Enforce PO–GRN–invoice matching in the system before payment.
- Management action plan
- Activate three-way match; train site admins.
- Follow-up
- Matching active at 2 of 3 sites.
P2P-04 Incomplete supporting documents for paymentsProcure-to-pay Medium
- Condition
- 11 of 60 payments lacked tax invoices or signed contracts.
- Risk / impact
- Tax exposure and weak evidence in disputes.
- Root cause
- No payment checklist; urgent requests bypass review.
- Recommendation
- Introduce a payment checklist and return incomplete requests.
- Management action plan
- Issue checklist; finance rejects incomplete packs.
- Follow-up
- Verified on 25 September samples.
INV-01 Stock count differences adjusted without investigationInventory & warehouse High
- Condition
- Count variances of 3.2% of inventory value were written off without approval or root-cause review.
- Risk / impact
- Theft or loss stays hidden; inventory may be misstated.
- Root cause
- No variance threshold or approval policy.
- Recommendation
- Set variance thresholds; require investigation and Finance Director approval above them.
- Management action plan
- Draft stock adjustment policy and recount high-value items.
- Follow-up
- Policy drafted; recount scheduled for November.
INV-02 Slow-moving and expired stock not identifiedInventory & warehouse Medium
- Condition
- No stock ageing review; expired items found in two warehouses.
- Risk / impact
- Overstated inventory and write-offs that come as a surprise.
- Root cause
- Ageing report not available from the system.
- Recommendation
- Produce a monthly ageing report and review provisions.
- Management action plan
- Build ageing report; monthly review meeting.
- Follow-up
- Report built; first review held in October.
INV-03 Warehouse users can change stock quantities without approvalInventory & warehouse Medium
- Condition
- 9 warehouse users hold rights to post stock adjustments directly.
- Risk / impact
- Unauthorized adjustments can conceal losses.
- Root cause
- Role design grants broad access; no periodic access review.
- Recommendation
- Restrict adjustment rights and review user access every quarter.
- Management action plan
- Redesign warehouse roles; quarterly access review.
- Follow-up
- Role redesign not started; escalated to Finance Director.
O2C-01 Sales orders released above customer credit limitsOrder-to-cash Medium
- Condition
- 12 customers exceeded their credit limit by a combined Rp2.1 billion.
- Risk / impact
- Higher bad-debt exposure.
- Root cause
- System shows a warning but does not block orders.
- Recommendation
- Turn on credit block; approvals above limit by Sales and Finance Directors.
- Management action plan
- Enable credit block after year-end sales period.
- Follow-up
- Not yet due.
O2C-02 Discounts outside the price list not documentedOrder-to-cash Low
- Condition
- Special discounts given verbally for 6 customers.
- Risk / impact
- Margin leakage and inconsistent pricing.
- Root cause
- No discount approval form.
- Recommendation
- Use a discount approval form with limits by role.
- Management action plan
- Roll out discount approval form.
- Follow-up
- Verified on September orders.
HR-01 Exit process not standardizedHR & payroll Low
- Condition
- System access for 3 resigned staff was removed 2–4 weeks after their last day.
- Risk / impact
- Former staff could still access company systems.
- Root cause
- HR and IT have no shared exit checklist.
- Recommendation
- Use one exit checklist with same-day access removal.
- Management action plan
- Issue exit checklist; monthly HR–IT reconciliation.
- Follow-up
- Verified on September leavers.
03 · Risk assessment for the annual audit plan
Audit effort follows risk
Each auditable area in the audit universe is scored for impact and likelihood (1–5). The score, adjusted for prior audit results, decides which areas are audited next year, when, and with how many days.
- High (15–25)
- Medium (8–14)
- Low (1–7)
Impact →
5
TRS
PRC
4
SALFCR
INVITG
3
PRD
HRP
MKT
2
FAS
1
1
2
3
4
5
Likelihood →
| Auditable area | Impact | Likelihood | Score | Rating | Prior audit | FY2027 plan |
|---|---|---|---|---|---|---|
| PRC Procurement & payables | 5 | 4 | 20 | High | 2 high findings | Q1 · 25 days |
| INV Inventory & warehouse | 4 | 4 | 16 | High | 1 high finding | Q2 · 20 days |
| ITG IT general controls | 4 | 4 | 16 | High | Not audited | Q3 · 15 days |
| SAL Sales & receivables | 4 | 3 | 12 | Medium | Medium findings | Q3 · 15 days |
| FCR Financial close & reporting | 4 | 3 | 12 | Medium | No issues | Q4 · 15 days |
| MKT Marketing & promotion spend | 3 | 4 | 12 | Medium | Not audited | Q2 · 10 days |
| TRS Treasury & cash | 5 | 2 | 10 | Medium | No issues | Q1 · 10 days |
| HRP HR & payroll | 3 | 3 | 9 | Medium | 1 low finding | Q4 · 10 days |
| PRD Production & costing | 3 | 2 | 6 | Low | No issues | FY2028 rotation |
| FAS Fixed assets | 2 | 2 | 4 | Low | No issues | FY2028 rotation |
- PRC Procurement & payables
- TRS Treasury & cash
- INV Inventory & warehouse
- MKT Marketing & promotion spend
- ITG IT general controls
- SAL Sales & receivables
- FCR Financial close & reporting
- HRP HR & payroll
Lower-risk areas (production costing, fixed assets) rotate into the following year. The plan is reviewed mid-year as risks change.
Want this level of visibility over your own processes?
We tailor the reporting format to your management and board.