# Internal Audit Engagement: [Engagement title]

> Record of one internal audit assurance engagement, from the engagement
> risk assessment and plan through the work program, evidence, findings
> and final report, to follow-up of management action plans. The
> structure is aligned with the Institute of Internal Auditors (IIA)
> Global Internal Audit Standards (GIAS), published 2024-01-09 and
> effective from 2025-01-09, referenced by domain, principle and standard
> number only. Internal control criteria use the GAO Green Book 2025
> (GAO-25-107721, US public domain). This is the engagement-level
> companion to the Internal Audit Charter and Plan
> (`compliance/internal-audit-charter-and-plan`). For an ISO 19011
> management-system audit (ISO 9001, ISO/IEC 27001 clause 9.2), use the
> Internal Audit Program (`compliance/internal-audit-program`) instead.
> The example organisation, Corvid Commerce Group plc, is fictional. Replace
> every `[bracketed]` value and every row marked *Example*. Obtain the
> standards for the normative text. This is a document format, not
> legal, audit or accounting advice.

<!--
Guidance: How to use this template
- One file per engagement. Sections 1 to 5 form the engagement plan and
  are approved by the Chief Audit Executive (CAE) before fieldwork.
  Sections 6 to 9 are completed during and after fieldwork. Section 10
  is the final engagement communication. Section 11 is updated until
  every action plan is closed or its risk is formally accepted.
- Fill section 2 (engagement risk assessment) before writing objectives.
  Objectives and scope should follow from the significant risks, not
  from last year's audit program.
- Keep the finding format in section 7 (condition, criteria, root cause,
  effect, recommendation, action plan). Findings without a root cause
  produce action plans that fix the symptom only.
- GIAS is copyrighted by the IIA. Cite standard numbers in your own
  methodology; do not copy their requirement text into this file.
- Common pitfall: a report full of detailed observations with no overall
  conclusion. Senior management and the audit committee read the
  conclusion and the rating first.
-->

## Document control

<!-- Guidance: The engagement file is the evidence that the work met the internal audit methodology. Record who planned, performed, supervised and approved it, and keep the classification consistent with the most sensitive finding. -->

| Field | Value |
|---|---|
| Document ID | [IA-2026-09] *(Example)* |
| Engagement title | [Procure-to-pay and supplier master data] *(Example)* |
| Organisation | [Corvid Commerce Group plc] *(Example, fictional)* |
| Engagement type | [Assurance / Advisory / Combined] |
| Audit plan reference | [IAP-2026 item 09] *(Example)* |
| Engagement period under review | [2026-01-01 to 2026-08-31] *(Example)* |
| Fieldwork dates | YYYY-MM-DD to YYYY-MM-DD *Example:* 2026-09-07 to 2026-10-02 |
| Final report date | YYYY-MM-DD *Example:* 2026-10-30 |
| Version | [1.0] |
| Status | [Planning / Fieldwork / Draft report / Final / Follow-up / Closed] |
| Owner | [@engagement-lead] |
| Approvers/reviewers | [@chief-audit-executive], [@engagement-supervisor] |
| Engagement sponsor (auditee) | [@group-cfo] *(Example)* |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential, internal audit] |
| Retention | [Per internal audit records policy, for example seven years] |
| Methodology version | [Internal Audit Manual v4.2] *(Example)* |

### Approvals

| Stage | Role | Name | Decision | Date |
|---|---|---|---|---|
| Engagement plan and work program | Chief Audit Executive | [@name] | [Approved] | YYYY-MM-DD |
| Work program changes | Engagement supervisor | [@name] | [Approved] | YYYY-MM-DD |
| Draft report | Chief Audit Executive | [@name] | [Released for management response] | YYYY-MM-DD |
| Management responses | Accountable executive | [@name] | [Agreed] | YYYY-MM-DD |
| Final report | Chief Audit Executive | [@name] | [Issued] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@author] | Engagement plan and risk assessment |
| 0.2 | YYYY-MM-DD | [@author] | Work program approved, fieldwork started |
| 0.9 | YYYY-MM-DD | [@author] | Draft report for management response |
| 1.0 | YYYY-MM-DD | [@author] | Final report issued |

## Contents

- [1. Engagement background and planning inputs](#1-engagement-background-and-planning-inputs)
- [2. Engagement risk assessment](#2-engagement-risk-assessment)
- [3. Objectives, scope and evaluation criteria](#3-objectives-scope-and-evaluation-criteria)
- [4. Resources, independence and timetable](#4-resources-independence-and-timetable)
- [5. Work program](#5-work-program)
- [6. Results and evidence](#6-results-and-evidence)
- [7. Findings](#7-findings)
- [8. Rating scheme](#8-rating-scheme)
- [9. Overall engagement conclusion](#9-overall-engagement-conclusion)
- [10. Final engagement report](#10-final-engagement-report)
- [11. Distribution, follow-up and risk acceptance](#11-distribution-follow-up-and-risk-acceptance)
- [12. Supervision and quality review](#12-supervision-and-quality-review)
- [13. Traceability matrix](#13-traceability-matrix)
- [Glossary and references](#glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Engagement background and planning inputs

<!-- Guidance: Purpose: show that planning started from an understanding of the area, its objectives and its risks (GIAS Principle 13). Questions: why is this engagement in the plan, what has changed since the last audit, what do stakeholders worry about? Pitfall: copying the prior-year background without checking for new systems, owners or processes. -->

Describe the area under review in plain terms: what it does, who owns
it, which systems support it and why it matters to the organisation's
objectives. Record the reason the engagement is in the annual plan
(risk score, regulatory requirement, management request or rotation)
and what changed since the previous engagement.

| Planning input | Source | Key points |
|---|---|---|
| Annual plan rationale | [IAP-2026 item 09, audit universe entity AU-FIN-04 Procure-to-pay] | [Weighted score 4.20 under the charter method (financial 4, regulatory 3, change 5, time since last assurance 5); last audited 2023] *(Example)* |
| Prior audit results | [IA-2023-11] | [Two findings, both closed; one repeated exception in supplier onboarding] *(Example)* |
| Process documentation | [P2P process narrative v3, risk and control matrix RCM-P2P] | [Narrative predates the ERP migration] *(Example)* |
| Risk register entries | [`compliance/risk-register` items R-031, R-047] | [Payment fraud; supplier data quality] *(Example)* |
| Fraud risk assessment | [`compliance/fraud-risk-assessment` scheme FRS-012] | [Fictitious supplier and bank-detail change fraud rated high inherent] *(Example)* |
| ICFR scoping | [`compliance/icfr-management-assessment`] | [Accounts payable and cash disbursement are significant accounts] *(Example)* |
| Stakeholder interviews | [CFO, Group Procurement Director, Head of Shared Services] | [Concern about manual vendor bank changes after the migration] *(Example)* |
| Other assurance providers | [External auditor interim work, second-line controls testing] | [External auditor tested three P2P controls in Q2] *(Example)* |

*Example background:* Corvid Commerce Group plc (fictional SaaS
retailer, listed in London with American Depositary Shares in New York,
IFRS reporter, functional currency EUR) migrated its German and UK
entities to a single cloud ERP in March 2026. Group Shared Services
processes about 6,000 supplier invoices a month for the German, UK, US
and Vietnamese subsidiaries. The supplier master file holds about 4,800
active suppliers. Management reported that bank-detail changes for
suppliers are now requested by email and keyed manually by two
shared-services clerks, a step that the previous system controlled
through a supplier portal.

## 2. Engagement risk assessment

<!-- Guidance: Purpose: identify the risks that matter for this area and decide where to spend audit hours (GIAS Standard 13.2). Questions: what could stop the area from meeting its objectives, how likely and severe is each risk, what controls does management rely on? Pitfall: listing every conceivable risk at equal weight, which spreads the hours too thinly. -->

Identify the significant risks to the area's objectives, including
fraud risk and IT risk, and the key controls that management relies on
to address them. Rate inherent risk before controls and an expectation
of control strength, then set the audit emphasis. Use the organisation's
own risk scale (see Risk Methodology, `compliance/risk-methodology`) so
that ratings can be compared with the risk register.

| Risk ID | Risk description | Inherent likelihood (1-5) | Inherent impact (1-5) | Inherent score | Key controls relied on | Audit emphasis |
|---|---|---|---|---|---|---|
| ER-01 *(Example)* | Fraudulent change of supplier bank details leads to misdirected payments | 4 | 5 | 20 | C-03 call-back verification; C-04 change report review | High: test design and operation |
| ER-02 *(Example)* | Duplicate or unauthorised supplier payments are made | 3 | 3 | 9 | C-06 ERP duplicate check; C-07 payment run approval | Medium: analytics over full population and targeted approval test |
| ER-03 *(Example)* | Fictitious or unapproved suppliers are created | 2 | 5 | 10 | C-01 onboarding due diligence; C-02 segregation of duties | High: test new suppliers since migration |
| ER-04 *(Example)* | Purchases bypass approved purchase orders | 3 | 3 | 9 | C-05 three-way match; policy exceptions log | Medium: full-population analytics of invoices paid without a matched PO |
| ER-05 *(Example)* | Excessive ERP access allows one user to create a supplier and release a payment | 3 | 4 | 12 | C-02 role design; C-09 quarterly access review | High: full access extraction |
| ER-06 *(Example)* | Supplier sanctions screening gaps for US and Vietnamese entities | 2 | 4 | 8 | C-08 screening at onboarding | Medium-low: walkthrough plus reliance on second-line testing in Q2 |

Inherent score is likelihood multiplied by impact on the 1 to 25 scale
of the example methodology. Risks scoring 12 or more, any risk with
impact 5, and any fraud scheme rated high in the fraud risk assessment
receive design and operating effectiveness testing (ER-01, ER-03,
ER-05). Risks scoring 8 to 11 receive targeted testing, full-population
analytics or reliance on other assurance providers whose work has been
evaluated (ER-02, ER-04, ER-06). Risks below 8 receive a walkthrough
only. These cut-offs are an example; use your own methodology.

Check whether any IIA Topical Requirement applies. When the engagement
covers cybersecurity, or relies on third parties such as an outsourced
payment provider or a cloud ERP vendor, the relevant Topical Requirement
sets minimum areas to consider; record the assessment and, if a
requirement is judged not applicable, the reason. In the example, the
cloud ERP is a third-party service, so the IT audit specialist reviews
the vendor's assurance report and the complementary user entity
controls that Corvid must operate.

Consider fraud risk explicitly. Ask how someone inside or outside the
organisation could exploit the process, which red flags would appear in
the data, and whether management override of controls is possible. The
answers drive the analytics in the work program.

## 3. Objectives, scope and evaluation criteria

<!-- Guidance: Purpose: state what the engagement will conclude on, what is in and out, and what "good" looks like (GIAS Standards 13.3 and 13.4). Questions: can each objective be answered with a conclusion? Are criteria agreed with management before fieldwork? Pitfall: criteria discovered after fieldwork, which leads to disputes over every finding. -->

### 3.1 Engagement objectives

Write each objective so that the report can answer it with a conclusion.
Tie each objective to one or more engagement risks.

| Objective ID | Objective | Linked risks |
|---|---|---|
| OBJ-01 *(Example)* | Assess whether controls over creation and amendment of supplier master data, including bank details, are designed and operating effectively | ER-01, ER-03, ER-05 |
| OBJ-02 *(Example)* | Assess whether controls prevent or detect duplicate and unauthorised payments | ER-02, ER-04 |
| OBJ-03 *(Example)* | Assess whether ERP access in the procure-to-pay process enforces segregation of duties | ER-05 |

### 3.2 Scope

| Item | In scope | Out of scope |
|---|---|---|
| Entities | [Corvid Commerce GmbH, Corvid Commerce Ltd (UK), Corvid Commerce Inc (US), Corvid Commerce Vietnam LLC] *(Example)* | [Joint ventures] |
| Processes | [Supplier onboarding and amendment, invoice processing, payment runs] *(Example)* | [Payroll, employee expenses, treasury dealing] |
| Systems | [Cloud ERP P2P module, payment bank portal] *(Example)* | [Legacy ERP archive (decommissioned 2026-03)] |
| Period | [2026-01-01 to 2026-08-31] *(Example)* | |

### 3.3 Evaluation criteria

Record the criteria against which conditions will be judged and confirm
them with management at the opening meeting. Criteria can be internal
policies, laws, contracts, the organisation's risk appetite, or a
recognised control framework. Where a framework is used, cite its
principle numbers. The GAO Green Book 2025 is used here because it is
in the public domain; organisations that use another framework under
licence cite it by name only.

| Criterion ID | Source | Criterion (summary in own words) |
|---|---|---|
| CR-01 *(Example)* | Group Procurement Policy v5, section 4 | Supplier bank-detail changes are verified with the supplier through an independently sourced contact before entry |
| CR-02 *(Example)* | Group Delegation of Authority v9 | Payments above EUR 50,000 need two approvers from the authorised signatory list |
| CR-03 *(Example)* | IT Access Management Standard v3 | Users who maintain supplier master data cannot approve or release payments |
| CR-04 *(Example)* | GAO Green Book 2025, Principles 10 and 11 | Control activities, including IT general controls, are designed to respond to identified risks |
| CR-05 *(Example)* | GAO Green Book 2025, Principle 8 | Fraud risk is considered when designing responses |
| CR-06 *(Example)* | Group Purchasing Policy v4, section 3 | Purchases above EUR 1,000 require an approved purchase order before the invoice is paid; exceptions are logged and approved |

## 4. Resources, independence and timetable

<!-- Guidance: Purpose: show that the team has the competence, time and independence to do the work (GIAS Standard 13.5, and Domain II on ethics and objectivity). Questions: has anyone on the team worked in or designed the area in the last twelve months? Do you need a specialist (IT, data, tax)? Pitfall: assigning an auditor who recently led the ERP migration project to audit its controls. -->

| Role | Name | Hours budgeted | Competence notes | Objectivity declaration |
|---|---|---|---|---|
| Engagement supervisor | [@name] | 24 *(Example)* | [Certified internal auditor] | [No conflict, signed YYYY-MM-DD] |
| Engagement lead | [@name] | 160 *(Example)* | [Five years P2P audits] | [No conflict, signed YYYY-MM-DD] |
| IT audit specialist | [@name] | 60 *(Example)* | [ERP security and access] | [Advised on ERP project roles in 2025; work limited to C-09, reviewed by supervisor] *(Example)* |
| Data analyst | [@name] | 40 *(Example)* | [Payments analytics] | [No conflict] |
| Total | | 284 *(Example)* | | |

The example total is 24 + 160 + 60 + 40 = 284 hours. Compare the
budget with actual hours in section 12.

Where an auditor has a potential impairment, record the safeguard (a
different reviewer, restricted scope or disclosure in the report) and
the CAE's decision. Coordinate with other assurance providers to avoid
duplicate testing and record whether their work is relied on.

| Milestone | Planned date | Actual date |
|---|---|---|
| Engagement notification to auditee | YYYY-MM-DD | YYYY-MM-DD |
| Opening meeting, criteria agreed | YYYY-MM-DD | YYYY-MM-DD |
| Fieldwork complete | YYYY-MM-DD | YYYY-MM-DD |
| Closing meeting, findings discussed | YYYY-MM-DD | YYYY-MM-DD |
| Draft report issued | YYYY-MM-DD | YYYY-MM-DD |
| Management responses received | YYYY-MM-DD | YYYY-MM-DD |
| Final report issued | YYYY-MM-DD | YYYY-MM-DD |

```mermaid
flowchart LR
  A[Plan: risk assessment, objectives, criteria] --> B[Work program approved by CAE]
  B --> C[Fieldwork: tests, analytics, evidence]
  C --> D[Findings drafted and validated with process owners]
  D --> E[Closing meeting]
  E --> F[Draft report and management action plans]
  F --> G[Final report to senior management and audit committee]
  G --> H[Follow-up until closed or risk accepted]
```

## 5. Work program

<!-- Guidance: Purpose: list the procedures that will produce enough relevant, reliable evidence for each objective (GIAS Standard 13.6). Questions: which control does each step test, how many items, chosen how, and who performs it? Pitfall: steps written as "review the process", which cannot be supervised or re-performed. -->

Write each step so that another auditor could re-perform it. State the
test type (walkthrough, design, operating effectiveness, analytics,
inquiry), the population, the sample method and size, and the
workpaper reference. Changes to the approved program need supervisor
approval and a note in the revision history.

| Step ID | Objective | Control | Procedure | Population and sample | Performed by | Workpaper |
|---|---|---|---|---|---|---|
| WP-01 *(Example)* | OBJ-01 | C-03 | Walk through a bank-detail change from request to ERP entry; inspect evidence of call-back | 1 walkthrough | [@lead] | WP-01 |
| WP-02 *(Example)* | OBJ-01 | C-03 | For sampled bank-detail changes, verify that the call-back used a number from an independent source and was recorded before the change | 214 changes; 40 sampled at random | [@lead] | WP-02 |
| WP-03 *(Example)* | OBJ-01 | C-04 | Re-perform the weekly change-report review for sampled weeks; check reviewer sign-off and follow-up | 35 weeks; 8 sampled | [@lead] | WP-03 |
| WP-04 *(Example)* | OBJ-01 | C-01 | For new suppliers, inspect due diligence evidence and approval before first payment | 612 new suppliers; 30 sampled, risk-weighted | [@lead] | WP-04 |
| WP-05 *(Example)* | OBJ-02 | C-06 | Run duplicate-invoice analytics over all paid invoices (same supplier, amount and date within 10 days; fuzzy invoice number) | Full population, 48,312 invoices | [@analyst] | WP-05 |
| WP-06 *(Example)* | OBJ-02 | C-07 | Inspect payment-run approvals above EUR 50,000 for two authorised approvers | 1,126 payments; 25 sampled | [@lead] | WP-06 |
| WP-07 *(Example)* | OBJ-03 | C-02, C-09 | Extract ERP user-role assignments; identify users with conflicting supplier-maintenance and payment-release permissions; inspect quarterly access reviews | All 1,904 users; 2 quarterly reviews | [@it-auditor] | WP-07 |
| WP-08 *(Example)* | OBJ-01 | C-08 | Walk through sanctions screening at onboarding for one US and one Vietnamese supplier | 2 walkthroughs | [@lead] | WP-08 |
| WP-09 *(Example)* | OBJ-02 | C-05 | Analyse invoices paid without a matched PO; inspect the exceptions log for approval of each one above EUR 1,000 | Full population, 48,312 invoices | [@analyst] | WP-09 |

Sample sizes in the example follow the internal audit manual's table
for controls that operate many times a day or weekly; they are not a
requirement of any standard. Where data analytics cover the whole
population, report the exceptions found rather than extrapolating from
a sample.

## 6. Results and evidence

<!-- Guidance: Purpose: record what each step found and point to the evidence (GIAS Standards 14.1, 14.2 and 14.6). Questions: is the evidence sufficient, reliable and relevant? Could a reviewer reach the same result from the workpaper? Pitfall: exceptions recorded in workpapers but never assessed for a finding. -->

Summarise each step's result, the number of exceptions and whether the
result leads to a potential finding. Keep the detailed evidence in the
referenced workpapers and record the evidence source (system extract,
inspected document, observation, inquiry). Inquiry alone rarely
supports a conclusion on operating effectiveness.

| Step ID | Result | Exceptions | Evidence | Potential finding |
|---|---|---|---|---|
| WP-01 *(Example)* | Call-back step exists in the procedure but the ERP allows bank-detail entry without a call-back record | Design gap | Walkthrough notes, ERP screen captures | F-01 |
| WP-02 *(Example)* | 9 of 40 changes had no call-back evidence; 3 of the 9 used the phone number given in the change-request email | 9 of 40 (22.5%) | Change log extract, call-back log | F-01 |
| WP-03 *(Example)* | Weekly change report reviewed in 8 of 8 weeks, but the report excluded changes made by the two clerks with elevated access | Report completeness gap | Report parameters, review sign-offs | F-01 |
| WP-04 *(Example)* | Due diligence and approval present for 30 of 30 | None | Onboarding files | None |
| WP-05 *(Example)* | 37 potential duplicates found; 14 confirmed duplicates paid, EUR 186,400 in total; 11 already recovered by credit note | 14 confirmed | Analytics script output, AP confirmation | F-02 |
| WP-06 *(Example)* | Two approvers present for 25 of 25 | None | Bank portal approval log | None |
| WP-07 *(Example)* | 6 users can both maintain suppliers and release payments; Q2 access review did not flag them | 6 users | Role extract, access review file | F-03 |
| WP-08 *(Example)* | Screening performed at onboarding in both walkthroughs | None | Screening tool records | None |
| WP-09 *(Example)* | 2,140 invoices paid without a matched PO; 2,121 below EUR 1,000 or logged and approved as exceptions; 19 above EUR 1,000 with no logged approval, all for legitimate goods on review | 19 of 2,140 (0.9%) | Analytics output, exceptions log | Raised as a low-rated observation in the report, not a finding |

Check the example arithmetic: 9 of 40 is 22.5%; 14 confirmed duplicates
leave 3 unrecovered after the 11 credit notes; 2,140 - 2,121 = 19 and
19 / 2,140 = 0.9%. Record the unrecovered
amount in the finding once the shared-services team confirms it.

Evidence quality matters more than volume. Prefer evidence obtained
directly by the auditor (system extracts with documented parameters,
re-performance, observation) over evidence prepared by the auditee.
When you rely on a report produced by the system, test its completeness
and accuracy first: the example change report failed this test, which
is itself part of finding F-01. Record the extraction parameters,
the date and the person who ran each query so that results can be
reproduced, and store analytics scripts with the workpapers.

## 7. Findings

<!-- Guidance: Purpose: turn exceptions into findings that management can act on (GIAS Standards 14.3 and 14.4). Questions: what is the condition, what should it be, why did it happen, what is or could be the effect, and what would fix the cause? Pitfall: an action plan that adds a review of the symptom instead of changing the control that failed. -->

Write each finding with the five attributes below, then rate it using
section 8. Validate the facts with the process owner before the closing
meeting so that the report discusses actions, not facts. Positive
observations (controls that worked well) may be recorded in the report
summary.

Ask "why" until you reach a cause that management can change: a missing
system configuration, an unclear policy, an untrained team, a resourcing
gap or a project that did not hand over a control. Group exceptions that
share a root cause into one finding instead of reporting each symptom.
Quantify the effect where possible (amount, number of items, period
exposed) and state when no loss was found, so the reader can judge the
rating. If the work suggests possible fraud, stop testing the affected
items, inform the CAE and follow the fraud response plan; do not
interview suspects within the audit.

### F-01 *(Example)*: Supplier bank-detail changes are not consistently verified

| Attribute | Content |
|---|---|
| Condition | 9 of 40 sampled bank-detail changes (22.5%) had no call-back evidence; in 3 of them the clerk used the phone number from the request email. The ERP accepts a change without a verification record, and the weekly change report excludes changes keyed by two clerks with elevated access. |
| Criteria | CR-01 (Group Procurement Policy v5, section 4); CR-04 (GAO Green Book 2025, Principle 10) |
| Root cause | The supplier portal workflow that enforced verification was not rebuilt in the new ERP; the migration project treated it as a manual control and did not update the report parameters. |
| Effect | Exposure to payment-diversion fraud, rated high inherent in the fraud risk assessment (FRS-012). No loss identified in the sample. Separately, an attempted diversion of EUR 41k through a false bank-detail request, partly recovered, was reported through the speak-up channel in 2026 and is handled under the fraud response plan (see Audit Committee Report, `finance/audit-committee-report`). |
| Recommendation | Configure a mandatory verification field and second-person approval for bank-detail changes in the ERP; correct the change report to include all users; re-verify all 214 changes made since migration. |
| Rating | High |
| Management action plan | AP-01 below |

### F-02 *(Example)*: Duplicate supplier invoices paid after the ERP migration

| Attribute | Content |
|---|---|
| Condition | Data analytics over 48,312 paid invoices found 14 confirmed duplicate payments totalling EUR 186,400; 11 were recovered by credit note before the audit. |
| Criteria | CR-04; Accounts Payable Procedure v7, section 2.3 |
| Root cause | The ERP duplicate check matches on exact invoice number only; invoices with added prefixes or spaces are not detected. |
| Effect | Cash loss until recovery and overstated expenses in the month of payment; amounts are below the ICFR materiality set for the group audit. |
| Recommendation | Extend the duplicate check to normalised invoice numbers and amount-date proximity; run the analytics monthly until the configuration is proven. |
| Rating | Medium |
| Management action plan | AP-02 below |

### F-03 *(Example)*: Segregation-of-duties conflicts in ERP roles not detected

| Attribute | Content |
|---|---|
| Condition | 6 of 1,904 ERP users hold permissions to maintain suppliers and to release payments; the Q2 2026 access review did not identify them. |
| Criteria | CR-03 (IT Access Management Standard v3); GAO Green Book 2025, Principle 11 |
| Root cause | The access review lists users by role name only; the conflict sits in two composite roles created during migration. |
| Effect | One user could create a supplier and pay it without detection. Combined with F-01, this raises the fraud exposure. |
| Recommendation | Remove the conflicting permissions; add a rule-based conflict check to the quarterly review; review the transactions of the 6 users since migration. |
| Rating | High |
| Management action plan | AP-03 below |

### 7.4 Management action plans

| Action ID | Finding | Action agreed | Owner | Due date | Status |
|---|---|---|---|---|---|
| AP-01 *(Example)* | F-01 | Configure mandatory verification field and dual approval; fix report parameters; re-verify 214 changes | [@head-shared-services] | 2026-12-15 | Open |
| AP-02 *(Example)* | F-02 | Change duplicate rule; recover the 3 unrecovered payments; monthly analytics for six months | [@ap-manager] | 2027-01-31 | Open |
| AP-03 *(Example)* | F-03 | Remove conflicting permissions; implement conflict ruleset; transaction review for 6 users | [@erp-security-lead] | 2026-11-30 | Open |

## 8. Rating scheme

<!-- Guidance: Purpose: make ratings consistent across engagements and understandable to the board. Questions: do the definitions refer to impact on objectives and to risk appetite? Does the board know what each overall rating means? Pitfall: ratings negotiated with management instead of applied from defined criteria. -->

In the example, the final report is dated 2026-10-30, so the two high
findings must be addressed by 2027-01-30 (AP-01 due 2026-12-15 and AP-03
due 2026-11-30) and the medium finding by 2027-04-30 (AP-02 due
2027-01-31): all three due dates meet the timeframes below.

Use the same scheme for every engagement in the plan year and publish
it in the internal audit manual. GIAS expects findings to be
prioritised by significance; the labels and definitions below are an
example, not text from any standard.

| Finding rating | Definition *(Example)* | Expected action timeframe *(Example)* |
|---|---|---|
| Critical | Control failure that exposes the organisation to loss, misstatement or breach beyond risk appetite; immediate escalation to CAE and audit committee chair | Immediate containment; plan within 2 weeks |
| High | Significant weakness in design or operation of a key control; risk outside appetite if not addressed | Within 3 months |
| Medium | Weakness that reduces control effectiveness but is mitigated in part by other controls | Within 6 months |
| Low | Improvement opportunity; minor deviation from policy | Within 12 months or at management discretion |

| Overall engagement rating | Definition *(Example)* |
|---|---|
| Effective | Controls are designed and operating to manage the significant risks; only low findings |
| Some improvement needed | Medium findings, no high findings; risks are managed in most respects |
| Major improvement needed | One or more high findings; one or more significant risks are not adequately managed |
| Ineffective | Critical findings, or several high findings indicating a breakdown of the control environment in the area |

## 9. Overall engagement conclusion

<!-- Guidance: Purpose: answer each objective in one or two sentences and give an overall rating (GIAS Standard 14.5). Questions: does the conclusion follow from the findings? Would a reader who reads only this section understand the risk position? Pitfall: a conclusion softer than the findings support. -->

State a conclusion for each objective, then the overall rating and the
reasoning. Mention significant positive results where they help the
reader judge the balance.

| Objective | Conclusion *(Example)* |
|---|---|
| OBJ-01 | Supplier onboarding controls operate effectively; bank-detail change controls are not effectively designed after the ERP migration (F-01). |
| OBJ-02 | Payment approval controls operate effectively; duplicate-payment prevention has a design gap (F-02); the three-way match is largely effective, with 19 unapproved non-PO invoices raised as a low-rated observation. |
| OBJ-03 | ERP role design contains segregation-of-duties conflicts that the access review does not detect (F-03). |

*Example overall rating:* Major improvement needed. Two high findings
(F-01 and F-03) together allow a single person, or an external
fraudster with a convincing email, to redirect supplier payments
without timely detection. Management has agreed actions with due dates
that close both exposures by 2026-12-15.

## 10. Final engagement report

<!-- Guidance: Purpose: communicate results to the people who must act and those who oversee them (GIAS Standard 15.1). Questions: is the report accurate, objective, clear, concise, constructive, complete and timely? Does it state the scope limitations? Pitfall: issuing the report weeks after fieldwork, so that action plans are already overtaken. -->

Use the structure below for the report issued to management, with a
one-page summary for the audit committee. Keep wording factual and
avoid naming individuals in findings.

### 10.1 Executive summary

Write one paragraph on why the engagement was performed, one on the
overall rating and the main messages, and one on what management has
agreed to do. Add the finding count by rating.

| Rating | Count |
|---|---|
| Critical | 0 *(Example)* |
| High | 2 *(Example)* |
| Medium | 1 *(Example)* |
| Low | 0 *(Example)* |

### 10.2 Background, objectives and scope

Summarise sections 1 and 3, including entities, systems, the period
reviewed and anything excluded. State any scope limitation (for example
records that were not provided) and its effect on the conclusion.

### 10.3 Detailed findings and action plans

Insert the findings from section 7 in order of rating, each followed by
the agreed management action plan with owner and due date.

### 10.4 Conformance statement

State whether the engagement was conducted in conformance with the
Global Internal Audit Standards. Make the statement only if the internal
audit function's quality assurance and improvement program supports it;
otherwise disclose the nonconformance and its effect, as the charter
requires.

*Example statement:* This engagement was conducted in conformance with
the IIA Global Internal Audit Standards, as supported by the results of
the internal audit function's quality assurance and improvement
program.

## 11. Distribution, follow-up and risk acceptance

<!-- Guidance: Purpose: make sure the right people receive the report and that actions are implemented or the residual risk is accepted at the right level (GIAS Standards 15.2 and 11.5). Questions: who confirms implementation, with what evidence? What happens when management decides not to act? Pitfall: closing actions on management's statement alone, without evidence. -->

| Recipient | Version | Date sent |
|---|---|---|
| Accountable executive (Group CFO) *(Example)* | Full report | YYYY-MM-DD |
| Process owners (Shared Services, Procurement, ERP Security) *(Example)* | Full report | YYYY-MM-DD |
| Chief Executive Officer | Executive summary | YYYY-MM-DD |
| Audit committee | Executive summary, in the quarterly internal audit report | YYYY-MM-DD |
| External auditor | Full report, on request under the coordination protocol | YYYY-MM-DD |

Follow up each action plan at its due date. Obtain evidence of
implementation and, for high and critical findings, re-test the control
before closing. Report overdue actions to the audit committee every
quarter.

| Action ID | Due date | Evidence received | Re-test result | Closed date | Closed by |
|---|---|---|---|---|---|
| AP-01 *(Example)* | 2026-12-15 | [ERP configuration change record, re-verification file] | [Pending] | | |
| AP-02 *(Example)* | 2027-01-31 | [Pending] | [Pending] | | |
| AP-03 *(Example)* | 2026-11-30 | [Pending] | [Pending] | | |

If management decides to accept a risk that the CAE believes exceeds
the organisation's risk appetite, the CAE discusses it with senior
management and, if not resolved, communicates it to the board or audit
committee. Record the decision below.

Escalation is not a penalty for management. It ensures that the people
accountable for the organisation's risk appetite make the decision with
the facts in front of them. Record the reasons management gave, the
compensating measures it relies on and the date when the acceptance
will be reviewed again.

| Risk acceptance ID | Finding | Risk accepted | Accepted by | Escalated to board | Date |
|---|---|---|---|---|---|
| RA-[NNN] | [F-NN] | [Description] | [@executive] | [Yes / No] | YYYY-MM-DD |

## 12. Supervision and quality review

<!-- Guidance: Purpose: evidence that the engagement was supervised and reviewed before conclusions were issued (GIAS Principle 12, Standard 12.3). Questions: who reviewed each workpaper, were review notes cleared, and how did actual hours compare with the budget? Pitfall: review notes cleared by deleting them rather than by resolving them. -->

| Review point | Reviewer | Date | Result |
|---|---|---|---|
| Engagement plan and work program | [@supervisor] | YYYY-MM-DD | [Approved with two added steps] *(Example)* |
| Workpapers WP-01 to WP-09 | [@supervisor] | YYYY-MM-DD | [12 review notes raised, all cleared] *(Example)* |
| Findings and ratings | [@chief-audit-executive] | YYYY-MM-DD | [F-02 changed from High to Medium after recovery evidence] *(Example)* |
| Draft report | [@chief-audit-executive] | YYYY-MM-DD | [Released] |

| Measure | Budget | Actual | Variance |
|---|---|---|---|
| Hours | 284 *(Example)* | 301 *(Example)* | +17 (6.0%) *(Example)* |
| Days from fieldwork end to draft report | 10 *(Example)* | 8 *(Example)* | -2 |
| Days from draft to final report | 15 *(Example)* | 19 *(Example)* | +4 |

Collect auditee feedback with a short survey after the final report and
feed the results into the internal assessment described in the Internal
Audit Charter and Plan (`compliance/internal-audit-charter-and-plan`).

## 13. Traceability matrix

<!-- Guidance: Purpose: show at a glance that every significant risk was tested and every finding has an agreed action. Questions: is any high risk untested? Is any finding without an action or accepted risk? Pitfall: a matrix that is filled in only at the end and never checked. -->

| Risk | Objective | Criteria | Work program steps | Findings | Action plans |
|---|---|---|---|---|---|
| ER-01 *(Example)* | OBJ-01 | CR-01, CR-04 | WP-01, WP-02, WP-03 | F-01 | AP-01 |
| ER-02 *(Example)* | OBJ-02 | CR-02, CR-04 | WP-05, WP-06 | F-02 | AP-02 |
| ER-03 *(Example)* | OBJ-01 | CR-04, CR-05 | WP-04 | None | None |
| ER-04 *(Example)* | OBJ-02 | CR-06 | WP-09 | None (low-rated observation) | Observation tracked by AP manager |
| ER-05 *(Example)* | OBJ-03 | CR-03 | WP-07 | F-03 | AP-03 |
| ER-06 *(Example)* | OBJ-01 | CR-04 | WP-08 | None | None |

## Glossary and references

<!-- Guidance: Define terms the auditee may not know and list the sources behind the criteria. Keep standards cited by name and number. -->

| Term | Meaning in this template |
|---|---|
| Assurance engagement | Objective examination of evidence to provide an independent conclusion on governance, risk management or control |
| Advisory engagement | Work agreed with management to improve processes, without an assurance conclusion |
| CAE | Chief Audit Executive, the person who leads the internal audit function |
| Condition | What the auditor found, stated as fact |
| Criteria | The standard of expected performance used to judge the condition |
| Root cause | The underlying reason the condition exists |
| Effect | The actual or potential consequence of the condition |
| Management action plan | The action management commits to, with owner and due date |
| Work program | The documented list of procedures for the engagement |
| QAIP | Quality assurance and improvement program of the internal audit function |
| Segregation of duties | Division of incompatible tasks between different people |

References (check the current official versions):

- The Institute of Internal Auditors, Global Internal Audit Standards
  (2024), effective 2025-01-09. Domain V (Performing Internal Audit
  Services), Principles 13, 14 and 15; Domain IV, Principles 11 and 12.
  Cited by number only; obtain the standards from the IIA.
- IIA Topical Requirements: Cybersecurity (effective 2026-02-05) and
  Third-Party (effective from September 2026 as reported in
  October 2026; check the date at theiia.org); apply them when an
  engagement covers those topics.
- US Government Accountability Office, Standards for Internal Control
  in the Federal Government (Green Book), GAO-25-107721, 2025-05-15,
  effective from fiscal year 2026.
- Related templates: Internal Audit Charter and Plan
  (`compliance/internal-audit-charter-and-plan`), Internal Audit
  Program, ISO 19011 (`compliance/internal-audit-program`), Control
  Testing Workpaper (`compliance/control-testing-workpaper`), Risk and
  Control Matrix (`compliance/risk-control-matrix`), Control Deficiency
  Evaluation (`compliance/control-deficiency-evaluation`), Fraud Risk
  Assessment (`compliance/fraud-risk-assessment`), Fraud Investigation
  Report (`compliance/fraud-investigation-report`), Audit Committee
  Report (`finance/audit-committee-report`), Whistleblowing Policy
  (`compliance/whistleblowing-policy`).

## Standard and licence note

Structure aligned with the IIA Global Internal Audit Standards (2024,
effective 2025-01-09), which are protected by copyright and are cited
here by domain, principle and standard number only; no text from them is
reproduced or paraphrased. Internal control criteria are based on the
GAO Green Book 2025 (GAO-25-107721), a US federal work in the public
domain, described in original wording. The template text, rating
scheme, sample sizes and the Corvid Commerce Group example are original
and fictional. Check the current official versions of the standards,
any Topical Requirements and your internal audit manual before use.
This is a document format, not legal, audit or accounting advice.
Template licence: MIT.