Internal Audit Reports: The 5 C’s
Internal audit reports are often known for adhering to the 5 C’s reporting requirement. A complete, sufficient internal audit often ends with a summary report that communicates answers to the following questions:
- Criteria: What particular issue was identified, and why was the internal audit necessary? Is the internal audit in preparation for a future external audit? Who requested the audit, and why did this party request the audit?
- Condition: How as the issue in relation to a company target or expectation? Does the company have a policy that was broken, a benchmark that was not met, or other condition that was not satisfied? Is the company confident no issue exists, or do they believe an issue is at hand?
- Cause: Why did the issue arise? Who was involved, what processes were broken, and how could the issue have been avoided?
- Consequence: What is the outcome of the problem? Are issues limited to internal matters, or are there risks of external consequences? What is the financial implications of the issue?
- Corrective Action: What can the company do fix the problem? What specific steps will management take to resolve the issue, and what type of monitoring or review will occur after solutions have been put in place to ensure a fix has been implemented?