Contents
- objective, scope, criteria,
- dates, duration, audit team and people interviewed,
- the evidence examined and the sampling information,
- classified findings — major, minor, observation,
- practices seen to work well,
- overall conclusion and recommendations for the next audit,
- areas excluded from scope and why.
Why the last item matters
If what was left out is not stated, the report reads as if it speaks for the whole system. “Contractor processes were out of scope for this audit” makes the report honest and sets the agenda for the next programme.
Who reads it
The report is written for two readers at once: the process owner who will close the finding, and the management that will allocate resources. So it must be both concrete and summarisable: detailed findings, a short conclusion.
What does not go in
- blaming individuals — a finding is about the process, not the person,
- impressions without evidence,
- the auditor's suggested fix written as if it were a requirement.
After the report
The report starts the corrective action process and becomes an input to the management review. An audit report never discussed at a management review is a piece of work filed away.