The audit report
Internal Audit → Audit Engagements → an engagement → Report
The report has two readers, and it is ordered for both.
The front is for the board and the audit committee: why the audit was performed, what it concluded, the themes running through it, and the few matters needing their decision. You write that part — it is the argument.
The body is for management: what was examined, what was found, what was not covered, and who has agreed to do what by when. You do not write that part. It is built from the engagement itself.
Written, and generated
Every section is one of two kinds, and the difference is visible in the editor.
Written sections have a text box and a prompt telling you what the section is really asking. Executive summary, key themes, matters requiring attention, background, objectives, scope, approach, basis for the opinion, conclusion.
Generated sections are marked from the engagement and cannot be typed into. Findings, what was examined, scope limitations, risk and control assessment, control strengths, the management action plan, criteria coverage, previous findings, and the evidence appendix.
They are not editable on purpose. Everything in them was already recorded during the audit — the conditions and root causes on each finding, the sample sizes on each step, the reasons steps were scoped out, the agreed actions and their owners. Retyping any of it into the report is a chance for the report to disagree with the audit it describes.
Refresh records
Findings get written and steps get signed off after you first open the report. Refresh records rebuilds the generated sections from the engagement as it stands now.
Every word you have written is kept. The refresh only touches the generated sections.
Issuing the report refreshes once by itself, immediately before it takes the snapshot — so the version the committee receives is the engagement as it stood at that moment.
What the report will not say
Some things are deliberately impossible.
It will not claim compliance. Criteria coverage reports which clauses were tested and what the testing concluded. There is no compliance column, because a column like that gets filled in. Controls being tested without exception is not compliance.
It will not print a number that overstates. Where sample sizes were not
recorded against the steps, the report says Not recorded rather than 0 — a
zero that means "we did not capture it" reads as "we found none".
It will not report an untested control as a strength. Control strengths list only steps that were both concluded without exception and signed off by the reviewer.
It will not lose a scope limitation. Every step taken out of scope appears with the reason you gave, under a statement that the opinion does not extend to those matters. Steps still incomplete at the report date appear there too.
It will not merge management's words into yours. A management response keeps its own heading, its own text, and the date it was received.
AI drafting
AI draft writes the narrative sections only — the argument, not the record.
What the model is sent, exactly: the engagement's title, scope and methodology, the audit opinion, and for every confirmed finding its title, severity, condition, cause and recommendation. That is the material an executive summary is written from, and it does leave your environment when the configured provider is external — which is why AI assistance is off until an organisation administrator consents to it, per module, in Settings.
What the model is never sent: sample sizes, control references, evidence, management responses, and draft observations that have not been confirmed. It cannot alter or invent the generated record sections, because it never writes them. It is told not to claim compliance, not to change a finding's severity, and not to paraphrase a management response into an audit conclusion.
You always review what it wrote. It is a first draft of your argument, not the report.
AI drafting requires the organisation to have consented for the audit module in Settings → AI assistance. Until then the button reports that AI is unavailable.
Issuing, and what a version means
A report is draft while you work on it, issued when it goes out, and final when it is signed off. Issuing and finalising require Chief Audit Executive permissions.
Issuing needs an audit opinion, an engagement that has started, and every step signed off — except steps taken out of scope, which will never be signed off because that is what taking them out of scope means.
Each issue snapshots the whole report as a version. That snapshot never changes, even as the engagement moves on, because it is the record of what was distributed. You can re-export any version as PDF or Word from the Versions panel. Returning an issued report to draft starts the next version.
Exports
PDF is the record. Word is the working document — audit committees redline it and management responses get pasted into it. Both render the same report; the tables appear as real tables in Word and as labelled entries in the PDF.
Reports created before this
A report opened under the earlier six-section format picks up the full structure the first time you press Refresh records. Your opinion rationale moves into Basis for the audit opinion, and the old auto-generated findings list is replaced by the full findings section. Anything you wrote yourself is kept.