QULDEXResources · Template
Audit report template: sections, example and what to include
What is an audit report?
The audit report is the formal record of an audit: what was examined, against what, what was found and what the auditor concludes. It is what management acts on and what the next auditor reads first.
A good report can be understood by someone who was not there. That depends less on length than on stating the scope, the criteria and the evidence behind each finding.
The conclusion and the number and grade of findings, in a few lines.
Each with its requirement, what was found, the evidence and the grade.
The overall conclusion, agreed actions, and how they will be checked.
Audit report template
Thirteen sections. The example is from an access management audit.
| Section | Example | What to write |
|---|---|---|
| Title and reference | Internal audit of access management, IA-2026-07 | Match the audit plan |
| Summary | Controls largely effective; 2 minor nonconformities, 1 observation | The conclusion in a few lines |
| Objectives | Confirm access controls operate as designed and meet ISO 27001 | From the audit plan |
| Scope | Head office and cloud production; HR and IT operations; 1 Apr to 30 Sep 2026 | What was and was not covered |
| Criteria | ISO/IEC 27001:2022; access control policy v3 | What was audited against |
| Audit team and auditee | Lead auditor, auditor; head of IT operations | Who took part |
| Dates and locations | 12 to 15 Oct 2026; on site and remote | When and where |
| Method and sampling | Interviews, record review; 25 joiners, 25 leavers | How evidence was gathered |
| Findings | F-01 minor: 3 of 25 leavers with active accounts | One entry per finding, with evidence |
| Good practice noted | Access requests fully ticketed | What worked well |
| Conclusion | The system conforms, subject to the two nonconformities | The extent to which criteria are met |
| Agreed actions | CA-2026-031 and CA-2026-032, owners and dates | Reference the CAPA log |
| Distribution and limits | Audit sponsor, head of IT; based on sampling | Who receives it, and the sampling caveat |
The example values are illustrative. Copying pastes the table as rows and columns into a spreadsheet or document.
How do you fill it in?
- Write the findings first
Each with its requirement, what was found and the evidence.
- Grade them consistently
Using the criteria agreed before the audit.
- Draft the conclusion from the findings
It should follow from them.
- Add the summary last
A reader should get the result from the first page.
- Agree the facts at the closing meeting
Then issue the report on the date in the plan.
What goes wrong most often?
Findings without evidence
The report says a control is weak but not what was seen.
Instead: state the sample and the result.
Conclusion that does not follow
The summary is positive though the findings are serious.
Instead: derive it from the findings.
No sampling caveat
Readers assume everything was checked.
Instead: say the audit was based on samples.
Do you need a template at all?
Plan, test, record findings and report in eight phases, with every step recorded against the audit.
Audit report template: common questions
What should an audit report include?
Objectives, scope, criteria, the audit team, dates and locations, methods, findings with evidence, conclusions, agreed actions, the distribution list and a statement that the audit was based on sampling.
How long should an audit report be?
As long as it needs to be for each finding to be understood and acted on. A clear two-page report is better than a long unclear one.
Who receives the audit report?
The audit sponsor and the management of the area audited, as set out in the audit plan.
Is this template free?
Yes. It is on this page, with no form to fill in.
Draft, review and issue the report from the audit record
The record lives with the audit, linked to its controls, findings and report.