IA-09
Findings and Reporting Kit
Rate findings, write them clearly and issue a report for management and the Audit Committee.
IA-10
Follow-up and Audit Committee Reporting Kit
Track recommendations to closure and give the Audit Committee periodic reports and KPIs.
Inside the kit
What this kit solves
A recommendation is only worth something once its implementation has been followed up and validated with evidence. 705 tracks every recommendation as implemented, partially implemented or overdue, against the full finding code, and the 706 sheets test what management has actually done. Where management decides not to implement, it signs the risk acceptance form (708). Two reports go to the Audit Committee each quarter: the follow-up report (707) and the internal audit activity report (709), covering plan progress, completed engagements, key findings and recommendation status. 710 measures the function's performance against target. The templates include a note on Audit Committee reporting for local banks and listed companies.
What your file holds afterwards
- A follow-up tracker with the status of every recommendation, tied to the full finding code (705)
- Validation sheets evidencing what management implemented (706), and a signed risk acceptance form where it chose not to (708)
- A follow-up report (707) and an internal audit activity report (709) for the Audit Committee each quarter; both templates include a note on SAMA (local banks) and CMA (listed companies) reporting requirements
- Internal audit KPIs measured against target (710)
How to use it
- Carry recommendations from the IA-09 reports into the 705 tracker with each full finding code.
- Validate implementation with evidence in 706, and document management risk acceptance in 708 where needed.
- Prepare the follow-up report (707) and the activity report (709) each quarter, showing progress against the annual plan from IA-04.
- Update the KPIs in 710 and compare them with target.
Who it is for
Audit firms and in-house internal audit departments throughout the year, once engagement reports are issued, to follow up recommendations and report to the Audit Committee.
What is in the kit
| Code | Paper | Format | What you get | Reference |
|---|---|---|---|---|
| 705 | Recommendation Follow-up TrackerReference: 15.2 | Excel | Template + worked exampleTemplate + example | 15.2 |
| 706 | Implementation Validation SheetsReference: 15.2 | Excel | Template + worked exampleTemplate + example | 15.2 |
| 707 | Periodic Follow-up ReportReference: 15.2, 11.3 | Word | Template + worked exampleTemplate + example | 15.2, 11.3 |
| 708 | Management Risk Acceptance FormReference: 11.5 | Word | Template + worked exampleTemplate + example | 11.5 |
| 709 | Periodic Internal Audit Activity ReportReference: 11.3, 8.1 | Word | Template + worked exampleTemplate + example | 11.3, 8.1 |
| 710 | Internal Audit Key Performance Indicators (KPIs)Reference: 12.2 | Excel | Template + worked exampleTemplate + example | 12.2 |
Every kit also includes a user guide (PDF and PowerPoint) and the licence terms, in Arabic and English.
IIA Global Internal Audit Standards (2024) references, with ISQM 1 and SAMA principles where they apply, as given in the guide. References are for cross-referencing and do not imply IIA endorsement.
Where it sits in the audit cycle
- 000File AdministrationIA-01
- 100Acceptance, Engagement and AdministrationIA-02
- 200Permanent and Annual FileIA-03IA-04
- 300Engagement PlanningIA-05IA-08
- 400Process Understanding and Control AssessmentIA-06IA-08
- 500Testing and FieldworkIA-07IA-08
- 600FindingsIA-09
- 700Reporting and Follow-upIA-09IA-10
- 800Advisory EngagementsReplaces 400–700 on advisory engagementsIA-11
- 900Quality Review and File ClosureIA-12
Sector notes inside the templates
- Local banks — Saudi Central Bank (SAMA)
Quarterly report to the Audit Committee on assessments, findings and management responses, and an annual report on the internal control system and performance against plan (Internal Audit Principles for Local Banks (effective 1 January 2022)) - Local banks — Saudi Central Bank (SAMA)
Electronic database of reports, findings, corrective action plans and working papers, and an approved records retention manual (Internal Audit Principles for Local Banks (effective 1 January 2022)) - Listed companies — Capital Market Authority (CMA)
The Audit Committee reviews internal audit reports, follows up corrective actions and oversees the performance of internal audit (Corporate Governance Regulations — Audit Committee duties) - Listed companies — Capital Market Authority (CMA)
The committee's annual report includes its opinion on the adequacy of internal control and risk management and is published with the General Assembly invitation (Corporate Governance Regulations — Audit Committee duties)
The affected templates carry a short line for each requirement with its reference. Check the official text of each reference before relying on it; regulations change.
Related kits
IA-04
Risk-Based Annual Audit Planning Kit
Build a risk-based annual audit plan ready for Audit Committee approval.