Türkçe English



PUBLIC INTERNAL AUDITING

REPORTING STANDARDS

I. INTRODUCTION

Public internal auditing reporting standards were determined by Internal Audit Coordination Board (IACB-Board) as per item (a) of the first paragraph of Article 67 of Law No. 5018.   

In accordance with Article 43 of By-Law on Working Procedures and Principles of Internal Auditors, the internal audit units and the internal auditors are obliged to abide by these standards with regard to reporting.

Internal audit units regulate the issues regarding reporting in their own internal audit charters in compliance with these standards.

II. TYPES OF REPORTS

            Following reports are provided as per their subject after each internal audit activity:

  • Audit Report which is prepared as a result of all kinds of audit activity (compliance, performance, financial, information technology and system audit) performed by internal auditors

  • “Examination Report which is prepared as a result of examinations and researches performed by internal auditors within the scope of consulting activities and studies regarding the determination of irregularity and corruption.

  • “Internal Audit Accountability Report which includes annual activity results of Internal Audit Unit.

A. AUDIT REPORT

1. Reporting Principles

Each internal audit activity is recorded with a report.

In reporting the following principles shall be abided by:

  • The aim, scope, results of the audit and the auditor’s opinion shall be stated in the report.

  • The expressions in the report shall be accurate, impartial, objective, clear, concise, constructive and complete. 

  • Expectations, perceptions and needs of the relevant directors shall be taken into account.

  • If there are previously reported findings and recommendations, information related to these may be included.

  • A summary shall be prepared for each report.

  • The report shall be reviewed by considering the principles of completeness, accuracy, compliance and readability before submitted.

  • Reports shall be submitted to the administration within an optimum time that will add value to the administration by considering issues such as significance of identified risks and urgency of measures. According to the nature of the work, the issues that are considered to meet the needs and should be notified with priority in terms of timing, if any, shall be indicated in the interim reports until the main report is issued.

  • The documents that constitute basis for the opinion of the auditor shall be annexed to the report. 

  • Good practices that are determined in the course of the audit shall be indicated in the reports in a separate section.

  • Reports shall be prepared in copies that will cover the necessary number considering the places where the report will be sent such as the audited unit, top management, and internal audit unit and the addressees of the report shall be indicated on distribution lists.

  • In the event that any serious missing points or error is found in final report after its submission,   chief audit executive shall communicate the correction note written by the relevant internal auditor to all parties that the report has been sent to. 

  • Audit reports shall include the statement of “The audit has been conducted in accordance with the Standards for Professional Practice of Public Internal Auditing”. However, this statement can only be used on condition that assessment of quality improvement program of the internal audit unit/activity is carried out within the scope of the standard No. 1312 and as a result of the evaluation its compliance with the standards is confirmed. In the event that any conflict with the above mentioned standards in the course of the execution of the audit arise, the standards which have not been properly complied with, the reasons of the conflict and the effect of the conflict on the engagement shall be stated in the report as special case explanation.     

  • Confidentiality principle shall be considered with regard to issuing, presenting and keeping of the reports.

2. Principles for report writing

The following principles should be respected while writing the reports:

Accuracy: means that the report must be based on facts. For this purpose, information in the report is obtained from working papers and audit file containing audit findings.

Impartiality: means unbiased communication of observations, findings, conclusions and recommendations in a factual and impartial way that is free from distortion.

Clarity: means that reports present sufficient information in an understandable way and unnecessary technical language is avoided.

Quantification; means that the tests performed, samplings and comments are comparable to the maximum extent possible and can be quantified.

 

Conciseness: means that rather than long explanations, the issue is presented in a short way to the extent that it is understandable.

Constructive: this is related to the tone of the language to be used in the report and the emphasis. Rather than criticizing persons and the past actions, the attitude should be towards the evaluation and improvement of the system.

Completeness: means that the report is written in a way that does not require any additional explanation or oral comment.

Timeliness: means that reports shall be prepared and submitted to the administration within an optimum time that will add value to the administration.

Resolution: means that the report should contain recommendations showing what is to be corrected when in line with the findings.  

3. Scope and format of the report

Audit report shall include the purpose, scope and the results of the audit at minimum. The recommended report format is as follows.

a) Report cover

            The first page of the report is the report cover (Annex:1). Report cover shall include the following;

  • Name of the internal audit unit,

  • Name of the audited entity/subject,

  • Name of internal auditor or auditors as well as the one who is responsible for supervision of the audit, if any,

  • Number of the report,

  • Date of the report.

b) Report presentation page

             Report presentation page which is no more than one page that shall follow the report cover (Annex:2). The following shall be included in the Report presentation page;

  • The name of the person that the report is addressed to,

  • Date of the report,

  • Type of the audit,

  • Term, subject and scope of the audit,

  • The statement of “The audit has been conducted in accordance with the Standards for Professional Practice of Public Internal Auditing” or a special case explanation which includes conflicts with the above mentioned standards, if any, the standards which have not been properly complied with, the reasons of the conflict and the effect of the conflict on the engagement,

  • The information that final report also includes comments and responses obtained during interviews and meetings (date of the closing meeting may be stated) after the draft report,

  • Stating that the monitoring process will start as of communication of the report by providing the time and that during this period, whether responsibilities are fulfilled or not will be monitored,

  • Concrete statements such as “adequate”, “requires correction/improvement” or “requires attention of management” determined as a result of the audit,

  • On condition that it is necessary, “appreciation” note for the responsible behaviour of audited unit’s personnel and the information they provide,  

  • Name and signature of each auditor who has participated in auditing.

c) Distribution list

            Distribution list that includes information on titles and addresses of persons such as audited entities, head of public administration, chief audit executive who can ensure that necessary measures related to the report are taken shall follow the report presentation page (Annex:3).

d) Report summary

The following are included in report summary that includes significant information of the report (Annex:4);

  • “Introduction” section composed of the legal framework, aim, scope and method of audit,

  • “Risk Assessment” section composed of identified risks, the risk code if any, key findings and risk levels,

  • “Audit Findings and Recommendations” section composed of audit findings, recommendations, management’ response and action plan,

  • “Response to the Report and Action Plan” section composed of responses of the audited entity.

  • “Issues of conflict” section which includes the issues that have not been agreed upon within the scope of findings and recommendations as well as the responses given upon the report and which includes the action plan and final opinions of the auditor on these matters,

  • “Strengths and Weaknesses” section regarding the audited entity.

 

            e) Body of report

            Body of report consists of the following at minimum;

  • “Introduction” section which includes the description of aim and scope of engagement as well as a brief information about the audited entity,

  • Following subsections under the title of “Findings” section for each finding which is considered that it should be included in the report (Annex:5);

a.       “Findings” section where the identified problems are orderly disclosed as per their significance level,

b.      “Causes” section where the source of findings are put forward,

c.       “Risks and Impacts” section which indicates to the risks that the organization is exposed to and their impact,

d.      “Criteria” section which explains the desired situation within the framework of relevant legislation, standards and good practices,

e.       “Recommendations” section which includes recommendations with respect to the results of the audit,

f.        “Response to the Report and Action Plan” section which includes the responses of the audited entity and the action plan,

g.       “Issues of conflict” section which includes the issues that have not been agreed upon within the scope of findings and recommendations as well as the responses given upon the report and which includes the action plan and final opinions of the auditor on these matters,

  • “Evaluation and Conclusions” section composed of summary of any additional and final considerations

      The following may also be included in the body of the report;

  • Information related to previously reported findings and recommendations,

  • Good practices related to the audited activities,

  • Other issues that are deemed to be important

f) Annexes

One copy of documents supporting the findings, sampling and tests in the report shall be included in the annex of the report. The annexes shall be given number and an annex list is added before the annexes.

4. Interim report and draft report

In the event that there is a requirement for the communication of information to be used in an urgent transaction, a change made on the audited activity or in the event that the audit task lasts for a long period of time; interim reports may be issued in order to inform the head of administration and the chief audit executive on the general course of the task. Interim report is not subject to any specific format. However the issuance of interim reports does not eliminate the requirement of issuing a final report upon the completion of the task.

The findings shall be communicated to the audited entity in the completion stage of the audit to be evaluated in closing meeting. The internal auditor shall prepare a draft report following the negotiations regarding the findings conducted between the auditor and the audited entity in closing meeting.

5. Presentation of the reports and monitoring

The internal auditor shall submit the audit report to the manager of the audited entity to be replied within a certain period of time. The unit manager shall prepare a response to the report by taking into consideration the opinions of the employees and relevant parties if deemed necessary and send it to the internal auditor.

In the occurrence of a disagreement between the internal auditor and the manager of the audited entity on the significance and level of risks, the internal auditor shall add his/her evaluation on this issue in the report.

In the event that the internal auditor and the manager are of the same opinion on the significance and level of risks, they shall decide on a reasonable period of time for taking measures.

Internal auditor submits the final report together with the responses received from the audited entity and relevant evaluations as annexed, to the head of administration by means of internal audit unit. Chief audit executive is responsible for communicating the final report to the concerned authorities.

Following the evaluation of the reports by the head of administration, the reports shall be submitted to the units mentioned in the report and strategic development units for due action.

Head of administration monitors whether the measures stated in the report have been taken or not. Head of administration may carry out this task by means of internal audit unit as well.

Actions taken following the reports or the reasons for not taking any due action shall be sent to internal audit unit to be communicated to the internal auditor.

            Report summary which is prepared in compliance with the format included in Annex:4 shall be sent to IACB by the head of administration in two months following its submission to the head of administration together with the actions taken following the report.    

Without the consent of the chief audit executive, internal audit reports cannot be disclosed to any external parties except for the IACB.

     

            B. EXAMINATION REPORT

1. Cases in which examination report is issued

Examination report is issued after the following activities;

  • Examinations and researches performed within the scope of consulting activities,

  • Examinations performed with regard to irregularity and corruption claims and detection,

  • Audit program, individual assignments or examinations and researches that are conducted if deemed necessary by the internal auditor.

2. Principles

Reporting principles included in section II-A-1 are taken into account while preparing examination reports. Report writing principles in section II-A-2 are also taken into account while writing above mentioned reports. 

3. Scope and format of the report

Scope and format of the examination reports, the actions taken following the reports as well as the other issues are provided below.

a) Report to be issued following the consulting activities

Examination report is issued following the consulting activities which are executed in line with the defined work program upon the approval of the head of administration in the fields that are identified in internal audit charters.  (Annex:6).

Following information is provided in this report;

  • Purpose, nature and scope of the engagement as well as the expectations of engagement clients and the term of the engagement,

  • Whether the engagement is performed within the scope of the annual program or upon a request which is outside the scope of the program,

  • Studies and analyses conducted, the methods, recommendations and supports provided by the experts,

  • Findings and evaluations as the results of the engagement as well as the opinions and recommendations,

  • The problems regarding the internal control, risk management and management processes which are outside the scope of the engagement but which need to be notified to the top management.

  • Information about risk and control which are obtained during the execution of the engagement and which may be evaluated at following audits,

  • General evaluation and result.

Interim reports may be issued in urgent and special cases. However, writing an interim report does not remove the requirement for writing examination report at the end of the engagement.

The reports issued following the consulting activity shall be submitted to the head of administration by means of internal audit unit.

Internal audit unit shall monitor the results of the engagement to the extent that an agreement is reached between the unit and the engagement clients. 

b) Report on irregularity and corruption findings

Examination report shall be issued following the communication of findings in audit regarding irregularities and corruption to the head of administration and examination of the claims in denouncements and complaints received by internal audit unit (Annex:7).

Following information is provided in report;

  • Findings, evidence and other information regarding irregularity and corruption,

  • Explanations of those whom the information has been provided from,

  • Nature and size of irregularity and corruption,

  • The results of the findings and evaluations, recommendations, measures to be taken and other operations to be carried out,

  • Information on risk and control which have been determined with regard to the subject of the examination and which could be evaluated in preparation of the audit program as well as the opinion of the auditor thereof.  

The reports shall be submitted to the head of administration by means of internal audit unit. Chief audit executive is responsible for communicating the report to the concerned authorities.

Internal audit unit shall monitor the transactions performed in the report and the results thereof.

Special provisions envisaged in the legislation with regard to the submission of the reports regarding the criminal acts to the authorities are reserved.  

c) Reports regarding research and examination

Examination report is issued as per the annual audit program and separate assignments which are outside the scope of the program or as a result of the examinations and researches performed independently (Annex:8).

Examination report shall be issued by the internal auditors so that the following elements are communicated to the concerned authorities,

  • Evaluations and recommendations regarding the improvement of national legislation as a result of examination of the international standards and best practices,

  • Professional and scientific studies with regard to the subjects such as internal audit, risk management, internal control and management processes,

  • Measures to be taken and recommendations regarding the works to be carried out towards the prevention and elimination of corruption and irregularities in public sector,

Following information is provided in the reports on researches and examinations;

  • Basic information on the subject,

  • Nature and scope of the research or examination,

  • Relevant legislation, standards and criteria,

  • Analyses and methods,

  • Views and opinions of those asked,

  • Evaluations,

  • Results and recommendations,

  • Other issues which are deemed necessary.

Internal auditors submit the reports they have issued as a result of the examinations and researches they have performed to the internal audit unit. Chief audit executive is responsible for communicating research and examination reports to the concerned authorities.

  

            C. INTERNAL AUDIT ACCOUNTABILITY REPORT

Internal audit accountability report is issued annually following the internal audit activities.  

1. Principles

Reporting principles included in section II-A-2 are taken into account while preparing internal audit accountability report. Reporting principles included in section II-A-2 are taken into account while writing above mentioned report.

2. Scope and format of report

The report shall include the following information;

  • All audit activities including those performed outside the scope of the program,

  • Significant findings and recommendations with regard to the audit,

  • Recommendations that have not been approved and implemented together with the statement of doing so,

  • Information on consulting services,

  • Information on the training of the internal auditors,

  • Information on the performance of internal audit unit,

  • General evaluation on the management and control system of the administration significant risks, problems and recommendations,

  • Information about internal and external assessments within the framework of quality assurance and improvement program,

  • Other issues requested by head of administration and board of directors, if any,

  • Other activities.

Format of the internal audit accountability report is as follows (Annex: 9):

a) Report cover

            The following are included in the report cover;

  • Name of the internal audit unit,

  • Emblem, logo of the relevant administration and internal audit unit,

  • Date of the report.

b) General information

Brief information on mission and vision of internal audit unit, human resources, physical resources, other resources related to budget and audit as well as findings and evaluations included in external audit reports and general information about organizational structure of the administration is included.   

c) Aims and objectives

Strategic goals and objectives, priorities of the activity year and main principles and policies which are followed by the internal audit unit are included.    

d) Information and evaluations regarding the activities

i- Audit activities: Audits which are executed under internal audit plan and program as well as the audits which are recommended to be performed outside the scope of the program by IACB in a way that it shall include information with regard to completion and continuation thereof are included.

ii- Findings and recommendations: results of internal audit activities as well as the significant findings and recommendations are included.

iii- Issues of conflict: any difference in the opinions between the head of administration and internal auditor raised during the activity term and the way these conflicts have been settled and those which have not been settled yet are included. 

iv- Consulting activity and other activities: consulting activity and other activities executed under internal audit plan and program in a way that it shall include information with regard to completion and continuation thereof are included.

e) Information on performance

Information obtained during internal and external assessments which are performed within the framework of quality assurance and improvement program is included.

In the event that any study towards the assessment of the activities of internal audit unit such as inquiries, interviews, group discussions, observations, analyses of stakeholders or current situation as well as other methods such as benefit/cost, cost/efficiency analyses are made; the finding of these activities shall be included in this section.

Information about findings and recommendations which have not been approved and implemented as per its quality and quantity are included in this section.

f) Evaluation of capability and capacity of internal audit

Strengths and weaknesses of the internal audit unit within the framework of medium and long term targets which are stated in the strategic plan of the administration are included. 

g) Risks, risk management, management and control systems of the administration

Following are provided in this section during the relevant activity term;

  • Findings relevant to the risks which have been identified by the administration,

  • Efficiency and adequacy of existing controls against the risks,

  • Newly defined risk areas, their possible impacts and recommendations for minimizing these risks, 

  • Opinions and recommendations regarding the establishment and improvement of internal control, risk management and management systems.

h) Training activities

Information on all training activities (such as in-service, professional and abroad trainings as well as the academic studies) which the internal auditors have participated to both as trainers and trainees during the concerned activity term is included.

ı) Recommendations and measures

Considering the results of the activity year as well as the general economic conditions, budgetary means and expectations, suggestions regarding changes in activities which internal audit unit plans to perform in the forthcoming years, changes in its targets as well as the possible risks and the measures to be taken against these risks are included. 

3. Submission of the report

Internal audit activity report to be issued annually shall be sent to the Board by the head of administration by the end of February.

Chief audit executive is responsible for communicating the report to the concerned persons.