Internal audit reports are an indispensable management tool, acting as the "immune system" that helps businesses detect risks and optimize operational processes. In the context of modern management, compliance with reporting standards is not only a legal responsibility. Decree 05/2019/ND-CP It is also a measure of the organization's control capabilities.
According to statistics from inspections, over 401 businesses have not completed their internal audit reports to the required standards, leading to financial errors and compliance risks. Understanding the structure and approval authority helps the board of directors gain an objective view of the company's current situation. Let's explore the details of current legal regulations to optimize this process.
The importance of internal audit reports in corporate governance.
An internal audit report is not simply a list of violations, but a strategic document providing concrete evidence of the effectiveness of the control system. This document helps managers identify gaps in accounting, tax, and operational processes early on, before they become serious problems.
The presence of a high-quality internal audit report enhances transparency and strengthens investor and regulatory confidence. For listed companies, this is a mandatory requirement to ensure legal compliance and sustainable financial safety.
What information must an internal audit report include according to the law?
According to Article 16 of Decree 05/2019/ND-CP, internal audit reports must be prepared promptly and completely after the completion of each audit. The content of the report must ensure honesty, objectivity, and be accompanied by specific evidence to support supervisory work.
Required components of the report content
A properly prepared internal audit report should clearly present the following key elements:
- Audit content and scope: Clearly define the audited entity (department, project, process) and specific timelines.
- Assessment and conclusion: Provide comments on the appropriateness and effectiveness of the control system and the basis for these comments.
- Errors and violations: Details of existing weaknesses, accounting and tax violations, or internal regulations were discovered during the audit.
- Suggested solutions: Propose a plan to thoroughly correct errors and handle violations, with a specific deadline for completion for the unit.
- Suggested improvements: Measures to streamline business processes and improve risk management policies to suit the actual situation.
The report requires critical analysis.
Internal audit reports are required to include the opinions of the management of the audited department. This is a crucial point to ensure fairness and a multi-faceted perspective. This allows for open dialogue among all parties regarding audit findings.
In cases where the audited department disagrees with the findings, the internal audit report must clearly state the points of disagreement and the specific reasons. This helps higher management gain a comprehensive view to make the most objective decisions.
| No. | Content components | Request details |
| 1 | Scope of audit | The time frame and target audience must be clearly defined. |
| 2 | Audit conclusion | Based on evidence (vouchers, receipts, observations) |
| 3 | Recommendation | It must be feasible and have a deadline. |
| 4 | Unit's response | Acknowledge the explanations provided by the audited party. |
Authority to sign and approve internal audit reports
Identifying the person responsible for signing the internal audit report is a crucial legal issue in determining the validity of the document. Decree 05/2019/ND-CP provides very specific regulations on this matter, depending on the organizational structure of the audit department.
For internal audit departments that perform audits in-house.
When a company organizes its own internal audit, the internal audit report must be signed by the Head of the Audit Team, the Team Leader, or the person in charge of the audit. These individuals are primarily responsible for the accuracy of the data and opinions presented in the report.
Signing an internal audit report demonstrates the auditor's commitment to professional ethics and independence. This signature confirms that the audit process has followed the correct procedures and applicable professional standards.
For cases where services are outsourced.
If a business hires a professional organization, the internal audit report must at least be signed by the legal representative or authorized person. Furthermore, the report must bear the official seal of the service provider to ensure its validity.
Additionally, depending on the agreement between the parties, the internal audit report may include the signatures of other key members. This helps to increase the credibility and joint liability of the external audit team for the results of their work.
Annual internal audit report
Unlike individual audit reports, the annual internal audit report is a summary of the results of plan implementation for the entire fiscal year. This report must be signed by the person in charge of internal audit at the unit.
The deadline for submitting the annual internal audit report is within 60 days of the end of the fiscal year. This report must be submitted to the Board of Directors, the Supervisory Board, and the General Director for periodic evaluation of the control system.
Regulations on internal auditing in enterprises
Internal auditing is legally mandated for certain types of businesses. Understanding the scope of application helps businesses ensure compliance and avoid administrative penalties from regulatory authorities.
Entities required to conduct internal audits
According to Article 10 of Decree 05/2019/ND-CP, the following entities are required to prepare and archive internal audit reports:
- Companies listed on the stock market.
- State-owned enterprises that own more than 50% of charter capital are considered parent companies.
- State-owned enterprises act as parent companies within large corporations and conglomerates.
Businesses not on the above list are still encouraged by the government to conduct regular internal audits. This helps businesses improve their risk management capabilities, self-detect errors, and increase the efficiency of capital utilization.
Methods for implementing internal audit work.
Businesses can establish a dedicated department or hire a qualified independent auditing firm. Regardless of the method chosen, the preparation of internal audit reports must ensure independence, objectivity, and absolute confidentiality of information.
For businesses under the defense and public security sectors, this process follows separate guidelines from the Minister in charge. This aims to ensure the specificity of national security during the inspection and planning process. Internal audit report.
Internal audit report preparation process
To ensure that an internal audit report meets professional standards, the audit team needs to adhere to a scientific process. This process spans from evidence gathering to the rigorous compilation of accounting and tax data.
Step 1: Gather and verify evidence
Auditors need to collect original documents, financial statements, and internal regulations. Verifying the validity of these figures is a prerequisite for writing a highly persuasive internal audit report for management.
Understanding current tax regulations and Vietnamese accounting standards (VAS) is crucial at this stage. All assessments in the internal audit report must be directly compared with the relevant legal documents.
Step 2: Risk analysis and assessment
After obtaining the data, the audit team conducts an analysis of the material risks affecting operations. These findings will be presented clearly in the internal audit report according to priority levels: High, Medium, and Low.
Step 3: Draft and finalize the report
The process of drafting an internal audit report requires the use of professional language to avoid misunderstandings. The report must strike a balance between identifying errors and proposing sustainable solutions that deliver added value.
Common mistakes when preparing internal audit reports.
In reality, many organizations face difficulties that prevent internal audit reports from fulfilling their purpose. Common mistakes include superficial content, only stating symptoms without analyzing the root causes of system errors.
Another error is the lack of supporting evidence or recommendations that are impractical and not aligned with actual resources. In particular, errors regarding the authority to sign internal audit reports, as stipulated in Article 16 of Decree 05, can invalidate the report's legal validity.
Internal audit reports and their connection to tax administration.
Internal audit reports are key to ensuring the safe operation of businesses in a volatile business environment. Full compliance with the content and signature requirements of Decree 05/2019/ND-CP is a solid foundation for development. From defining the scope of the audit to adhering to the regulations regarding the signature of the audit team leader, every detail needs to be standardized to ensure the highest legal validity and applicability.
If your business needs a professional solution for preparing a standardized internal audit report, contact MAN – Master Accountant Network today. We provide comprehensive internal audit services, helping you identify risks and optimize operations with our team of experienced professionals. Let MAN be your partner in ensuring your business's peace of mind and sustainable prosperity!
Other services
- Financial statement audit services
- Internal audit services
- Internal Control System Assessment Service
- Auditing services on request
- Professional tax audit services
- Construction auditing services
- Completed project settlement audit service
Service contact information at MAN – Master Accountant Network
- Address: No. 19A, Street 43, Tan Thuan Ward, Ho Chi Minh City
- Mobile/Zalo: 0903 963 163 – 0903 428 622
- Email: man@man.net.vn
Content production by: Mr. Le Hoang Tuyen – Founder & CEO MAN – Master Accountant Network, Vietnamese CPA Auditor with over 30 years of experience in Accounting, Auditing and Financial Consulting.
Frequently Asked Questions about Internal Audit Reports
What is the deadline for submitting the annual internal audit report?
The person in charge must submit a consolidated annual internal audit report within 60 days of the end of the fiscal year to the relevant management authorities.
Are private businesses required to prepare internal audit reports?
If it is a listed company, private enterprises are required to do so. If it is not listed, the law encourages it to do so to optimize internal governance and prevent risks.
Is it permissible to completely outsource the preparation of internal audit reports?
Yes, businesses can hire a professional firm, provided they ensure independence and comply with legal regulations regarding signatures and seals in internal audit reports.
