How should findings be supported?

Attach clear workpapers including test steps, logs, screenshots, and data extracts. Reference file names in the observation so reviewers can quickly validate evidence and replicate tests if needed.

When is eSignature legally sufficient?

Electronic signatures meet legal validity under the ESIGN Act and UETA when intent, consent, attribution, and retention are demonstrated; include consumer disclosure where applicable for consumer-facing records.

Do audit reports need notarization?

Routine internal audit observations do not usually require notarization. If a signed attestation or certification is required by a third party, follow applicable state notarization or RON rules.

What authentication should be used for signers?

Use email plus SMS or 2FA for higher-risk approvals; maintain audit trail metadata (IP, timestamp) to support signer attribution and non-repudiation.

How do we track remediation progress?

Record owner, action, and due date in the report and update status through a tracked follow-up schedule; close items only after independent verification of remediation.

How long must we retain final reports?

Retain final reports and supporting workpapers per applicable standards: at least three years for tax-related items and six years for HIPAA-related records; extend retention where litigation or regulatory inquiry is possible.

Electronic Signature
Templates
Miscellaneous
Audit Observations Report

Audit Observations Report

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

AUDIT OBSERVATIONS REPORT

Report Header

Report Number

Audit Period (Start):

Audit Period (End):

Report Date Auditor / Firm Client Name Client Address Engagement Lead (Auditor) Distribution List

Recitals

WHEREAS, Client Name: has engaged Auditor Firm: to perform an audit engagement in accordance with the terms set forth in this report; and

WHEREAS, the parties agreed the objective of the engagement is to evaluate internal controls, compliance and operational effectiveness for the audit period beginning and ending ;

WHEREAS, this Audit Observations Report sets forth the observations, supporting evidence, auditor recommendations and management responses, and when signed by the parties it serves as the final report and engagement certification for the services described herein.

Executive Summary

Scope of Work

The auditor performed tests of controls and substantive procedures reasonably necessary to form observations as set forth below. The scope included inquiry, inspection of documents, sample testing and walkthroughs limited to the audit period identified above. Any limitations to the scope are described within individual observations.

Observations (Itemized)

Observation ID Observation Title Condition (What was found) Criteria (What should be) Cause Effect / Impact Recommendation

Priority: High Medium Low

Management Response

Action Owner:

Target Completion Date:

Observation ID Observation Title Condition (What was found) Criteria (What should be) Cause Effect / Impact Recommendation

Priority: High Medium Low

Management Response

Action Owner:

Target Completion Date:

Observation ID Observation Title Condition (What was found) Criteria (What should be) Cause Effect / Impact Recommendation

Priority: High Medium Low

Management Response

Action Owner:

Target Completion Date:

Payment Terms

Compensation for the audit engagement shall be paid in accordance with the following terms. Fees are exclusive of taxes unless otherwise stated and are payable as set forth below.

Total Fee Payment Schedule Late Fee / Interest

Term and Termination

This engagement commences on Start Date: and terminates on End Date: , unless earlier terminated in accordance with this section. Either party may terminate the engagement for convenience upon providing written notice not less than days prior to the intended termination date.

Confidentiality

The auditor and client each agree to maintain the confidentiality of non-public information obtained in connection with this engagement. Confidential information shall not be disclosed to third parties except (i) with prior written consent, (ii) to the extent required by law or regulation, or (iii) to professional advisors bound by comparable confidentiality obligations. Each party shall implement and maintain reasonable safeguards to protect confidential information from unauthorized access or disclosure.

Governing Law

This report and any resulting engagement agreement shall be governed by and construed in accordance with the laws of the State of , excluding its conflicts of law rules.

Entire Agreement

This Audit Observations Report, together with any appendices and the parties' signatures below, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior proposals, communications and agreements, whether oral or written. Any amendment must be in writing and signed by both parties.

Certifications

The undersigned auditor certifies that, to the best of the auditor's knowledge, the observations and conclusions set forth in this report are accurate and based on procedures performed in accordance with the agreed scope. Management attests that the management responses are complete and that any action plans reflect management's intended corrective actions.

Auditor Name:

By:

Date:

Client Name:

By:

Date:

What an Audit Observations Report Is

An Audit Observations Report documents findings arising from an audit or review, summarizing identified issues, evidence, root causes, and recommended corrective actions. It typically includes a scope statement, a list of exceptions or control gaps, risk ratings for each observation, and suggested timelines for remediation. The report serves both as an internal record for management and as evidence of due diligence for external stakeholders, regulators, or auditors. Clear, factual presentation and supporting attachments improve the report's usefulness during follow-up reviews and when validating remediation progress.

Why a Formal Audit Observations Report Matters

A concise Audit Observations Report creates a documented trail of issues, accountability, and remediation steps so management and stakeholders can prioritize corrective actions and demonstrate compliance.

Typical Authors and Recipients

The report is prepared by audit teams and distributed to management and governance bodies for review and action.

Internal audit teams and audit managers responsible for testing controls and drafting findings.
Line management and process owners tasked with remediation and providing responses.
Boards, audit committees, external auditors, or regulators who require evidence of controls and corrective action.

Use distribution lists and version control so recipients know their responsibilities and deadlines when the report is issued.

Key Roles Who Sign or Approve

Internal Audit Manager

Prepares and approves factual content, certifies that findings reflect tested evidence, and signs to confirm the report represents the audit team’s conclusions.

Chief Financial Officer

Reviews significant control deficiencies and management responses, signs acknowledgement for financial statement-related observations, and confirms remediation commitments.

Filling Out an Audit Observations Report — Step-by-Step

Follow a standard sequence to gather evidence, draft findings, and obtain approvals to ensure accuracy and defensibility.

01

Collect Evidence: Assemble workpapers, logs, and supporting files.
02

Draft Finding: State the condition, criteria, cause, and effect.
03

Assign Owner: Identify responsible party and remediation deadline.
04

Approve & Distribute: Obtain signatures and circulate final report.

Online Workflow Settings for Completing the Report

Configure fields and authentication so the report and attachments remain auditable and tamper-evident when completed electronically.

Field	Configuration
Signature Field	Required; signer role assigned per approval step
Date Field	Auto-fill on signing; MM/DD/YYYY
Attachment	Allow PDF/ZIP for supporting workpapers
Authentication	Email link or SMS code; consider 2FA for high-risk findings

Technical Considerations for Digital Completion

Use a platform that captures an unalterable audit trail and supports secure attachments and role-based signing.

Integrations: Connectors for document storage and ticketing (e.g., NetSuite, Microsoft 365, Salesforce)
Formats Supported: PDF and DOCX input/output; preserves original attachments
Signer Authentication: Email, SMS code, or advanced authentication for sensitive reports

Ensure encryption in transit (TLS 1.2/1.3) and at rest (AES-256) and verify available audit trail metadata before committing to a platform.

Typical Distribution and Approval Flow

A standard flow ensures each observation is reviewed by the right stakeholders and that evidence and responses are recorded for follow-up.

Prepare Draft: Author compiles findings and supporting workpapers.
Internal Review: Audit manager reviews and edits draft observations.
Management Response: Owners provide remediation plans and target dates.
Final Approval: Audit lead and governance sign and distribute report.

Common Preparation Pitfalls to Avoid

Vague findings that lack evidence: reports without referenced workpapers make remediation and verification difficult and increase dispute risk.
Missing remediation owners or unrealistic deadlines: unclear accountability delays corrective action and weakens audit committee oversight.
Incomplete supporting documents: failing to attach logs, screenshots, or test steps reduces the report’s defensibility during external review.
Version control failures: circulating multiple unsynchronized drafts leads to confusion and may invalidate signed responses.

Essential Sections Every Professional Report Should Include

Standardize structure so readers can quickly locate the finding, evidence, risk rating, and remediation plan.

Executive Summary

One-page overview of the most significant observations, overall risk posture, and any high-priority actions management must address immediately.

Scope & Methodology

Define audit objectives, period reviewed, sampling approach, and any limitations affecting findings or conclusions.

Individual Observations

For each item include ID, condition, criteria, cause, effect, evidence references, risk rating, and recommended remediation actions.

Management Responses

Document management’s written response, remediation plan, owner, and target completion date for each observation.

Supporting Workpapers

Attach or link to test results, logs, screenshots, and other evidence required to substantiate the observation.

Follow-up Plan

Describe timing and criteria for re-testing or closure, including who will verify completed remediation.

Typical Timelines and Deadlines

Set clear target dates for each stage to keep remediation on schedule and to document management commitments.

Preliminary Findings Issued:

Within 7–10 business days after fieldwork completion

Draft Report Delivered:

Typically within 10 business days following preliminary findings

Management Response Due:

Commonly 14 calendar days from draft delivery

Final Report Issued:

Within 5 business days after receiving management responses

Follow-up Testing:

Scheduled within 60–90 days or per agreed remediation timeline

Key Milestones from Planning to Close

Track milestones so progress is visible and audit committee reporting is timely and consistent.

01

Planning

Define scope, objectives, and resources for the engagement.

02

Fieldwork

Execute tests, collect evidence, and log exceptions.

03

Reporting

Draft findings, obtain reviews, and circulate draft for management comment.

04

Follow-up

Verify remediation and close observations or escalate unresolved items.

How the Audit Observations Report Differs from Related Documents

Compare common document types to choose the format appropriate for the intended audience and purpose.

Criteria	Audit Observations Report	Management Letter
Purpose	operational findings	governance commentary
Audience	management & owners	board & auditors
Formality	structured findings	narrative commentary
Attachments	workpapers included	summary exhibits

eSignature Vendor Comparison for Finalizing Reports

Basic pricing and capability differences for vendors commonly used to sign and distribute audit reports. signNow is listed first per comparison conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	No	No	No	No
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No envelope cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

Security and Compliance Essentials

Encryption: TLS 1.2/1.3 in transit; AES-256 at rest

Certifications: ISO 27001 and SOC 2 Type II available

HIPAA: HIPAA-compliant with BAA option

21 CFR Part 11: Supports FDA-compliant controls

ESIGN / UETA: Meets ESIGN and UETA legal tests

Accessibility: WCAG 2.0 Level AA conformity

Consequences of Inaccurate or Late Reporting

Regulatory Penalties: Fines or enforcement action

Audit Scope Expansion: Additional testing and expense

Reputational Damage: Stakeholder distrust and scrutiny

Contractual Liability: Breach claims or indemnities

Delayed Remediation: Extended exposure to risk

Loss of Funding: Grant or covenant violations

Practical Examples of How Reports Are Used

Two real-world scenarios illustrate typical formats and outcomes when an Audit Observations Report is completed and tracked.

Public Company Internal Audit

Audit team identifies control gaps in expense approvals affecting quarter-end close

Risk rated high and quantified at $250,000
Management implements process controls and a follow-up test within 60 days to verify remediation and report closure to the audit committee.

Healthcare Compliance Review

Reviewer documents PHI access logging deficiencies in inpatient system

Observation includes redacted evidence and suggested technical fixes
IT applies access control patches and documents test results; evidence retained six years per HIPAA retention rules.

Frequently Asked Questions and Troubleshooting

Answers to common questions about drafting, signing, and managing Audit Observations Reports, and how to address typical issues during distribution and follow-up.

Need help? Contact support

How should findings be supported?
Attach clear workpapers including test steps, logs, screenshots, and data extracts. Reference file names in the observation so reviewers can quickly validate evidence and replicate tests if needed.
When is eSignature legally sufficient?
Electronic signatures meet legal validity under the ESIGN Act and UETA when intent, consent, attribution, and retention are demonstrated; include consumer disclosure where applicable for consumer-facing records.
Do audit reports need notarization?
Routine internal audit observations do not usually require notarization. If a signed attestation or certification is required by a third party, follow applicable state notarization or RON rules.
What authentication should be used for signers?
Use email plus SMS or 2FA for higher-risk approvals; maintain audit trail metadata (IP, timestamp) to support signer attribution and non-repudiation.
How do we track remediation progress?
Record owner, action, and due date in the report and update status through a tracked follow-up schedule; close items only after independent verification of remediation.
How long must we retain final reports?
Retain final reports and supporting workpapers per applicable standards: at least three years for tax-related items and six years for HIPAA-related records; extend retention where litigation or regulatory inquiry is possible.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now