The internal audit report is the final output of the cycle: it consolidates what was audited, what was found and what needs action. Clause 9.2.2 requires that the results be reported to relevant management — and the report is the evidence of that. It also feeds two mandatory destinations: the treatment of nonconformities (10.2) and the management review (9.3.2, which lists "results of audits" as an input).
The structure that works: identification (number, dates, auditors, scope and criteria); a half-page executive summary — for the management team that will not read the details: overall assessment, number of findings and the 2 or 3 points that deserve attention; the findings, classified (major NC, minor NC, observation, opportunity for improvement and strengths — yes, record what is working well: it gives credibility and engages the auditees); and a conclusion on the health of the system with next steps and deadlines for the action plans.
Two mistakes undermine reports. The first is surprise: no finding should show up in the report without having been communicated at the closing meeting; a report is not the place for revelations. The second is delay: a report published three weeks after the audit finds cold evidence and disengaged auditees, and it pushes back every action plan that depends on it. A healthy deadline is up to 5 working days after the closing meeting, with the distribution list recorded in the report itself.
The template below summarizes a real report from a day-and-a-half audit. The detailed findings follow the requirement-evidence-fact format of the audit nonconformity template linked on this page.