Can internal audit share audit reports with risk management?

author: AcadiFi Team

Answer:

Sometimes, but it should be governed by a protocol. The CAE should consider the report's intended audience, confidentiality, legal sensitivity, board or audit committee expectations, and whether risk management needs the full report or only risk themes.

Often the best compromise is structured sharing: issue categories, ratings, themes, remediation aging, and risk-register implications, with full reports limited to those who need them. If risk management has a formal role in tracking enterprise risks, audit themes can be very useful.

The key is that sharing information does not transfer ownership of the audit conclusion. Internal audit still controls its final communication and assurance opinion.