When should auditors communicate findings before the final report?

Auditors should communicate before the final report when the matter is significant, time-sensitive, or needs prompt management action to prevent continued exposure. Examples include active control failures, high-risk compliance gaps, potential safety or cybersecurity exposure, suspected misconduct, or issues that may change the engagement scope.

The audit team should first validate the evidence and criteria, then communicate through the approved engagement route. Interim communication does not replace the final report. It helps management act while the audit team preserves a clear record of what was found, who was informed, and what happened next.