c) Differences between internal and external auditors’ reports on internal control deficiencies:

• External auditor’s report:
  The external auditor’s report to management only details significant deficiencies in the internal control systems that have come to the auditor’s attention as part of their normal audit procedures. It is not a comprehensive list of all deficiencies, reflecting the auditor’s broader role focused on the accuracy of the financial statements. External auditors only review internal controls insofar as they impact the reliability of financial reporting.
• Internal auditor’s report:
  Reporting on internal control deficiencies is one of the main roles of the internal audit function. They carry out tests on systems and controls according to the needs of the business to ensure effective control and use of resources. Internal auditors may conduct a series of assignments, focusing on specific operational aspects of internal controls.
• Differences:
  Internal auditors have a wider scope and focus compared to external auditors. They not only look at financial reporting but also at operational efficiency, risk management, and compliance with company policies. Their reports typically contain a more detailed analysis of deficiencies, including a broader range of control issues than just those affecting financial reporting. Internal audit reports often include:
  • Executive summary: Summarizing the objectives of the assignment and major findings.
  • Body of the report: Detailing the work done, observations made, and recommendations given, including timelines for implementation.
  • Appendices: Containing the tests carried out, results, and potential impacts of the deficiencies.