How to read a public audit report

Two kinds of audit

Public audit offices do two broad kinds of work. Financial audits check an organisation's accounts each year and end in an audit opinion. Performance or value-for-money audits look at whether a programme or contract achieved what it set out to do at a fair cost. The UK National Audit Office (NAO) says it gives an independent audit opinion on around 400 accounts a year and publishes around 60 value-for-money reports a year ⁴.

In the United States, GAO sets Government Auditing Standards, known as the Yellow Book, which cover financial audits, attestation work and performance audits. The 2024 revision applies to audits of periods beginning on or after 15 December 2025 ¹.

Annual audits and special audits

Annual audits recur on a fixed cycle, such as the NAO's yearly work on government accounts ⁴. A special audit is a one-off review of a single subject, often on request. The Auditor General of Canada's ArriveCAN audit began after the House of Commons passed a motion on 2 November 2022 asking for it ⁶.

The Philippines Commission on Audit publishes Annual Audit Reports for national government agencies, local government units and government-owned or controlled corporations ⁸.

Scope and objective

The scope tells you what the auditors looked at and what they left out. Read it first. The Auditor General of Canada's June 2025 report on GC Strategies covered 106 contracts from 13 April 2015 to 31 March 2024 and listed four contracts it counted in its totals but did not examine ⁹. A finding cannot reach beyond the scope, so a gap in scope is not a clean bill of health.

Criteria, condition, cause and effect

Under the Yellow Book, a finding is built from four elements. The Louisiana Legislative Auditor's guide, which cites the Yellow Book, defines the condition as "the situation that exists," the criteria as "the standard that the condition violates," the cause as the reason or explanation given by the auditee and the effect as "the impact of the condition" ².

When you read a finding, look for each part. A finding with a clear condition and no stated criteria tells you what happened but not which rule was broken. In the ArriveCAN report, the condition was missing cost records, and the auditors estimated a cost of about $59.5 million in place of a precise figure ⁶.

Findings and conclusions

Findings are the detailed results. The conclusion answers the audit objective in a sentence or two. The NAO's December 2015 report on e-Borders put its conclusion plainly: the Comptroller and Auditor General said he could not view e-Borders as having delivered value for money ⁵.

A report can reach strong conclusions and still make no recommendations. The Auditor General of Canada's June 2025 report on GC Strategies made none and said it confirmed weaknesses raised in earlier audits ⁹.

Recommendations and the management response

Recommendations say what the audited body should change. The management response follows each one and states whether the body agrees and what it will do. The Yellow Book requires auditors to obtain and report the views of responsible officials and any planned corrective actions, according to the Louisiana Legislative Auditor's guide ².

Agreement in a response is a promise, not proof of action. GAO tracks each recommendation after publication. For its September 2020 report on CBP facial recognition, GAO lists four of five recommendations as closed and implemented and one as closed and not implemented, after CBP dropped the requirement in question ⁷.

In the UK, audited bodies must respond to recommendations from the Committee of Public Accounts, which holds evidence sessions based on NAO reports ⁴.

Audit opinions: clean, qualified, adverse and disclaimer

A financial audit ends in an opinion on the accounts. PCAOB standard AS 3105 sets out three departures from a clean opinion. A qualified opinion says the statements are fair "except for the effects of the matter(s) to which the qualification relates." An adverse opinion says the statements "do not present fairly" the financial position. A disclaimer says "the auditor does not express an opinion" at all ³.

Read a qualified opinion closely. The basis paragraph names the matter and its size. An adverse opinion or a disclaimer is a much stronger signal than a qualification ³.

Management letters

A management letter is a shorter audit report sent to the audited body. The Philippines Commission on Audit says a management letter "is an audit report on the results of audit of the regional/branch office." It uses them for agencies with incomplete books or missing subsidiary records, for some agencies that did not submit financial statements by the deadline and for leagues or federations of local government units ⁸.

What to check after the report

An audit report is one stage. Check what came next. Did the body act on its recommendations, did a later audit test that, did parliament hold a hearing, and did any court or tribunal rule? In the UK e-Borders case, the NAO report came after an arbitration award and a High Court judgment, and a second NAO report on the successor programme followed in 2020 ⁵. GAO's recommendation tracker shows how this works in practice ⁷.