Audit Report Structure and Communication

The report is the product

All the planning and testing exists to produce one thing: a report that tells the right people what’s working, what isn’t, and what to do about it.

A good audit has no surprises. Findings are discussed with management as they come up, so by the time the report arrives, everyone already knows what’s in it.

From fieldwork to final report

1. During fieldwork, the auditor checks each issue with the people involved, so the facts are confirmed early.
2. At the exit meeting, the auditor walks management through the findings and recommendations. The aim is agreement on the facts and on practical recommendations.
3. Management gives written responses to the draft report: what they’ll do, who’s responsible, and by when.
4. The final report goes to management and, for significant matters, to senior management and the audit committee.
5. Audit follows up to check the actions get done.

What goes in it

ITAF’s reporting standard requires the report to state:

• who it’s for, and any limits on distribution
• the scope, objectives and period covered, and the work performed
• findings, conclusions and recommendations
• any reservations or scope limitations
• signature, date and distribution list

A typical layout:

1. Executive summary and overall conclusion
2. Background, objectives and scope
3. Findings: criteria, condition, cause, effect, risk rating and recommendation for each
4. Management’s response and action plan, with owners and dates
5. Appendices with detail

When management disagrees

The auditor owns the content of the report.

• If management disputes the facts, the auditor re-checks the evidence and corrects the finding if it’s wrong.
• If management agrees with the facts but disputes the significance, the finding stays, and management’s view can be included.
• If management accepts a risk the auditor believes is beyond the organisation’s appetite, it’s escalated to senior management or the audit committee.

Already fixed? Still reported

When an issue is fixed during the audit, it’s still reported, with a note of the fix. The weakness existed during the period under review, and the readers need to know about it.

Example. The auditor finds a firewall rule allowing remote desktop connections from the internet. The network team removes it the same day. The final report still includes the finding, rated by the risk it posed while it was open, and notes that it was fixed on the day it was found.

Qualities of a good report

Clear, concise, objective, constructive and timely, with every statement supported by evidence. Recommendations fix the root cause, not just the symptom, and are practical for the organisation.

How the exam asks about it

In short

• The report states the scope, objectives, period, what work was done, findings, conclusions, recommendations and any limitations.
• Findings are discussed with the auditee before the report is final, to confirm the facts and get management's responses.
• The auditor decides what's in the report. Management can respond, but can't have valid findings removed.
• Management responses include agreed actions, owners and target dates.
• Significant findings go to senior management and the audit committee.
• Problems fixed during the audit are still reported, noting the fix.

Exam traps

• If management disagrees, the finding isn't dropped. Both views can appear in the report.
• A problem fixed before the report is issued is still reported, because it existed during the period.
• The exit meeting confirms facts and discusses recommendations; it's not for negotiating findings away.
• Don't issue a report based on facts that haven't been checked with the auditee.

Slides

Click the slide and use the arrow keys. F toggles full screen.