Audit Reporting and Follow-up
What you must know
The audit report is the formal record of the audit: objectives, scope, criteria, team, dates, findings, conclusions, and any recommendations. Know the difference between a finding (evidence-based statement), a conclusion (overall judgment against objectives), and a recommendation (suggested improvement, which the auditee may accept or reject). Understand report distribution and confidentiality. Follow-up is the verification that corrective actions were implemented and effective - not merely promised. Know the corrective action lifecycle: containment, root cause analysis, action plan, implementation, effectiveness verification, and closure. Understand that the auditee owns the corrective action; the auditor verifies. Know timelines, escalation for overdue actions, and how follow-up findings feed back into the audit programme.
Traps in questions
A frequent trap is treating a corrective action as closed once the plan is submitted - closure requires evidence of implementation and effectiveness. Another is confusing root cause with the symptom (e.g., "operator error" is rarely a root cause; ask why the system allowed it). Questions may misattribute ownership: the auditor does not write or implement the corrective action. Watch for reports that omit conclusions or that mix recommendations into findings as if mandatory. Also beware assuming every finding needs a recommendation.
Worked example / rule of thumb
A finding: calibration records missing for three instruments. The auditee proposes retraining the technician. Before closure, verify records now exist and that a system control prevents recurrence (e.g., a calibration due-date alert). Rule of thumb: closed means verified effective, not promised.
Exam angle
Expect questions on what belongs in a report, who owns actions, and when closure is legitimate.