Audit Reporting, Communication and Follow-up
Domain 9 is where the work becomes useful or wasted: writing findings that survive challenge, communicating them without alarming or softening, and following up until risk is genuinely reduced.
Anatomy of a finding
- Condition: what is, with the population and exception count.
- Criteria: the policy, regulation or framework requirement it fails.
- Cause: the root cause, not the symptom.
- Effect: the risk in business terms, quantified where possible.
- Recommendation: specific, cost-aware, and owned by someone who can act.
- Management response: action, owner and date. Without a date it is not a commitment. Rate findings by risk, not by how easy they are to fix, and keep ratings consistent across the report.
Communication
- Validate facts with process owners at the exit meeting before the draft is issued. Disagreement on facts is cheap to resolve then and expensive later.
- The draft goes to management for response; responses are included, not paraphrased away.
- The chief audit executive signs off, and an engagement quality review applies to high-risk work.
- Significant accepted risk is escalated to the audit committee and, where material, to the board.
- Avoid loaded language (fraud, negligence, incompetence) unless the evidence supports it.
Follow-up
- Track every issue with owner, rating, due date and ageing; report overdue high-risk items on a fixed cadence.
- Validate remediation by re-testing a fresh sample over a sufficient period, not by reading a confirmation email.
- Where management accepts the risk, document who accepted it, their authority, and the residual exposure.
Worked example
A finding reports that terminated users retained access. Management responds that 12 accounts were disabled. Re-testing next quarter on 25 new terminations finds one account active for nine days after termination. The issue is not closed: one exception in 25 shows the termination trigger is still unreliable, and closure requires evidence that the feed or the SLA has changed and now operates.
Traps
- Recommending implement a policy when a policy exists but is not enforced. The gap is operation, not documentation.
- Closing issues on management assertion.
- Burying high-risk findings in an appendix.
- Writing findings with no criteria, so management can argue the standard was never agreed.