Audit Reporting and Follow-up
Building the report
An audit report communicates findings to the intended users. Candidates must know the anatomy: objective, scope, criteria, findings, conclusion or opinion, and recommendations. A well-formed finding has a condition (what is), criteria (what should be), cause (why it happened), effect (why it matters), and a recommendation. Reports must be accurate, objective, clear, concise, constructive, and timely.
Ratings and conclusions
Know the difference between an overall opinion and individual findings, and how ratings (e.g. satisfactory, needs improvement, unsatisfactory) should be defined and applied consistently. Understand that a conclusion must be supported by the evidence in the report - not by the auditor's general impression.
Follow-up
Follow-up verifies that management actions have been implemented and that risks are actually reduced. Know the difference between a management action plan (with owner and due date) and the auditor's follow-up verification. Overdue actions should be escalated to the governing body, not silently dropped.
Traps to watch
- Writing a recommendation that is vague ("improve controls") rather than specific and actionable.
- Stating an opinion stronger than the evidence supports.
- Confusing management's agreement with implementation - agreement is not completion.
- Allowing management to remove findings without documented justification.
Rule of thumb
A finding is complete only when condition, criteria, cause, and effect are all present. If any is missing, the finding is not yet ready to report.
Worked example
Condition: 4 of 20 payments lacked a second approval. Criteria: policy requires dual approval over a threshold. Cause: system allows single approval. Effect: risk of unauthorised payments. Recommendation: configure system to enforce dual approval by a stated date.