Audit Reporting, Documentation and Presentation of Findings
This domain tests whether your findings are written so that a manager, a client or a court can act on them and defend them.
Report skeleton
Title, report ID, date, auditor, site and client; executive summary of three to five findings; scope, objectives, period covered, cameras reviewed and limitations (missing footage, no audio, no remote access); methodology (retrieval method, hashing, tools, sampling basis); findings; appendices (chain-of-custody forms, review logs, evidence stills with source hash, the electronic-record certificate).
Each finding in four parts
Criteria - what the policy or standard requires. Condition - what you actually observed. Evidence - exhibit number, camera ID, timestamp, hash. Effect and recommendation - the risk and a specific, achievable fix. Optionally rate it critical, major, minor or observation.
Worked example
Camera 7's clock reads 09:14:12 when the reference clock reads 09:18:24. Criteria: all cameras sync to NTP daily. Condition: drift of 4 minutes 12 seconds measured on 12 March. Effect: any timestamp from this camera may be challenged. Recommendation: enable NTP, check monthly, log the check. Evidence: exhibit 04, SHA-256 recorded.
Writing style
Past tense, neutral, quantified. Separate fact from inference from recommendation. No adjectives, no blame, no speculation about motive. Number every page, sign and date, and use version control so the issued copy can be identified later.
Presentation
Share on a need-to-know basis, redact faces and plates where they are not needed, present in a controlled room, and never hand over the only copy.
Traps
Conclusions without evidence references; no limitations section; mixing opinion with observation; editing an exhibit to produce a screenshot; reports that name individuals as guilty.