Audit Reporting, Communication, and Follow-up
Reporting items test whether a finding is complete and whether escalation follows the Standards. Expect to spot missing elements and to judge follow-up and risk-acceptance responses.
Core rules
- Standard 2400: results are communicated promptly to the appropriate parties.
- 2410 requires objectives, scope and results; 2420 requires communications that are accurate, objective, clear, concise, constructive, timely and complete.
- A finding is built from criteria (what should be), condition (what is), cause (why), effect or risk (so what), and a recommendation or agreed action plan.
- 2421: if a final communication contains a material error, corrected information goes to everyone who received the original.
- 2430: "conducted in conformance with the Standards" may be stated only when the quality program supports it.
- 2440 governs dissemination; 2500 requires a follow-up process confirming action; 2600 governs acceptance of risk.
Worked example
Management declines to fix a segregation-of-duties conflict, arguing no losses have occurred. Absence of loss is not evidence the risk is acceptable. Under 2600 the CAE discusses the residual risk with management; if disagreement persists, the CAE reports the matter to the board. Internal audit cannot impose the control, and cannot silently drop the item - the escalation and the decision trail are documented.
Traps
Writing conditions without criteria; burying the risk in an appendix; treating management responses as optional; describing follow-up as a new engagement; claiming conformance while a corrective action is open.