Audit reporting, communication, follow-up and quality assurance
What the exam tests
This domain tests whether audit findings are communicated clearly, actioned and quality assured. Questions often require rewriting weak findings, assessing management responses and evaluating follow-up evidence.
Core rules and concepts
- A finding should state criteria, condition, cause, effect and recommendation. The criteria may be policy, regulation, standard or good practice; the condition is the factual evidence.
- Reports need an overall opinion or rating, a clear scope, risk-ranked findings, agreed management actions, owners and due dates.
- Communication should be timely and escalate significant risks to the audit committee. Draft reports should give management a chance to correct factual errors, not to negotiate away valid findings.
- Follow-up verifies implementation with evidence; an issue should not be closed merely because management says it is done.
- A QAIP includes internal assessments, supervision and review, and an external assessment at least every five years.
Worked example
The draft finding says loan files are incomplete. This is too vague. Rewrite it: criteria - credit policy requires current financial statements before annual review; condition - 7 of 50 watch-list files lacked statements within 18 months; cause - review checklist not enforced and no exception report; effect - deterioration may be missed, understating ECL; recommendation - enforce checklist, add automated exception reporting, and re-perform reviews for affected files. The management response must name an owner and date.
Traps
- Recommendations that describe a control without fixing the root cause.
- Closing issues without evidence of operation.
- Reports that omit the effect or risk rating.
- Treating supervision as a substitute for a QAIP.