Reporting, Communication, and Follow-up
This domain tests whether findings are clear, supported, and actionable, and whether communication continues through management responses and verified remediation.
Core rules and concepts
- An engagement report typically states objectives, scope, results, conclusion, and recommendations, with management responses.
- A finding should link criteria, condition, cause, and effect. The effect states the risk or exposure, not merely that a policy was breached.
- Recommendations should identify an action, an owner, and a target date. Avoid prescribing detailed operational design when management is responsible for the solution.
- Communicate throughout the engagement, including an exit discussion, so factual errors are corrected before final issuance.
- Follow-up verifies implementation, not just management's promise. Overdue high-risk actions are escalated to the board or audit committee.
- Conclusions must stay within the engagement scope; do not imply an overall opinion when only one process was tested.
Worked example
A draft says "procurement controls are poor." It has no criterion or effect. A stronger finding states: policy requires three quotes above $50,000; eight of forty sampled purchase orders had one quote; the system does not block single-quote orders; this exposed about $1.2 million to noncompetitive pricing. The recommendation assigns the procurement director to configure a system block by a stated date, with follow-up evidence required.
Traps that cost marks
Issuing recommendations without owners or dates; reporting only at the end; accepting a response without testing implementation; and overstating conclusions beyond the scope tested.