6.1Audit report and recommendations for improvement

A systems audit does not end with finding a control deficiency; it creates value only once it reaches management and leads to remediation. The bridge for that is the audit report. A systems auditor must judge how to describe each finding objectively in the order of fact, cause, impact, and recommendation, based on collected audit evidence, backed by confirmed facts rather than impressions or guesses. Crucially, the auditor is in the position of pointing out deficiencies and recommending improvement, not of designing or implementing the concrete fix themselves. If the auditor implemented the fix, they would be auditing their own work in the next audit and would lose independence and objectivity.

6.1.1The four elements of a finding and fact-based description

• The four elements of a finding are (1) fact (current state/condition), the objective fact confirmed by audit evidence; (2) cause, why it came to be; (3) impact (risk), the loss or threat expected if left unaddressed; and (4) recommendation, the proposal for how to remediate. Only when these four are present can management understand "why it should be fixed" and decide. Omitting the impact (risk) fails to convey why it should be prioritized for fixing.
• Fact-based description means the report is written on confirmed facts backed by audit evidence, not the auditor's subjective impressions or guesses. Rather than vague expressions like "seems to be" or "probably dangerous," it concretely shows "when, which target, how it was verified, and against which criterion it is a deficiency." Unsupported assertions or overstatement provoke pushback from the audited department and damage the report's credibility.

6.1.2Writing recommendations and the auditor's position

• Keep a recommendation as a recommendation: the auditor recommends a direction for remediation, such as "a preventive control of segregation of duties should be introduced" or "approval should be mandatory for production releases," but actually building the system change or control with their own hands oversteps their role and undermines independence. Responsibility for executing the fix lies with the audited department (the field) and management, and the auditor keeps the position of later objectively verifying its implementation.
• Make recommendations feasible and prioritized to match significance: a recommendation must be feasible under constraints of cost, staffing, and technology, not idealistic. Also, labeling every finding equally as "act immediately" exhausts the field and buries the important ones, so assign priority according to the severity of impact (risk). Recommending early remediation for serious risks and planned handling for minor ones—this gradation helps management allocate its limited resources.

6.1.3Judgment in writing a finding and recommendation

Suppose a systems auditor, auditing access management in a sales-management system, confirms several facts that accounts of departed employees remain undeleted. How to write this in the report is the question. First, as fact, rather than an impression, describe a confirmed fact backed by audit evidence (the reconciliation result): "reconciling the user list as of month X against HR's roster of departed staff, accounts for N departed users remained active, and M of them could still log in." Next, as cause, "the offboarding procedure does not incorporate a step to disable accounts, and the coordination between HR and the IT department is not standardized," and as impact (risk), "there is a risk of unauthorized access or information leakage by former employees or third parties, a serious deficiency in internal control." Without writing this impact (risk), management cannot judge why it should be prioritized. Then, as a recommendation, recommend the direction: "account disabling should be incorporated as a mandatory step in the offboarding procedure, and a mechanism (a detective control) that finds residual departed-user accounts through periodic stocktaking should be established." Here is a line the auditor must not cross. For the auditor to log into the HR system themselves and delete the departed-user accounts, or to write a disabling script and apply it to production, is implementing the fix, which is not the auditor's role—doing so would mean auditing a mechanism of their own making in the next audit, losing independence both in appearance and in mind. Execution of the fix is left to the audited department and management, and the auditor keeps the position of objectively verifying its implementation at a later follow-up. In addition, because this finding is a serious risk of login-capable accounts remaining, the recommendation is given an "early action" priority, differentiated from minor findings (such as inconsistent naming conventions), so that management can direct its limited resources to the serious risk. Backing findings with facts, conveying priority through impact, and keeping to recommendation while leaving implementation to the field is the judgment of report writing.

6.1.4Section summary

• Build a finding on the four points of fact, cause, impact (risk), and recommendation; omitting impact fails to convey priority
• Description is fact-based, backed by audit evidence (no assertion on subjectivity or guesswork); unsupported assertion damages credibility
• The auditor recommends and does not implement the fix themselves (preserving independence); recommendations are feasible and prioritized by risk significance