What's changed: Initial version
6.1Audit report and recommendations for improvement
Covers the structure of the audit report that conveys results, how to build each finding on the four points of fact (current state), cause, impact (risk), and recommendation, the principle that the auditor recommends but does not implement the fix themselves (preserving independence), and the judgment of making recommendations feasible and prioritized to match the significance of the risk.
A systems audit does not end with finding a control deficiency; it creates value only once it reaches management and leads to remediation. The bridge for that is the audit report. A systems auditor must judge how to describe each finding objectively in the order of fact, cause, impact, and recommendation, based on collected audit evidence, backed by confirmed facts rather than impressions or guesses. Crucially, the auditor is in the position of pointing out deficiencies and recommending improvement, not of designing or implementing the concrete fix themselves. If the auditor implemented the fix, they would be auditing their own work in the next audit and would lose independence and objectivity.
6.1.1The four elements of a finding and fact-based description
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.