What's changed: Initial version
6.2Reporting to management and the audit opinion
Covers how to choose the reporting destination (management, or a superior who can maintain independence), the problem of reporting directly to the head of the audited department, the difference between the audit opinion of an assurance engagement (a conclusion giving a level of assurance) and the proposals of an advisory engagement (improvement proposals as the main aim), and the principle that an opinion is expressed within the scope of the audit evidence obtained.
An audit report's independence and effectiveness are determined by "to whom" it is reported. A systems auditor must judge how to report results to a position independent of the audit target (management, an audit committee, and so on) and deliver them to a party that can decide on remediation as an organization. Along with this, whether the audit is assurance-type (expressing a level of assurance) or advisory-type (improvement proposals as the main aim) changes whether the report gives an "opinion" or "proposals." And the opinion expressed must not exceed the scope of the audit evidence one was able to obtain—vouching for an area where evidence is insufficient is not audit but irresponsible assurance.
6.2.1Independence of the reporting destination
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.