Information Systems Auditing Process · Topic 5 of 5
Audit Reporting and Quality Assurance
Structuring IS audit findings, the exit meeting, management responses, follow-up of recommendations and quality assurance of the audit function.
- 3 min
- A finding has condition, criteria, cause, effect and recommendation.
- Hold an exit meeting before issuing the final report.
- Report significant issues promptly to the right level.
What it is
The audit report is the product of the engagement: it tells management and the audit committee what was found, why it matters and what should be done. Follow-up checks that agreed actions were taken. Quality assurance of the audit function makes sure audits are performed to standard and keep improving.
How it works
Structure of a finding
| Element | Question it answers |
|---|---|
| Condition | What did the auditor find? |
| Criteria | What should be in place (policy, standard, regulation)? |
| Cause | Why did it happen? |
| Effect | What is the risk or impact to the business? |
| Recommendation | What should management do? |
Recommendations should address the root cause, not only the symptom. Fixing one wrong user account without fixing the process that created it leaves the problem to recur.
Communicating results
- Discuss findings with the auditee during fieldwork so there are no surprises.
- Hold an exit meeting to confirm facts and discuss recommendations before the final report.
- Include management responses with agreed actions, owners and dates.
- Report to the level that can act, normally senior management and the audit committee.
The auditor must not drop or soften a significant finding because the auditee disagrees. Disagreements are recorded, with both views, in the report.
Significant findings during fieldwork
A serious issue, such as active fraud or a major exposure, should be reported promptly to the right level of management and not held back until the final report. Suspected fraud is escalated as the charter and policy require; the auditor does not investigate it alone without authority.
Follow-up
The auditor tracks whether management has implemented agreed actions. If management chooses to accept a risk instead of acting, the auditor checks that the decision was taken by someone with the authority to accept that level of risk, and reports it if not.
Quality assurance and improvement
| Activity | Purpose |
|---|---|
| Supervision and review | Senior auditors review work papers and conclusions during each engagement |
| Internal assessments | Periodic self-review of the function against standards |
| External assessments | Independent reviewers evaluate the audit function |
| Feedback | Auditee surveys and lessons learned improve future work |
| Training | Keeps auditors competent as technology changes |
When asked how to confirm that an audit was performed to standard, look for independent review of work papers or an external quality assessment.
How the exam asks about this
- "The auditee disagrees with a finding." Discuss it, verify the facts, and include management's view in the report; do not remove a valid finding.
- "Management accepts the risk instead of fixing it." Confirm the acceptance was made at the right authority level and document it.
- "What should a recommendation target?" The root cause.
What to remember for the exam
- A finding has condition, criteria, cause, effect and recommendation.
- Hold an exit meeting before issuing the final report.
- Report significant issues promptly to the right level.
- Follow up on agreed actions; verify risk acceptance authority.
- Quality assurance includes supervision, internal and external assessments.
Agreeing to remove a finding because the auditee fixed it during the audit hides the weakness. Report it and note the corrective action taken.
Common mistakes
Recommending a fix for the symptom only. The cause will produce new problems.
Waiting for the final report to raise fraud. Escalate promptly.
Treating the report as the end of the audit. Follow-up completes it.
Check yourself
What is the purpose of the exit meeting?
To confirm the facts of the findings and discuss recommendations with the auditee before the final report.
What should the auditor do when management decides to accept a reported risk?
Confirm the decision was made by someone with authority to accept that risk and document it.
What should an audit recommendation address?
The root cause of the finding, not just the symptom.
Topic 5 of 5 in Information Systems Auditing Process
Test yourself on Information Systems Auditing Process
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.