© SidorArt/Shutterstock.
CHAPTER 7
Writing the IT Infrastructure Audit Report
COMMUNICATION OF AUDIT RESULTS typically includes the publication of an audit report. The exact format to use will vary greatly depending on the organization, industry norms, and standards set by the audit department leadership. A vast number of templates and industry examples are available to choose from. Regardless of the format selected, audit reports should contain at a minimum the following:
The scope, including the time period to which the opinion pertains
The overall opinion of the auditor
A summary of the information that supports the opinion
The risk, framework, or other criteria used as a basis for the overall opinion
Any individual observations or gaps that need to be remediated to reduce the risk, including the impact on the organization’s goals if timely remediation is not taken
It is important to keep in mind that the target audience for the audit report is senior management. The audit report is the opportunity to make a persuasive argument that moves management into action. The risk and impact to the organization if action is not taken must be clear and concise. In many ways, the report reflects on the competence and helps build credibility of the auditor. The report must be clear, concise, timely, and persuasive.
In this chapter, we will discuss the key elements to be included in an audit report. The chapter will also discuss a thoughtful approach to building an audit report.