Audit Reporting and Follow-Up

Audit Reporting and Follow-Up is the final stage of the IS audit process. It is how an auditor formally presents what they found, what risks those findings create, and what the organisation must do to fix things.

Let us define the key terms. An 'audit finding' is a specific gap between what should be happening (the control standard) and what is actually happening. For example, the standard says 'all network routers must have their firmware updated every 90 days', but the audit found three routers that had not been updated in 18 months. That gap is an audit finding.

An 'audit opinion' is the auditor's overall conclusion about the area being audited. It might be 'unqualified' (everything is fine), 'qualified' (there are some issues but not catastrophic), 'adverse' (serious problems exist), or a 'disclaimer' (the auditor could not get enough evidence to form an opinion). CISA loves testing the difference between these four types of opinions.

The 'audit report' is the formal document containing all findings, the audit opinion, and recommendations. It is addressed to the board of directors, the audit committee, or senior management. This is not a casual email to a friend. It is a legal and professional document.

Now, how does the reporting process work? Step one: the auditor drafts the report. This means organising all findings logically, usually by risk level (high, medium, low). Each finding must include: what was found, what the standard requires, the root cause (why it happened), the risk impact (what could go wrong because of this gap), and a recommendation for fixing it.

Step two: the auditor discusses the draft with the auditee — the person or team responsible for the area audited. This is called 'exit conference' or 'closing meeting'. The purpose is to ensure no factual errors exist. If the auditee says 'you wrote that we left the server room unlocked, but actually we have a biometric lock that logs every entry', the auditor must check and correct the report if wrong. This is crucial because the final report becomes the official record.

Step three: the auditor issues the final report. This goes to the people who have authority to act — usually the board audit committee or C-level executives. The report often includes a management response section: management states whether they agree with each finding, what action they plan to take, and a target date for completion.

Follow-Up is the next phase. The auditor does not just send the report and walk away. The auditor must verify that management actually implemented the corrective actions. This is called 'remediation testing' or 'follow-up audit'. The auditor asks for evidence: a screenshot of a new firewall rule, a signed policy document, a log showing completed employee training. If the fix is inadequate, the auditor may escalate to the board.

Why does follow-up matter? Because an audit that finds problems but never checks if they are fixed is useless. Organisations are busy. They might promise to fix something and then never do it. The follow-up ensures accountability. CISA exam questions love to ask: 'What should the auditor do if management does not fix a high-risk finding?' The answer is: escalate to the audit committee or board.

What does this replace? Before formal auditing existed, people just complained about problems informally. No records, no accountability. Formal audit reporting created a traceable, professional process. It moves from 'trust me, I fixed it' to 'here is the documented evidence that the fix was implemented and tested'. It also replaces guesswork with standardised risk ratings, so everyone understands which problems are truly dangerous.

Key concepts to remember for the exam:

The entire process exists to turn audit findings into real improvements. Without reporting and follow-up, an audit is just a pile of papers that nobody reads.

Imagine you work as an IT auditor for a medium-sized bank. You have just completed an audit of the bank's access control system — who can log into the core banking application. You spent two weeks reviewing user lists, testing passwords, and checking terminated employees' access. Here is what happens next in the real world.

First, you draft your audit report. You have 15 findings. One is critical: a former employee who left six months ago still has an active admin account. Three are high: twelve shared user accounts exist (two staff use the same login), passwords are not required to be complex, and there is no log of failed login attempts. The rest are medium or low, like 'password expiry reminder not visible on login screen'.

For each finding, you write a standard 'finding description' paragraph. For the critical finding, you write: 'User account js1234, belonging to former employee John Smith (terminated 15 January 2024), remains active with full administrative rights to the core banking application. This violates the bank's policy requiring account deactivation within 24 hours of termination. The risk is that the ex-employee could access sensitive customer data or perform fraudulent transactions, potentially causing financial loss and regulatory penalties.'

You also assign a risk rating using the bank's matrix: likelihood (high that a terminated employee could use their access) multiplied by impact (very high — direct access to financial accounts) equals critical.

Now you schedule the exit conference. You meet with the IT manager, the head of information security, and the internal audit director. You walk through each finding. The IT manager says: 'Oh, we thought we had deactivated John's account. It was missed in the manual process.' You note that. You ask: 'So do you agree with the finding?' The manager agrees. Then you discuss the action plan. For the critical finding, the manager says: 'We will disable the account today, and we will run a script tomorrow to audit all active accounts for ex-employees. We will also automate the deactivation process within 30 days.' You record that as the management response with a completion date of 30 days from now.

After the meeting, you update the report to reflect the discussion. Then you issue the final report to the board audit committee. The report includes a summary table: the number of findings by risk level, the audit opinion (you give a 'qualified' opinion because there is one critical and three high findings, but the core controls work overall), and management's action plans. The board reads it, asks a few questions at the next committee meeting, and formally accepts the report.

Then comes follow-up. 45 days later, you check whether the critical and high findings are fixed. You ask for evidence. The IT manager sends you a screenshot showing John's account is disabled. They also provide a log of a script run that found no other active accounts for ex-employees. And they show you a project plan for automating account deactivation, which is now 60% complete. You verify the screenshot by logging into the system yourself (with proper authorisation) to confirm the account is gone. You document your verification.

For the 'shared accounts' finding, the manager says they are still working on it. They blame the project taking longer than expected. You assess that this is a high-risk issue still outstanding. You then escalate to the board audit committee: you write a memo stating that a high-risk finding remains unresolved beyond the agreed target date, and you recommend the board require management to report on progress monthly until fixed.

That is the real workflow. It is bureaucratic but necessary. Every step is documented so that if something goes wrong later — like a data breach caused by that ex-employee account — there is a clear trail showing whether the auditor did their job properly.

Common real-world tools auditors use during this phase include:

The key is that an auditor never assumes 'they said they fixed it, so it must be fine.' You always verify with objective evidence.