Audit Reporting Follow Up

1. Audit Reporting Follow Up

2. Audit Report Follow Up • Form and content of audit report • Management actions to implement recommendations

3. Form and Content of Audit Report • Form • Content • Guidelines

4. Form • Audit • Review • Agreed upon procedures

5. Content • An introduction to the report, including a statement of audit objectives and scope, the period of audit coverage, and a general statement on the nature and extent of audit procedures examined during the audit • The IS auditor's overall conclusion and opinion on the adequacy of controls and procedures examined during the audit • The IS auditor's reservations or qualifications with respoect to the audit. this may state that the controls or procedures examined were found to be adequate or inadequate. the balance of the audit report should support that conclusion and the overall evidence gathered during the audit should provide an even greater level of support

6. Content • Detailed audit findings and recommendations and the decision to include or not include findings in an audit report. these should be based on the materiality of the findings and the intended recipient of the audit report. an audit report directed to the audit committee of the board of directors, for example, may not include findings that are important to local management but have little control significance to the overall organization. the decision of what to include in various levels of audit reports depends upon the guidance provided by upper management • A variety of findings, some of which may be quite material while others are minor in nature • Limitations to audit • Statement on the IS audit guidelines followed

7. Guidelines • Background • Introduction • Assurance • Types an services • Audit and Review • Agreed upon procedures • Agreed upon procedures reporting • Engagement Mandate

8. Guidelines IS Audit Opinion • Limitations • Management's usual requirement that the cost of an internal control does not exceed the expected benefits to be derived • Most internal controls tent to be directed at routine rahter than nonroutine transactions/events • The potential for human error due to carelessness, distraction or fatigue, misunderstanding of instructions and mistakes in judgment • The possibility of circumvention of internal controls through the collusion of employees with one another or with parties outside the organisation • The possibility that a person responsible for exercising an internal control could abuse that responsibility, for example, a member of management overriding a control procedure • Subsequent Events • Conclusions and Reporting

9. Management Actions to Implement Recommendations • Follow up program to determine if agreed corrective actions have been implemented • Not necessarily follow up for external audit • The timing of the follow up will depend upon the criticality of the findings and would be subject to the IS auditor’s judgment • The results of the follow up should be communicated to appropriate levels of management • The level of the IS auditor’s follow up review will depend upon several factors