After auditors have finalized their iieldwork
and discussed their draft audit results with
the client, the final audit report is issued.
IIA Standard 2400 requires the fmal report
to include the engagement's objectives and
scope, as well as applicable conclusions, recommendations,
and action plans.
Following Sawyer's guidnnce, auditors
should provide the client a table indicating
the scores they have assigned to the
risks that were detailed in the scope document.
Communicating the results this
way gives the client credit for risks that
were well-managed at the time of the
review. A composite score should be calculated
and plotted on the ERM heat map
based on the risk summary and the auditor's
fmal assessment of the process that
was reviewed. The auditor then provides
a brief executive summary of the individual
risks that were assessed, which are
classified as minor weaknesses, management
attention, and/or major deficiencies
(see "Risks Requiring Improvement"
on this page). The degree of detail within
this section of the executive summary
should be standardized and agreed upon
by senior management each year. The
executive summary should conclude by
giving the audit client's management
team an opportunity to remark on the composite score provided by the auditors
and make any additional comments.
Finally, individual appendices should
be attached to the executive summary and
referenced appropriately. Each appendix
should detail the nature of the issue, internal
auditing's concern statement and
recommendation, management's comments
and action dates, and the person
responsible for resolving the issue.