Please enable JavaScript.

Coggle requires JavaScript to display documents.

AUDIT REPORTING (PHASES (PREPARING TO WRITE, WRITNG THE REPORT, FINALIZING…

- - - - The audit report is the primary means of communicating the results of an audit to the client or auditee, oversight bodies, or other stakeholders
      - Audit reports should assist auditees in understanding control issues, recommendations and the associated risk of not taking corrective action.
      - The value of the IS audit report lies in its ability to communicate the scope, objectives, results and recommendations of the audit.
      - The value also lies in the report’s ability to provide information to persuade and assist management in reducing risk, achieving organizational objectives and taking corrective action.
      - To do so, the content of the report must be understandable to all report users and presented in a logical order and a readable style.
  - - - A review is designed to provide limited assurance about an assertion.
      - A review consists primarily of review work with less emphasis on testing or verification.
      - A review can be more process oriented, focusing on the appropriateness of the tasks and activities that the audit entity performs and the associated controls.
      - The level of evidence that is gathered is less than in an audit, and testing is generally limited or none is performed.
      - As a result, reviews do not include audit opinions.
      - Instead, conclusions may often be stated negatively.
    - - An information system audit can be performed as an examination, which is a systematic process by which a competent, independent person objectively obtains and evaluates evidence regarding assertions about an entity or event, processes, operations or internal controls, for the purpose of forming an opinion and providing a report on the degree to which the assertions conform to an identified set of standards.
      - An examination requires a higher threshold for audit evidence than a review.
      - The audit tests, for example, can focus on a comparison of the auditee’s stated and actual practices to established standards or relevant control practices.
    - - A third party and the auditor agree on specific procedures that will be performed to obtain the evidence on which the third party is willing to rely as a basis for a conclusion.
      - Depending on the requirements of the third party, the agreed-upon level of evidence may be significantly limited or extensive.