Audit work

An audit record holds its number, scope, planned date, auditor and status. It gives the team a defined engagement for a vendor security review. A finding then references that audit and names the requirement, observation, severity, owner and due date. Keeping the finding with the engagement allows the Auditor to inspect the scope in which it arose and to distinguish a finding from a failed inspection check.

Audit work moves from planned to in progress, reporting and closed. A finding has its own closed date. Those dates answer different questions: when the engagement was planned or completed, and when a particular issue was closed. The team should not infer that every finding has been addressed because the audit record reached a closed state. Read the linked findings when preparing the report and when following up.

• Engagement scope. The audit number and scope identify the body of work being reviewed.
• Findings beneath the audit. Each observation carries its own requirement, severity and owner.
• Dated follow-up. The due date and closed date make outstanding findings visible after reporting.

Choose a consistent audit-number convention and a useful level of detail for scope. A scope such as a vendor, service or control area helps readers understand which evidence was examined. Agree when an audit moves into reporting and what the Auditor checks before closing it. That decision should include a review of linked findings and their owners.

Agree who can edit a finding after it has been reported. The fields hold the current observation and closure date, so the team needs a procedure for corrections and for preserving the underlying evidence. Also decide how the Auditor chooses observation, minor or major severity. A consistent severity policy makes follow-up lists and reports more useful.

Plan an audit of a vendor’s access-control scope. The Auditor records the planned date and scope, then enters a finding against the specific requirement. The finding names a person to follow up and a due date. During reporting, the Auditor checks whether the finding describes the observed gap clearly enough for that person to act.

Now let the audit engagement complete while the finding remains open. The follow-up list should still identify the due item. When the owner addresses it, the Auditor records the closed date on the finding after reviewing the work. This case shows why the audit status and the finding’s closure need to be read separately. It also prevents an engagement-level completion from hiding an outstanding security question.

• Audit engagements — Audits planned, being performed or in reporting.
• Outstanding audit findings — Findings due for owner follow-up with severity and parent audit.

Read audit follow-up for planning, reporting and finding closure. The reports page shows how the team can review findings by engagement.