712-50 Question 70
Single answerDevelop an IT audit documentation process and share reports with relevant stakeholders as the basis for decision-makingA newly appointed CISO is standardizing the organization's IT audit documentation process after several audit reports were criticized for being inconsistent, too technical for executives, and not actionable for system owners. The board wants concise information to support risk decisions, while control owners need enough detail to remediate findings. Which approach should the CISO implement FIRST to improve the usefulness of audit documentation and reporting for decision-making across stakeholders?
- A
Create a role-based audit reporting standard that defines required documentation elements, evidence retention, issue ratings, remediation tracking, and separate report views for executives and technical owners
- B
Require auditors to submit full working papers and raw evidence directly to the board so leaders can independently assess the severity of each finding
- C
Standardize all audit reports into a single highly technical template so every stakeholder receives the same level of detail and no information is lost
- D
Delay report distribution until every finding is fully validated, root cause analysis is completed, and remediation dates are approved by all affected teams
Show answer and explanation
Correct answer: A
Explanation
The best answer is the establishment of a role-based audit documentation and reporting standard. In a mature governance model, audit documentation should be complete, consistent, traceable, and defensible, while reporting should be tailored to stakeholder needs. This generally includes standardized working papers, evidence references, finding statements, risk ratings, root cause where available, management responses, remediation owners, and target dates. At the same time, reports should be shared in forms appropriate to the audience: board and executive leadership need concise summaries tied to enterprise risk and business impact; control owners and IT managers need detailed findings and corrective action requirements. This aligns with common audit and governance practices found in frameworks and guidance such as ISACA audit reporting principles, IIA reporting expectations, and ISO 19011 guidance on audit communication and documented information. The key objective is to ensure audit outputs become a reliable basis for risk decisions, prioritization, and accountability rather than merely a record of testing.
- A. Correct.
Correct. A role-based audit reporting standard is the most effective first step because it addresses the core problem: inconsistent documentation and misaligned reporting for different audiences. A strong process should define minimum documentation requirements such as scope, objectives, methodology, evidence references, control mapping, risk/impact statements, issue severity, owners, due dates, and exception handling. It should also support tailored outputs, such as executive summaries for the board and detailed remediation reports for control owners. This improves audit quality, traceability, and decision support without overloading stakeholders with irrelevant detail.
- B. Incorrect.
Incorrect. Boards should receive summarized, decision-oriented reporting rather than raw working papers and full evidence sets. Working papers are important for audit defensibility, quality assurance, and potential regulatory review, but sending them directly to the board is inefficient and may create confusion. Executives typically need risk exposure, trends, business impact, and remediation status, not detailed testing artifacts.
- C. Incorrect.
Incorrect. Standardization is valuable, but a single highly technical template for all stakeholders does not solve the communication problem. Executives, audit committees, and operational teams have different decision needs. Giving everyone the same technical detail often reduces clarity for senior leadership and can weaken decision-making. The misconception here is that consistency means identical reporting rather than consistent underlying documentation with audience-appropriate presentation.
- D. Incorrect.
Incorrect. While validation and accuracy are important, delaying report distribution until all analysis and remediation details are finalized can slow risk communication and governance action. Leading practices support timely issuance of draft and final reports, with clear status indicators for validation, management response, and remediation commitments. Waiting too long can prevent stakeholders from making prompt risk-based decisions.