11 Report? Findings and the Audit Opinion
What did we find, and how do we say it so the board acts?
🗂️ Tessera Case: the report must preserve the evidence
The CTO asks for a one-page conclusion. Your working papers include historical access exceptions, missing review records, unresolved privacy terms and a recovery test that missed its targets. Management has also made changes. The report must distinguish tested progress from promises without losing any issue on the way to the board.
11.1 From evidence to a finding
A finding connects a requirement with an evidenced condition. State the relevant population, period and limitation. A policy exception is not automatically an incident; an incident does not establish failure of every control. Missing evidence may prevent an assurance conclusion without proving the underlying activity never happened.
Give each finding a stable ID. Use that ID in the test, management response, retest and final opinion. If wording changes, retain enough history to show that the underlying issue has not been replaced by an easier one.
A finding can be reported before its root cause is fully established. Mark the cause as provisional or unknown and require investigation. Do not delay reporting a serious supported condition, or invent a cause, merely to fill a template.
11.2 The 5C+R format
This book uses 5C+R as an author-created working template, not a universal certification-body marking scheme. Follow the actual engagement’s reporting requirements. Here the five Cs are Criteria, Condition, Cause, Consequence and Correction; the recommendation records proposed corrective action and management’s response.
Criteria: identify the requirement, its version and why it applies. P-IT and P-HR supply the operational deadlines in this case. A.5.18 is the related access-rights area; A.6.5 addresses continuing responsibilities. Do not put quotation marks around a paraphrase and attribute it to the standard.
Condition: state what the test found, including what it did not establish. “Three of 48 leavers exceeded 24 hours” is reproducible from E04. “Offboarding is bad” loses the period, population and threshold.
Cause: distinguish supported mechanism from hypothesis. E05 supports a missing key-owner step and unacknowledged handoffs for two exceptions. L044’s six-hour delay has no supplied cause. An unresolved cause needs an owner and investigation, not a plausible sentence supplied by a model.
Consequence: explain the effect on objectives and obligations. Separate actual harm, plausible exposure and uncertainty. E05 provides realised misuse for L007; it does not establish misuse for the other exceptions.
Correction: address the detected problem, such as authorised revocation of a remaining credential or repair of an incorrect record. Record owner, authority, deadline and evidence of completion.
Recommendation and response: propose or agree corrective action, which addresses causes and recurrence. Management owns implementation; the auditor evaluates the response and verifies the evidence within the agreed mandate. A checklist change alone is not proof that the revised workflow operates.
Correction and corrective action have different purposes. The distinction is consistent with ISO’s quality-management vocabulary. The exact management-system requirements must still be checked in the authorised edition.
11.3 Root-cause analysis: the finding’s centre of gravity
Repeated “why?” questions can help locate a mechanism, but they do not prove it. Test proposed causes against records and consider alternatives. If the handoff failed because a queue was inaccessible, training alone may not correct it. If a signed checklist omitted a separately owned key, enforcing the same incomplete checklist may reproduce the problem.
A fictional junior auditor writes “staff did not follow the process” and proposes refresher training. The reviewer asks which step failed, who owned it and how completion was established. E05 shows that the process did not cover key ownership and did not ensure an acknowledged handoff. The revised response needs those mechanisms addressed. It need not prescribe automation as the only possible solution.
Keep accountability clear without treating a person’s name as a complete causal explanation. Equally, do not assume that every failure must have a purely systemic cause. Record the investigation, alternative explanations and evidence still missing.
11.4 Rating the finding: from guess to evidence
E04 establishes 3/48 = 6.25% historical deviations against 24 hours, and 4/48 ≈ 8.33% against two hours. These are observed rates in a census. They do not establish the probability of future misuse, a future breach or the proportion of all access controls that are ineffective.
E05 changes the consequence assessment: one retained key was used for unauthorised reads and the supplied adviser assessment records an eligible breach. No misuse is evidenced for the other records. Assess continuing exposure separately from the incident already realised.
Use E02’s agreed readiness-priority rules. F01 is high because of the critical credential-coverage failure, realised misuse and incomplete verification of the revised process. That is this engagement’s risk judgement. It is not an automatic ISO “major” classification based on a percentage. Preserve the original severity when recording remediation; closure status and residual risk are separate fields.
11.5 The offboarding finding, in full
🗂️ Tessera Case: F01
Criteria: E03’s P-IT v3.1 requires full revocation within 24 elapsed hours; P-HR v2.0 requires two hours. Both applied during the historical period without an approved precedence rule. Access rights relate to A.5.18. The exact deadlines are Tessera’s requirements.
Condition: E04 contains all 48 supplied departures for 1 June 2025–31 May 2026. L007, L019 and L031 exceed 24 hours; L044 additionally exceeds two hours. L007’s key remained enabled for 47 days. E05 records unauthorised use of that key. Full population coverage is stipulated by the exercise’s reconciliation fact, rather than independently verified by the reader.
Cause: E05 supports incomplete key coverage and unacknowledged handoffs. L044’s separate delay remains unexplained. The conflicting policy deadlines also require authorised resolution.
Consequence: retained credentials can permit access after authority ends. INC-01 supplies one realised case and a dated privacy assessment; no equivalent incident is established for the other leavers.
Rating: high under E02. The rating rests on critical access exposure, realised harm and incomplete corrective-action verification, not an inferred 6.25% incident probability.
Correction: the Head of IT authorised current-access reconciliation on 16 June. E10 found no active credentials belonging to the 48 historical leavers. Any newly discovered hazardous access would require prompt authorised containment and investigation; the auditor does not revoke it independently.
Corrective action and response: the approved 19 June policy changes align the deadlines to two hours prospectively. The 20 June workflow adds acknowledged handoff, a key-owner sweep and evidence-gated closure. The Head of IT owns investigation of the missing R06 evidence and a further agreed observation/retest period. Do not wait until a later surveillance audit to verify a readiness blocker.
Status at 30 June: historical current-state reconciliation completed; policy conflict corrected prospectively; systemic finding open, retest incomplete. Original severity remains high.
11.6 Show the retest before changing the status
E10 supplies the complete six-person post-change population and the independent review on 29 June. Five records have paired termination and key-disable events showing one-hour completion. R06 has a signed checklist but lacks its key-disable event or independent state evidence.
The supported retest result is five demonstrated passes and one insufficient-evidence result, not six passes and not a proved active key. The observation period is short. Request the missing R06 evidence, investigate why the closure gate accepted an incomplete record and agree further testing that addresses recurrence.
A promise, a new policy and a successful sample answer different questions. Record each, then decide whether their combined evidence is sufficient for closure. Closing F01 would not close the separate access-review, privacy, recovery or supplier issues.
11.7 The finding and closure ledger
| ID | Evidence and issue | Status at cutoff | What would change it |
|---|---|---|---|
| F01 | E03–E05, E10: historical revocation and incomplete retest | High; open | Resolve R06, substantiate cause-directed action and adequate operating verification |
| F02 | E03, E06, E10: quarterly ordinary and monthly privileged review coverage | High; open | Complete the distinct populations/reviews and verify resulting actions and recurrence controls |
| F03 | E03, E07, E10: AI privacy/terms/settings/retention/escalation | High; open | Deployment-specific evidence for every listed subissue, with qualified privacy review |
| F04 | E03, E08, E10: missed recovery targets and untested dependencies | High; open | Revised, authorised exercise meets targets with dependency/cutover evidence and reconciled documentation |
| F05 | E01, E09, E10: supplier-report period, exception and user-control reliance | Medium; open | Current relevant assurance, exception assessment and tested complementary controls |
| P01 | E11: three tenant-authorisation requests | Concern cleared, bounded pass | Reassess if configuration or threat model changes |
The electronic ledger uses these same IDs. Do not merge P01 into a global “access passed” conclusion. It tested a different assertion from F01 and F02.
11.8 Forming a defensible audit opinion
The opinion synthesises the ledger against the mandate. It should explain which issues prevent the requested recommendation, which limited successes were observed and where evidence or scope prevents a broader conclusion.
Financial-audit labels such as unqualified, qualified and adverse are not universal ISO readiness classifications. This book uses a plain-language recommendation under E02. Formal certification findings and decisions follow the certification body’s applicable rules.
A single critical unresolved issue can outweigh several bounded passes. That does not make the passes irrelevant; they establish progress and prevent an unfairly blanket negative account. Chapter 12 uses the full ledger to show both.
An illustrative report draft says, “The root cause was fixed and the leaver finding is now minor.” E10 supports a changed workflow and five demonstrated passes, but one retest record is incomplete. Rewrite the sentence to preserve the original severity and current status. The missing evidence must remain visible in the conclusion.
11.9 Executive reporting: the board-facing version
Lead with the recommendation and its limitations, then the issues driving it. Name the next action, owner and verification needed. Keep the detailed working papers available through finding IDs.
Avoid both euphemism and drama. “Access needs enhancement” hides the specific failure. “Every leaver can breach the company” exceeds the evidence. A useful sentence says that historical key revocation failed for identified records and the revised process is not yet sufficiently verified.
Do not measure success by whether the board looks uncomfortable. The report should enable an informed decision, including a decision to defer an external audit or change a deployment.
Time: 30 minutes. No AI required. Write F01 in the corrected 5C+R template. Re-perform E10’s six-record retest and state precisely why closure is not supported. Complete the six-row ledger, then draft a 150-word executive summary accounting for F01–F05 and P01. Keep original severity, action progress and closure status separate.
11.10 The question, answered
A finding earns its place through a criterion, an evidenced condition and a defensible assessment of consequence. Remediation earns closure through sufficient verification. The final chapter makes that ledger answer the board’s readiness question.