Realistic Audits – Reporting

The audit report is the final deliverable, following an audit, and must therefore, be able to communicate, effectively, what was done and what was found, to the people commissioning the audit, as well as the auditees.  This is not an easy task, and many auditing groups are continuously modifying and improving reports to achieve perfection, or as near perfection as possible.
There are many opinions on what a ‘good’ audit report should look like, but this is heavily influenced by the purpose of the report.  ADAMAS standard audit reports include details relating to the audit scope, to allow the recipient of the report to be able to put the observations into context.  Some organisations produce reports which contain only observations, and cut out the background detail.  This is probably acceptable for internal systems audits, but may not present the reader with a clear picture of what was actually audited.
One of the biggest challenges in writing reports is the grading of observations.  It is standard practice to grade observations as critical, major or minor (also may be general or other).  This is one of the most difficult areas in which to achieve consistency between auditors.  Having good definitions for each grading helps, but because the context of the audit observations varies enormously, it can still be very difficult to always achieve agreement.
Agreeing on critical observations is usually achievable because it is often based on a non-compliance that has actually occurred and impacts the rights or safety of the subject or the integrity of the data.  The most difficult area to achieve consistency in the grading is between major and minor.  One solution to this is to ensure all reports are peer reviewed and any disagreements discussed with a third auditor.  However, even though suitable regulatory citations may be used to support the grading, there is often an element of subjectivity, and the best person to make the final decision is probably the auditor making the finding, as they know the most about the context in which it was made.  Because of this element of subjectivity it is unlikely ‘perfection’ will ever be achieved, although it will continue to be strived for!