Why are good practices not mentioned in an audit report?
The objective of an audit report is to inform management of problem areas that were identified, verify with management that the problem exists and help management move toward improvement in the specified area of concern. To accomplish these steps, the audit observations (findings) that strengthen the control environment and require management assistance are specifically mentioned in the audit report. The report must be objective thus offering an unbiased review of the control environment. This is done in the cover letter of the Draft and Final Reports where an overall assessment of the controls is provided. As example of this would be effective, effective with opportunity for improvement, effective-partially, ineffective, etc. However, when warranted, we do mention an overall assessment of stronger controls in the Department, Laboratory or Center.
