# Audit Report Writing Workflows

## Workflow 1: End-to-End Audit Report Production

```
Step 1: Report Planning (Days 1-2 post-fieldwork)
├── Collate all working papers, evidence files, and interview notes
├── Review fieldwork completion checklist for scope coverage
├── Confirm all findings have been discussed with auditee during fieldwork
├── Assign finding owners and agree preliminary severity ratings
└── Set report drafting timeline (target: 10 business days from fieldwork end)

Step 2: Findings Drafting (Days 3-6)
├── For each finding:
│   ├── Write the Condition (what was observed, with evidence references)
│   ├── State the Criteria (regulation article, policy clause, or standard section)
│   ├── Analyse the Cause (root cause: process gap, training deficiency, system limitation)
│   ├── Describe the Effect (actual or potential impact on data subjects, organisation)
│   ├── Assign risk rating using severity matrix
│   └── Draft specific, actionable recommendation
├── Cross-reference evidence IDs to evidence repository
├── Verify no duplicate findings (merge overlapping issues)
└── Order findings by severity (Critical → High → Medium → Low)

Step 3: Executive Summary Drafting (Day 7)
├── Write scope paragraph (what was audited, period, boundaries, exclusions)
├── State overall compliance opinion:
│   ├── Satisfactory — no critical/high findings; effective controls
│   ├── Needs Improvement — high findings present; controls partially effective
│   └── Unsatisfactory — critical findings; material non-compliance
├── Summarise finding distribution by severity (table format)
├── Highlight critical/high findings requiring immediate attention
├── Note positive observations and areas of strong compliance
└── Conclude with overall risk posture assessment

Step 4: Management Response (Days 8-12)
├── Issue draft findings to auditee management
├── Allow 5 business days for management response
├── For each finding, management must provide:
│   ├── Accept or dispute the finding (with evidence if disputing)
│   ├── Planned corrective action
│   ├── Responsible owner (named individual)
│   └── Target completion date
├── Review responses for adequacy
└── Escalate unresolved disputes to audit committee

Step 5: Quality Review (Days 13-14)
├── Peer review by independent auditor not involved in fieldwork
├── Check: accuracy, objectivity, clarity, completeness, constructiveness
├── Verify all evidence references are valid and accessible
├── Confirm findings are distinct and non-overlapping
├── Review severity ratings for consistency
├── Ensure recommendations are actionable and proportionate
└── Obtain sign-off from Internal Audit Director / Chief Audit Executive

Step 6: Report Finalisation and Distribution (Day 15)
├── Apply report classification (Confidential / Internal / Restricted)
├── Generate PDF with controlled document numbering
├── Distribute full report to: CPO, DPO, Internal Audit Director, auditee management
├── Distribute executive summary to: Board Audit Committee, C-suite
├── Record distribution in report register
├── Upload to audit management system (findings tracker)
└── Schedule follow-up verification dates based on remediation deadlines
```

## Workflow 2: Finding Severity Classification

```
START: Classify a finding
│
├─ Does the finding indicate active or imminent harm to data subjects?
│  ├─ YES → CRITICAL
│  └─ NO → Continue
│
├─ Could the finding lead to regulatory enforcement action or material breach?
│  ├─ YES → HIGH
│  └─ NO → Continue
│
├─ Does the finding represent a control weakness that could deteriorate?
│  ├─ YES → MEDIUM
│  └─ NO → Continue
│
├─ Is the finding an improvement opportunity with no current risk?
│  ├─ YES → LOW
│  └─ NO → OBSERVATION
│
END: Apply rating and document rationale
```

## Workflow 3: Disputed Finding Resolution

```
Step 1: Receive management dispute
├── Document the specific points of disagreement
└── Identify whether the dispute is factual, interpretive, or severity-related

Step 2: Evidence review
├── Re-examine original evidence supporting the finding
├── Consider additional evidence provided by management
└── Consult regulatory text or standard for interpretive disputes

Step 3: Resolution
├── If audit position upheld: document rationale; retain original finding
├── If management evidence is compelling: amend finding; document change
├── If partially agreed: adjust severity or scope; note in management response
└── If unresolved: escalate to audit committee with both positions documented

Step 4: Documentation
├── Record resolution outcome in finding record
├── Update management response section
└── Note escalation path if applicable
```