IT Audit Deliverables | Comprehensive IT Audit Guide Part 7

Introduction of IT Audit Deliverables

IT Audit Deliverables are the formal documents, reports, working papers, and evidence that an auditor produces during and after the audit process. These deliverables provide:

Documentation of audit scope, methodology, and findings
Evidence of control testing and issue validation
Actionable insights and recommendations for remediation
Proof of audit quality and regulatory compliance

They ensure that audit stakeholders—including IT, risk management, compliance officers, audit committees, and external regulators—have a clear and reliable reference for current risk status and required actions.

9 Key IT Audit Deliverables

📘 1. IT Audit Charter / Engagement Letter

Purpose: Formal agreement defining the purpose, authority, and responsibilities of the audit.

Contents:

Audit objectives and scope
Responsibilities of audit and auditee
Reporting lines and timelines
Legal and compliance context

Timing: Issued before the audit begins (during planning).

🧭 2. Audit Plan and Risk Assessment Report

Purpose: Define how the audit will be performed and identify key risk areas.

Contents:

Scope of systems and controls under review
Audit timeline, phases, and resources
Preliminary risk assessment and control mapping
Audit universe and coverage rationale

Timing: Early-stage deliverable; serves as blueprint for audit fieldwork.

📋 3. Initial Request List (IRL)

Purpose: Collect documentation and access permissions necessary for the audit.

Contents:

List of required policies, procedures, logs, access credentials, and evidence
Due dates and responsible parties
Tools or systems to be accessed

Timing: Sent prior to fieldwork or testing phase.

📂 4. Working Papers and Control Test Results

Purpose: Document the detailed evidence and results of control design and effectiveness testing.

Contents:

Control objectives and test steps
Sample selections and results
Evidence (screenshots, logs, configs)
Auditor conclusions and exceptions found

Tools: Excel, GRC platforms, internal audit portals

Timing: Created during fieldwork phase and continuously updated.

📉 5. Risk and Control Gap Register

Purpose: Summarize identified deficiencies, their severity, root causes, and impact.

Contents:

Gap ID, description, and affected control
Risk severity rating (High, Medium, Low)
Impact (financial, operational, compliance)
Root cause and business owner comments

Timing: Post-testing, used to inform reporting and remediation planning.

🗂 6. IT Audit Report

Purpose: Present the audit’s formal findings, risks, and recommended actions to management and stakeholders.

Contents:

Executive summary
Background and scope
Audit methodology
Observations and risk ratings
Recommendations and management responses
Conclusion and overall audit opinion

Audience: CIO, CISO, Risk Committee, Board, External Auditors

Timing: After analysis phase, typically 1–2 weeks post fieldwork.

📜 7. Management Action Plan (MAP)

Purpose: Define the corrective actions that will be taken for each audit finding.

Contents:

Finding reference
Action items
Responsible person
Deadline
Risk owner approval

Timing: Submitted by auditees after audit report is reviewed.

📆 8. Follow-Up / Remediation Status Report

Purpose: Track progress of remediation efforts and verify issue closure.

Contents:

Status of each MAP item (Not Started / In Progress / Completed)
Updated timelines and responsible owners
Evidence of remediation
Auditor re-validation (if applicable)

Timing: Quarterly or bi-annual follow-up reports; sometimes followed by re-audit.

🧾 9. Audit Closure Memo

Purpose: Official documentation that the audit has been completed and all deliverables are finalized.

Contents:

Summary of objectives and scope
Key findings and actions taken
Stakeholder acknowledgements
Date of closure

Timing: Final administrative step after follow-up is completed.

🧷 Summary Table of IT Audit Deliverables

Deliverable	Purpose	Produced During
Audit Charter / Engagement Letter	Define audit authority & objectives	Planning
Audit Plan & Risk Assessment	Outline audit scope & priorities	Planning
Initial Request List (IRL)	Request documentation & access	Pre-Fieldwork
Working Papers & Test Results	Evidence of audit tests & results	Fieldwork
Risk and Gap Register	Summarize issues and risks	Analysis
IT Audit Report	Communicate findings & risks	Reporting
Management Action Plan (MAP)	Define remediation steps	Post-report
Follow-Up Status Report	Track and validate remediation	Follow-up
Audit Closure Memo	Officially close audit	Closure

✅ Best Practices for Managing IT Audit Deliverables

Version Control: Use audit platforms (e.g., TeamMate, AuditBoard, or OneDrive with naming conventions) to ensure deliverables are tracked.
Standardization: Use pre-approved templates to ensure consistent documentation across audits.
Audit Trail: All deliverables should be backed by logs, evidence, timestamps, and reviewer notes.
Confidentiality: Ensure deliverables containing sensitive information are encrypted and access-restricted.