Internal Auditing Standards and Practices – Cybersecurity Practice Test

To avoid surprises, findings should be discussed with management before finalizing a report. This practice ensures the auditor and management review the facts, evidence, and implications together, giving management a chance to provide context, correct any inaccuracies, and propose corrective actions. It helps ensure the report reflects reality, supports actionable remediation, and reduces the risk of last-minute disputes or rework.

Keeping findings confidential from management prevents the necessary verification and corrective response, and sharing findings publicly or with all staff first bypasses proper governance and confidentiality controls. Discussing with management first keeps the audit credible, timely, and useful for improving controls.