Guidelines for Writing Audit Reports

sponsored by the Henderson Group
Computer Security Consulting and Training

Every organization has its own format for audit reports. Your reports will be more effective however if you keep these guidelines in mind, and consider following them unless there is some overriding reason not to:

• Relate your findings to business risk. Don't say the "PROTECTALL option is not on. It should be." Say rather:"PROTECTALL is not on. This allows non-standard dsnames to be used, which can result in datasets not being protected when they should be. This also makes it more difficult to manage DASD space and enforce naming standards."
  
• Review your recommendations in draft form with the person you will be suggesting carry them out. Always ask that person if he or she knows of any additional steps which should be taken (and give that person credit for the suggestion).
  
• Use the active voice (not the passive), and be specific. Instead of "Controls should be strengthened.", say "The security administrator should define all disk and tape datasets to the security software. Senior management should create a task force to develop a policy which specifically assigns responsiblity for approving access rules for each application's data. Those department heads identified in the policy should indicate in writing to the security administrator who should be allowed to read, and who to write, each application's data."
  
• Provide specific detail in your recommendations to allow anyone to determine clearly whether the recommendation has been carried out. Rather than "Datasets should be better protected.", recommend that "The security administrator should define every production dataset to the security software by year-end."