Staff label every failed monthly access review as an audit finding, including issues raised by compliance testing outside an audit engagement. What terminology correction is needed?
Select an answer to reveal the explanation.
Short Explanation
Not every red flag is an auditor’s stamp. Failed access reviews from compliance testing are issues to fix; audit findings are what formal assurance engagements officially raise.
Full Explanation
At terminology depth, issues and remediation from policy, compliance, or risk activities are not automatically audit findings. Audit findings are outcomes of audit engagements. Keeping the labels straight preserves workflow, ownership, and reporting clarity across IRM modules.