Which statement is least appropriate?

It is therefore important that the objectives of this final document are clearly established and this may be one or more of the following:

a. To recommend change: The audit report must be first and foremost about securing change in terms of new or improved controls.

b. To provide an insight for management into risk and control issues: It can be said that the audit report will highlight the importance of control issues and relate these to risks to management’s own business objectives.

c. To secure action in response to audit advice: Action goes further than recommendation by moving an idea to the status of an actual event.

d. To bring problems to management’s attention: Another view of the audit report suggests it is designed to ensure management is aware of unmitigated risk and its effect on systems objectives.

e. To ensure that the results of audit work are clearly documented: Not all audit reports are published and some, particularly preliminary survey reports, are used as internal documents. Others contain no major findings so are not sent out to management.

f. To provide assurance to management on their activities: This part of the role of the audit report is based on the view that audit reviews controls, because they may have fallen into disrepair or misuse.

g. To show managers how their problems may be solved: Pointing the way forward is another objective of the audit report.

h. To provide information about risk management practices: This is a valid objective as many audits will report new information that has been specially developed via the audit process.

i. To protect the auditor: Many reports will have the subsidiary objective of documenting where audit resources were applied and where it was not possible to do detailed work.