MemberMay 19, 2021 at 8:30 am
In addition to above it should also include below
1. Risk Mattrix – Criteria of defining the observation as High Medium and Low. The same criteria should be approved by board.
2. Whenever an observation is rated High Medium Low , reference should be given to the specific criteria basis which it has been rated
3. Incase the observation is a repeat finding, it should mention it clearly.
4. Disclaimer – Incase the information is not provided, some application access not provided or data referred to produce the report
5. Lastly, Annexures