The most important consideration when assessing the adequacy of management’s remediation action plan is the criticality of the audit findings, as this reflects the level of risk and impact that the findings pose to the organization’s objectives, performance, and value. The IS auditor should evaluate whether the remediation action plan addresses the root causes, mitigates the risks, and resolves the issues of the audit findings in a timely and effective manner. The IS auditor should also consider the feasibility, reasonableness, and measurability of the remediation actions.

References

ISACA CISA Review Manual, 27th Edition, page 256

How to Write an Audit Finding - Dallas Chapter of the IIA

How to Write an Audit Report: 14 Steps (with Pictures) - wikiHow