# Audit Finding Response

Drafts a formal written response to a single audit finding, including the root cause, corrective action plan, and target completion date. Use it when an internal or external auditor issues a finding and your organization must respond in writing.

## Prompt

## Context
You are a governance, risk, and compliance (GRC) professional responding to an audit finding on behalf of your organization. The auditor has documented a gap, control weakness, or noncompliance. Your written response becomes part of the audit record and may be reviewed by regulators, leadership, or the board.

Organization name: [ORGANIZATION NAME]
Audit type (internal, external, regulatory): [AUDIT TYPE]
Auditor or audit body: [AUDITOR NAME]
Finding title and reference number: [FINDING TITLE AND REFERENCE NUMBER]
Finding text as written by the auditor: [AUDITOR FINDING TEXT]
Root cause identified by your team: [ROOT CAUSE]
Corrective actions planned: [CORRECTIVE ACTIONS]
Target completion date: [TARGET COMPLETION DATE]
Person or team responsible: [RESPONSIBLE PARTY]

## Task
Draft a formal audit finding response with these sections:
1. Acknowledgment: one sentence accepting or respectfully disputing the finding, stated plainly.
2. Root cause: the technical or process reason this gap exists, in two to three sentences.
3. Corrective action plan: a numbered list of specific steps, each with the responsible party and target date.
4. Compensating controls (if any): interim measures in place while the full remediation is underway.
5. Management signature block: name, title, date, and a line for signature.

## Standards
- Work only from the inputs provided. Do not invent additional findings, root causes, or corrective steps the user did not supply.
- Do not fabricate CVEs, system names, log data, hostnames, or vulnerability details. Use only what is in the inputs.
- Formal, professional tone. First-person plural (we, our organization). Past tense for what happened, future tense for what will be done.
- Under 400 words.
- If the finding text, root cause, or corrective actions are missing or ambiguous, ask before drafting. A response built on assumptions can worsen the audit record.

## Variables

- ORGANIZATION NAME
- AUDIT TYPE
- AUDITOR NAME
- FINDING TITLE AND REFERENCE NUMBER
- AUDITOR FINDING TEXT
- ROOT CAUSE
- CORRECTIVE ACTIONS
- TARGET COMPLETION DATE
- RESPONSIBLE PARTY

## Input checklist

- [ ] The auditor's finding text, copied exactly as written, not paraphrased
- [ ] Your team's documented root cause, not a guess
- [ ] Specific corrective actions with owners and realistic completion dates, agreed with the responsible parties before you draft
- [ ] Confirm all technical details (system names, control references, dates) come from your own audit records, not from the AI
- [ ] Redact any classified, personnel, or customer data from the finding text before pasting, per your organization's data handling policy

## Verification checklist

- [ ] Confirm the acknowledgment sentence accurately reflects your organization's position, whether accepting or disputing the finding
- [ ] Verify the root cause matches your internal investigation notes, not an assumption the AI introduced
- [ ] Check each corrective action step against what your team actually committed to, including owners and dates
- [ ] Confirm no CVEs, hostnames, system names, or vulnerability details appear in the response that you did not supply
- [ ] Verify the target completion dates are realistic and have been agreed with the responsible parties
- [ ] Confirm the management signature block reflects the correct signer for your audit process
- [ ] Read the response as the auditor would: does it address the specific finding text, or does it talk around it?

## Sample output

Sample output. Generated by AI from sample inputs:

Audit Finding Response
Organization: Northwind Defense Contractors LLC
Audit: External compliance review, FY 2026
Finding Reference: NCF-2026-07
Finding Title: Privileged Account Review Not Performed Quarterly

1. Acknowledgment
Northwind Defense Contractors LLC acknowledges the finding that quarterly privileged account reviews were not completed for the period January through September 2026.

2. Root cause
The quarterly review cadence was documented in our Access Control Policy but was not entered into our IT task management system as a recurring obligation. As a result, two review cycles were missed without a notification or escalation. The process gap was process-tracking, not policy intent.

3. Corrective action plan
1. Enter quarterly privileged account reviews into the IT ticketing system as recurring tasks with assigned owners. Responsible: IT Security Manager. Target: November 15, 2026.
2. Conduct the overdue Q1-Q3 2026 reviews and document results. Responsible: IT Security Manager. Target: November 30, 2026.
3. Add privileged account review completion to the monthly GRC dashboard reported to leadership. Responsible: GRC Analyst. Target: December 1, 2026.

4. Compensating controls
Privileged account access is logged by our identity management platform and reviewed on an ad-hoc basis during incident investigations. No unauthorized access was identified in the logs for the missed review periods.

5. Management sign-off
Name: ______________________
Title: ______________________
Date: ______________________
Signature: __________________

## Customization notes

For regulatory findings (FedRAMP, CMMC, HIPAA), add the specific control identifier (for example, AC-2 for account management under NIST SP 800-53) in the acknowledgment section so the response maps cleanly to the framework. If your organization disputes a finding, rewrite the acknowledgment section to state the dispute plainly and add an evidence section. For repeat findings, add a section explaining why prior corrective actions did not hold.

---

From The IT & Cybersecurity Library at vetslearn.com/libraries/it-cyber