Executive Summary
Definition
The opening section of an audit report written for non-technical leadership. It states the audit scope, overall posture, the most material findings in plain language, and the required actions. It must be self-contained: a reader who reads only the summary should understand the key risks and what must be done.
- Position
- Opening section of an audit report
- Audience
- Non-technical leadership
- Contents
- Scope, overall posture, material findings, required actions
- Requirement
- Self-contained, understandable on its own
Common questions
How is an executive summary different from the report's full findings section?+
The full findings section documents every issue in technical detail for the audit trail. The executive summary distills only the most material findings into plain language, so a leader who reads nothing else still understands the key risks and needed actions.
What makes an executive summary self-contained rather than a preview?+
It must state its own scope, posture, and conclusions clearly enough that a reader who never opens the rest of the report can still make an informed decision, rather than relying on details found only later in the document.
Related terms
- Finding
- A discrete, evidence-backed statement that a specific control is absent, misconfigured, or insufficient. Each finding contains an issue statement, evidence, risk rating,...
- Management Response
- The audited organisation's formal reply to each finding, included in the report. It states whether the recommendation is accepted, rejected, or accepted...
- Nonconformity
- The ISO 27001 term for a finding that represents a failure to meet a requirement of the standard or the organisation's own...
- Observation
- A noted issue or improvement opportunity that does not constitute a formal finding because it lacks sufficient evidence or does not violate...
- Risk Rating
- A classification of a finding's severity, typically Critical, High, Medium, Low, or Informational, derived from a likelihood-by-impact matrix. The rating determines remediation...