What should an IS auditor do if corrective actions have been taken after identifying a reportable finding?

When corrective actions have been taken in response to a reportable finding, the auditor should include the finding in the final report to provide a comprehensive overview of the audit process. This inclusion serves multiple purposes: it documents the initial issue for transparency, highlights the auditor's observations regarding the effectiveness of the corrective actions, and provides context for future audits or assessments.

Including the finding in the final report ensures that the organization understands the significance of the issue, allows for accountability in the remediation process, and aids in improving the organization's overall risk management and control posture. It also demonstrates to stakeholders that the auditor has conducted due diligence in recognizing not only the problems but also the responses to those issues.

While documenting the finding for verification or discussing it in a closing meeting might carry some value, they do not provide the same level of formal recognition necessary for ongoing improvement and accountability. Not including the finding in the final report would leave a gap in the audit trail, potentially diminishing its effectiveness as a tool for organizational learning and development. Thus, including the finding in the final report is essential for maintaining transparency and fostering continuous improvement within the organization.