This sample IT risk assessment audit report presents findings from an entity-level risk analysis review.

In this sample, Sarbanes-Oxley requires that executive officers of public companies confirm that a clearly understood internal control environment exists at the senior levels of the overall enterprise as well as the operating units and that the internal control environment is enforced and effective. The objective of this entity-level assessment is to confirm the existence of internal controls (e.g., policies, business practices, people, methodologies, etc.) and query senior finance executives for their individual impression of specific attributes that define key internal controls.