Back to: Point of View
As auditors, we must write our testing narratives and report documentation in the 2nd Person writing style. Be sure you understand the differences between first person (I), second person (you), and third person (narrator), point of view writing styles.
For example, in the following control requirement example:
“The organization develops, documents, and disseminates to [Assignment: organization-defined personnel or roles] an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.”
An example of an acceptable 2nd person test description for the example control requirement would be:
“The auditor verified through examination of the annually renewed Access Control Policy V2, dated July 4, 2022, approved by the CISO, that all employees, contractors, part-time and temporary workers, and those employed by others to perform work on Client Name premises or who have been granted access to Client Name information or systems, are covered by the policy standard and are required to comply with associated guidelines and procedures.”
In this example, the auditor described the Client’s “People”, “Processes” and “Policy”, but not the “Technologies” to satisfy the requirement.
Related Posts