ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
49. Content of audit report.
Edition: 2024-02-16 · In force
49. Content of audit report.
(1)Upon concluding the audit exercise, the auditor shall prepare an audit report which shall contain the following—(a)summary of the audit findings identified during the audit exercise;(b)any systemic finding within the critical information infrastructure, which may result in a weakness in the design of a critical information infrastructure;(c)a recurring finding identified from past audits and that reoccurs irrespective of the recommended corrective action being done; and(d)recommended good practices in the governance and controls of the critical information infrastructure identified during the audit.(2)The auditor shall provide recommendations on any of the following areas—(a)appropriateness of the management’s response or proposed actions to the audit finding;(b)adequacy and effectiveness of the controls put in place by the owner of the critical information infrastructure to mitigate on the identified risks to the critical information infrastructure; and(c)opportunities for improvement to secure the critical information infrastructure.(3)The audit of critical information infrastructure undertaken under these Regulations may take any format provided that the elements specified under these Regulations are incorporated.(4)Without prejudice to paragraph (3), the audit report may be in the manner provided in Form CMCA 6 set out in the Third Schedule.