Sample reports

Every audit firm will describe its reports. Few will show you one, because a real report belongs to the client who commissioned it and usually says things that client would rather not publish. So these are written against a protocol that does not exist, which lets us publish them whole rather than redacted to the point of being useless.

They are the actual templates. Same structure, same severity definitions, same scoping language, same statement of what fell outside the review. What changes on a real engagement is the protocol and the findings.

Four deliverables, because four different questions get asked. A technical audit works line by line through the contracts and proves each finding. A business logic audit asks a separate question: whether the product does what its documentation claims, which is not something a line-by-line review is built to catch. A compliance audit traces each design decision to the licence or duty it triggers in a given market. An access control review maps every address and account holding power over the system, and what each one can do with it.

Read them for the parts that are uncomfortable. The severity definitions, so you can judge what another firm means by "medium". The scope statement, which says what was not examined. The limits section, which is where an honest report admits what it cannot tell you.