The auditor can submit (i) one audit report for both cybersecurity and COI audits combined or (ii) two separate audit reports. If the auditor choose to submit one audit report for both audits, the auditor must indicate clearly from which audit were the findings were found, or from where the audit conclusion was drawn.
The audit report must follow the report format as stipulated in the audit guidance document titled “Guidelines For Auditing Critical Information Infrastructure” on CSA’s website (https://www.csa.gov.sg/legislation/supplementary-references).
For the COI audit, the auditor should also complete an audit worksheet titled “Implementation of COI Recommendations - Audit Template” and submit it together with the audit report.