Excellent article, covering waaay more than I expected.
Although 'of course' I would have quite some sideline comments like the findings not being required to be in the format listed (rather, C-C-Remainder risk-Cause-Recommendation works better with those responsible (and links to resources like ISACA and others might have helped), I think this is a very worthwhile overview of what audits are about.
Thanks for probably taking away much subconscious fear... The uncertainty and doubt, well, will be brought back in by the auditors ...? ;-)

You also need to include the work that goes in the beginning, such as defining the Audit universe, the risk & frequency models, determining those areas of greatest risk or concern to the company. These things help define those areas or subjects for auditing, which can then be scoped out.

Though this article does not include a description of the auditor's planning process, that topic is covered in a book I wrote for the Information Systems Audit and Control Association: Stepping Through the IS Audit, A Guide for Information Systems Managers, 2nd Edition. Published in 2005, it is now free online to ISACA members, and also available to non-members at the ISACA online bookstore or Amazon.