ServiceNow Interview Question

How do you typically audit ISMS? How do you communicate findings?