I thought the report format and detailed assessments were very well done by Canada's IT audit team.  This is one of the best recent assessments I've seen.  It's worth speed reading through for anyone involved in IT security.

http://www.oag-bvg.gc.ca/domino/reports.nsf/html/20050201ce.html

Quote: Despite encouraging signs of improvement, the government has made unsatisfactory progress in strengthening information technology (IT) security since our audit in 2002. It has laid a foundation by developing IT security policies and standards, and lead agencies and departments are more involved and committed to IT security. However, two and a half years after revising its Government Security Policy, the government has much work to do to translate its policies and standards into consistent, cost-effective practices that will result in a more secure IT environment in departments and agencies