Every auditor has seen it. The fieldwork was solid, the evidence is clear, and yet the closing meeting turns into an argument about wording. Or worse, management accepts the finding without discussion, agrees an action date, and the same issue appears again in next year's audit.
Both outcomes usually trace back to how the observation was written. A finding is not a record of what the auditor saw. It is an argument for change, written for a reader who did not do the fieldwork and has other priorities.
The four elements, done properly
The Institute of Internal Auditors' Global Internal Audit Standards expect findings to be built from criteria, condition, cause and effect. Most reports include all four headings. Far fewer use them well.
Criteria: what should be happening
State the expectation precisely and cite where it comes from: a policy clause, a regulation, a standard or an agreed practice. "Access should be appropriate" is not a criterion. "Policy IS 07 section 4.2 requires privileged access to be reviewed quarterly by the system owner" is.
Condition: what is actually happening
Describe facts, with numbers and scope. "Some reviews were not performed" invites debate. "Reviews for 3 of 8 critical systems were not performed in Q2 and Q3, covering 41 privileged accounts" does not. Avoid adjectives like "weak" or "inadequate"; let the facts carry the weight.
Cause: why it is happening
This is where most findings fail. "Lack of awareness" or "oversight" are symptoms, not causes. Keep asking why until you reach something management can change: no owner was assigned when the system went live, the review tool cannot extract database accounts, or the process depends on one person who left. A finding with the wrong cause produces an action plan that fixes nothing.
Effect: why it matters
Translate the gap into business terms. Not "risk of unauthorised access" but "a former administrator's account remained active for five months on the payments system, which could allow fraudulent transactions without detection." Leadership acts on consequences, not on control language.
Recommendations that land
A good recommendation addresses the cause, not the condition. If reviews were missed because no owner exists, "perform the missed reviews" fixes this quarter and nothing more. "Assign named owners for each critical system and add ownership to the go live checklist" fixes the process.
Keep recommendations specific enough to verify, but leave room for management to choose how. Agree the action, owner and date in the meeting, and test that the action actually answers the cause before you accept it.
Practical habits that help
- Lead with the headline. One sentence that states the issue and its impact, so a busy executive understands it without reading further.
- Validate facts early. Share the condition with the process owner during fieldwork. Disputes about facts belong before the report, not in the closing meeting.
- Rate consistently. Use a clear rating scale tied to impact and likelihood, and apply it the same way across audits.
- Group related issues. Five findings with the same root cause are one finding with five examples.
- Write for the reader. Short sentences, plain words, no audit jargon, and no blame directed at individuals.
Before you issue, ask yourself
- Would someone who did not do the fieldwork understand exactly what is wrong?
- Is every statement in the condition supported by evidence on file?
- Have I found the real cause, or stopped at the first convenient one?
- Would fixing my recommendation prevent this finding next year?
Audit reports are judged by what changes after they are issued. Precise criteria, factual conditions, honest causes and consequences in business terms turn a finding from something to defend against into something worth fixing. That is the difference between an audit that is accepted and one that is acted on.