How to Write an Internal Audit Finding: Stop Writing Recommendations and Start Getting Management to Own the Solution
Updated: 2 hours ago
Using SPIN Selling to Overcome Management Denial and Develop Effective Management Action Plans
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Internal Audit Tradecraft Series
One of the most important skills an internal auditor must develop is the ability to communicate an audit finding in a manner that causes management to recognize a problem and take responsibility for correcting it.
Unfortunately, traditional internal audit reporting often follows a process that undermines this objective.
The auditor identifies a control weakness, documents the condition, explains the risk, and then writes a recommendation telling management how to correct the problem.
Management responds, sometimes reluctantly, and the auditor subsequently follows up to determine whether the recommendation was implemented.
I believe this approach has a fundamental weakness.
Internal auditors should identify and explain problems. Management should determine how to solve them.
Management operates the business. Management understands the people, systems, processes, budgets, operational constraints, and competing priorities.
Internal auditors generally do not possess the same depth of operational knowledge as the first- and second-line management functions.
Furthermore, when auditors prescribe solutions, management may become defensive, challenge the auditor's understanding, or implement a recommendation without accepting responsibility for its effectiveness.
A better approach is to use the principles of SPIN Selling to help management understand the finding, recognize its implications, and develop its own corrective action.
The result should be a documented Management Action Plan, not an auditor-prescribed recommendation.
This approach can improve management accountability, preserve internal audit objectivity, and increase the likelihood that corrective actions address the underlying risk.
1. What Is an Internal Audit Finding?
An internal audit finding communicates a significant difference between what should be happening and what the auditor determined is actually happening.
A well-developed finding should provide enough information for management and the Audit Committee to understand the issue, its significance, and why action is necessary.
The traditional elements of an audit finding include:
Element | Purpose |
Criteria | What should be happening? |
Condition | What did the auditor find? |
Cause | Why did the condition occur? |
Effect or risk | What are the actual or potential consequences? |
Significance | How important is the issue? |
Management Action Plan | What will management do, who owns it, and when will it be completed? |
The first five elements establish the problem and its importance.
The final element establishes management's accountability for resolving it.
An auditor's responsibility is to develop an accurate, evidence-based finding.
Management's responsibility is to decide how the organization will address the finding and manage the associated risk.
These responsibilities should remain distinct.
2. Why I Do Not Favor Auditor Recommendations
The traditional recommendation model assumes that an auditor who identifies a weakness is also well-positioned to determine the appropriate operational solution.
That assumption is frequently questionable.
Consider an internal auditor reviewing a purchasing department.
The auditor may understand COSO, segregation of duties, authorization controls, fraud risks, and audit evidence.
However, the purchasing manager may possess substantially greater knowledge of the organization's procurement software, staffing limitations, vendor relationships, transaction volumes, and operational requirements.
The auditor may identify that purchase orders are being approved after goods have been received.
That is a legitimate finding.
But should the auditor prescribe a specific approval workflow without fully understanding the operational consequences?
In my view, the answer is generally no.
The auditor should explain the control weakness and associated risks.
Management should determine the corrective action.
There are several reasons for this distinction.
Management has deeper operational knowledge
The first and second lines generally possess greater knowledge of the systems and processes involved in day-to-day operations.
They are better positioned to evaluate implementation costs, operational feasibility, staffing requirements, and alternative control designs.
Management owns the internal control framework
Under the IIA Three Lines Model, management is responsible for managing risks and maintaining effective controls.
Internal audit provides independent assurance and advice.
The auditor should not become the operational owner of the solution.
Auditor recommendations can weaken accountability
When management implements an auditor's prescribed recommendation, responsibility can become blurred.
If the solution does not work, management may argue that it simply followed the auditor's instructions.
A Management Action Plan establishes a clearer allocation of responsibility.
Auditor recommendations can increase defensiveness
Management may view a recommendation as criticism of its professional competence.
Instead of focusing on the underlying risk, management begins defending the existing process or challenging the auditor's proposed solution.
The discussion becomes a disagreement over how to operate the department rather than an examination of the problem.
Auditor recommendations can create objectivity concerns
Providing advice is a legitimate internal audit activity.
However, when an auditor designs a specific control and later evaluates that same control, safeguards may be needed to address potential impairments to objectivity.
Having management develop and implement its own action plan helps maintain clear ownership.
The internal auditor should own the finding. Management should own the corrective action.
3. The Global Internal Audit Standards Support Management Action Plans
The 2024 IIA Global Internal Audit Standards, effective January 9, 2025, provide an important basis for this approach.
Standard 14.4, Recommendations and Action Plans, allows internal auditors to determine whether to develop recommendations, request action plans from management, or collaborate with management to agree on corrective actions.
This is a significant distinction.
The Standards do not require the auditor to prescribe a recommendation for every finding.
Management-developed action plans are an expressly recognized approach.
Standard 14.4 also requires appropriate consideration of whether the proposed actions address the finding, mitigate risk, and address its root cause.
Therefore, requesting a Management Action Plan does not mean the auditor simply accepts whatever management proposes.
The auditor must evaluate whether the proposed response is reasonable and adequate.
The Standards also require internal audit to confirm implementation of recommendations or action plans through an established methodology under Standard 15.2.
The allocation of responsibilities is clear: Management develops and implements the corrective action. Internal Audit evaluates the adequacy of the response and independently confirms implementation.
This is consistent with the purpose of internal auditing and the separation of management and assurance responsibilities.
4. The Real Challenge: Management Denial
One of the most difficult aspects of communicating audit findings is dealing with management denial.
Management personnel may not agree that a problem exists.
They may acknowledge the condition but dispute its significance.
They may argue that existing controls are sufficient.
They may believe that the risk is theoretical or that the auditor does not understand the business.
Typical responses include:
"We have always done it this way."
"We have never experienced a problem."
"The auditor does not understand our process."
"We do not have the resources to change."
"This is not a significant risk."
"Our employees know what they are doing."
"We have compensating controls."
Some of these statements may reflect legitimate operational considerations.
Others may represent denial, defensiveness, or an incomplete understanding of risk.
The auditor should not automatically interpret disagreement as denial.
Management may possess evidence or operational knowledge that changes the audit conclusion.
But when the evidence establishes a meaningful control weakness, the auditor needs a method for helping management recognize the problem.
Simply repeating the finding more forcefully is often ineffective.
This is where SPIN Selling becomes valuable.
5. What Is SPIN Selling?
SPIN Selling is a consultative questioning methodology developed by Neil Rackham from research into sales interactions.
The approach focuses on helping another party understand a problem and recognize the value of addressing it.
SPIN represents four categories of questions:
SPIN element | Objective |
Situation | Understand the current process and circumstances |
Problem | Identify difficulties, weaknesses, and dissatisfaction |
Implication | Explore the consequences of leaving the problem unresolved |
Need-Payoff | Help the other party articulate the benefits of solving the problem |
SPIN was developed for consultative selling, its questioning structure adapts to internal audit communications. Internal Auditing is a very detailed version of consultative selling.
Internal auditors are not selling products.
They are helping management understand risks and recognize the value of effective corrective action.
This requires listening, questioning, evidence, and professional judgment.
The objective is not to manipulate management into agreeing with the auditor.
The objective is to establish a shared understanding of the facts and risks so management can make an informed decision.
6. Step One: Situation Questions
Situation questions establish how the process currently operates.
The auditor should understand the operational environment before discussing weaknesses.
Consider an audit of vendor banking-information changes.
The auditor might ask:
How are vendor banking-information changes received?
Who is authorized to make changes?
What systems are used?
How are change requests authenticated?
Who approves changes?
How are employees trained?
What reports are available to management?
How does management monitor unusual changes?
These questions provide context.
They also demonstrate that the auditor is interested in understanding the process rather than immediately criticizing it.
Effective auditors should already have much of this information from their fieldwork.
SPIN questioning is not a substitute for audit evidence.
It is a communication technique that helps establish a shared understanding.
7. Step Two: Problem Questions
Problem questions help management recognize weaknesses or difficulties in the existing process.
Suppose the auditor has identified vendor banking changes made without independent verification.
Rather than immediately stating that management must implement a new approval process, the auditor might ask:
How do you know that a banking change request came from an authorized vendor representative?
What happens when the person requesting the change is not independently verified?
Could an employee change banking information without another person reviewing the request?
How would management detect an unauthorized change?
What would prevent a fraudulent email from redirecting a vendor payment?
These questions direct attention to the actual control weakness.
The auditor should support the discussion with evidence obtained during the engagement.
For example:
"During our testing, we identified 12 banking-information changes for which independent verification was not documented."
That is a factual observation.
The questions then help management evaluate the implications.
8. Step Three: Implication Questions
Implication questions are particularly valuable when management minimizes the significance of a finding.
They help management consider the consequences of allowing the condition to continue.
For the vendor banking-information example, the auditor might ask:
What could happen if a fraudulent banking change were processed?
How much money could be transferred before the error was detected?
What would be the financial consequences of a $500,000 payment being redirected?
How would the organization recover the funds?
What would be the impact on vendor relationships?
Could the organization experience business interruption?
How would management explain the event to the Board?
What regulatory or legal obligations might arise?
The purpose is to connect the control weakness to meaningful organizational consequences.
An auditor may describe a control deficiency in technical terms.
Management is more likely to recognize its significance when the discussion addresses financial exposure, operational disruption, reputational damage, and accountability.
However, the auditor should distinguish plausible risks from established losses and should not exaggerate potential consequences.
A finding becomes more compelling when management understands what could happen if the problem remains unresolved.
9. Step Four: Need-Payoff Questions
Need-Payoff questions help management identify the value of correcting the problem.
This is the point at which the conversation shifts from identifying weaknesses to considering improvements.
For example:
What would improve if every banking-information change were independently authenticated?
How could stronger verification reduce the likelihood of payment diversion?
Would a reliable audit trail make investigations easier?
What would management gain from better visibility into high-risk vendor changes?
How could the organization strengthen controls without unnecessarily delaying legitimate payments?
What corrective approach would work best within your existing systems?
The final question is especially important.
The auditor is not prescribing the solution.
Management is being asked to determine how the risk should be addressed.
This approach respects management's operational expertise while maintaining the auditor's focus on the control objective.
10. A Complete SPIN Conversation: Vendor Banking-Information Changes
Consider the following practical example.
Audit finding: Vendor banking information can be changed without documented independent authentication.
Management's initial response: "We have never had a fraudulent payment, so we do not believe this is a significant problem."
Situation
Auditor: "How does your team currently verify that a banking information change request came from the vendor?"
Management: "We receive an email from the vendor and update the system."
Problem
Auditor: "If someone impersonated the vendor and sent a convincing email, what control would identify the impersonation?"
Management: "We generally recognize the vendors we work with, but there is no separate verification requirement."
Implication
Auditor: "If a fraudulent request changed the banking information for a major vendor, what would happen when the next payment was processed?"
Management: "The payment could go to the wrong account."
Auditor: "How quickly would the organization identify the error, and what might be the financial exposure?"
Management: "It could take several days. Some of our vendor payments exceed $250,000."
Need-Payoff
Auditor: "What would be the benefit of a process that independently verified high-risk changes before payment?"
Management: "It would reduce the likelihood of a fraudulent banking change."
Auditor: "Given your systems and staffing, what approach would management consider practical?"
Management: "We could require a callback using an independently established vendor telephone number and have a supervisor approve the change before it becomes effective."
At this point, management has identified a potential corrective action.
The auditor can evaluate whether the proposed approach adequately addresses the risk.
Management can then document the agreed action in a Management Action Plan.
This is fundamentally different from the auditor issuing a recommendation that management must implement a specific callback procedure.
The corrective action originates with management.
11. How to Write the Finding Without an Auditor Recommendation
A practical internal audit finding should communicate the problem clearly and allow management to develop the corrective action.
Example: Vendor Master File Changes
Finding title: Inadequate Authentication of Vendor Banking-Information Changes
Risk rating: High, based on the organization's defined risk assessment criteria.
Criteria
Vendor banking-information changes should be subject to controls designed to authenticate the request and prevent unauthorized payment redirection.
Condition
Internal Audit examined 40 vendor banking-information changes processed during the audit period.
Twelve changes did not contain documentation demonstrating independent verification of the requesting party.
In addition, the system permitted designated Accounts Payable personnel to modify banking information without an independent approval.
Cause
Management had not established a consistent control process requiring independent authentication and approval of vendor banking-information changes.
Effect or Risk
The condition increases the risk that fraudulent or unauthorized banking-information changes could result in payments being redirected to unintended recipients.
The potential exposure depends on the value and timing of payments processed after a change.
Management Action Plan
Accounts Payable management will establish a documented verification process for vendor banking-information changes.
The process will include independent authentication using previously established contact information, supervisory approval before changes become effective, and retention of supporting evidence.
Responsible management owner: Accounts Payable Manager
Target completion date: December 15, 2026
Internal Audit follow-up: Internal Audit will evaluate the implementation and operating effectiveness of the revised controls using a risk-based follow-up procedure.
Notice what is missing.
There is no separate auditor recommendation.
The finding identifies the condition, explains the risk, and documents management's corrective action.
Management owns the response.
Internal Audit retains responsibility for evaluating whether the response adequately addresses the finding.
12. What Makes a Good Management Action Plan?
A Management Action Plan should be specific enough to permit accountability and meaningful follow-up.
At a minimum, it should identify:
Component | Required information |
Corrective action | What management intends to change |
Risk addressed | Which deficiency or exposure the action addresses |
Responsible owner | The individual accountable for implementation |
Target completion date | When the action is expected to be completed |
Implementation evidence | What documentation will demonstrate completion |
Effectiveness criteria | How management and Internal Audit will assess whether the action works |
The plan should address the root cause rather than merely the symptoms.
For example, if vendor banking changes are not independently authenticated, providing employee training alone may be insufficient.
Training can improve awareness.
But the organization may also need an enforceable process, system controls, monitoring, or other measures.
Management should determine the appropriate solution.
The auditor should evaluate whether the proposed plan reasonably mitigates the identified risk.
13. Internal Audit Must Still Challenge an Inadequate Action Plan
Eliminating auditor recommendations does not mean eliminating professional judgment.
Suppose management responds to the vendor banking-information finding with the following plan:
"We will remind employees to be more careful when processing vendor changes."
That response may not adequately address the root cause.
The auditor should not automatically accept it.
Instead, the auditor can return to the SPIN methodology.
Problem: "What specific control would prevent an unauthorized change?"
Implication: "If an employee overlooked the reminder, what would stop the payment from being redirected?"
Need-Payoff: "What process would give management greater assurance that the request was authentic before the change becomes effective?"
Management should be given the opportunity to strengthen its plan.
If management continues to propose an inadequate response, Internal Audit should document the disagreement and follow the organization's established escalation methodology.
Significant unresolved risks may need to be communicated to senior management and the Audit Committee.
Management owns the corrective action, but Internal Audit does not have to agree that an inadequate corrective action resolves the finding.
14. Root Cause Analysis Should Come Before the Action Plan
An effective Management Action Plan should address why the deficiency occurred.
Consider an audit finding involving late bank reconciliations.
The condition may be straightforward: reconciliations were not completed within the required period.
But several different root causes are possible.
The department may lack sufficient staffing.
The accounting system may not produce reliable information.
Management may have failed to assign responsibility.
Supervisory review may be ineffective.
The established deadline may be impractical.
Each cause could require a different response.
If the auditor prescribes a recommendation before understanding the cause, the solution may be ineffective.
SPIN questioning can help clarify the underlying problem.
The auditor should work with management to understand the root cause while remaining objective.
The resulting action plan should address that cause and establish appropriate accountability.
15. The Role of the First and Second Lines
The IIA Three Lines Model provides an important foundation for the Management Action Plan approach.
First Line: Operational Management
First-line management is responsible for delivering products and services and managing the risks associated with operational activities.
These managers generally understand how processes actually function.
They should take responsibility for correcting weaknesses in the activities they manage.
Second Line: Risk, Compliance, and Control Support
Second-line functions provide expertise, support, monitoring, and challenge concerning risk-related matters.
They may help operational management evaluate corrective alternatives and design appropriate risk management processes.
Third Line: Internal Audit
Internal Audit provides independent assurance and advice concerning the adequacy and effectiveness of governance, risk management, and controls.
Its role is to evaluate, communicate, and follow up.
The Management Action Plan approach reinforces these distinctions.
The first and second lines determine how the organization will manage the risk.
Internal Audit evaluates whether the risk is being managed effectively.
16. How to Handle Management That Refuses to Acknowledge a Finding
Sometimes management remains unwilling to acknowledge a deficiency even after the auditor presents evidence and discusses the implications.
The auditor should not assume that every disagreement is evidence of denial.
Management may identify an error in the audit analysis or provide evidence of compensating controls.
The auditor must evaluate that information objectively.
However, if the evidence continues to support the finding, the auditor should not withdraw it simply to obtain management agreement.
A disciplined escalation process should include:
Confirming the accuracy and completeness of the audit evidence.
Giving management an opportunity to explain its position.
Evaluating any new evidence or compensating controls.
Clearly communicating the residual risk.
Documenting unresolved differences.
Following established escalation procedures.
Reporting significant unresolved matters to the appropriate governance level.
SPIN is a method for improving understanding.
It is not a substitute for evidence or an obligation to achieve agreement at any cost.
17. What Should the Audit Committee Receive?
The Audit Committee should receive clear information concerning significant findings and management's response.
For each important issue, the report should identify the nature of the deficiency, associated risk, significance, responsible management owner, planned corrective action, and implementation deadline.
The Committee should also know when management disputes a finding or declines to take action.
The Committee's responsibility is not to design the operational solution.
It is to oversee management accountability and determine whether significant risks are receiving appropriate attention.
A report that clearly identifies management ownership helps the Committee perform that role.
18. Following Up on Management Action Plans
Internal Audit should establish a process for confirming whether management has implemented agreed action plans.
The extent of follow-up should reflect the significance of the finding.
For example, a high-risk vendor payment control weakness may require testing actual transactions after the revised control is implemented.
Simply obtaining management's statement that the process has changed may not provide sufficient assurance.
Follow-up procedures may include reviewing revised policies, examining system configurations, testing selected transactions, and evaluating evidence of supervisory review.
The auditor should distinguish between two questions:
Was the action implemented?
Did the action adequately address the identified risk?
Both matter.
A corrective action may be fully implemented yet fail to achieve its intended control objective.
If significant risk remains, the auditor should communicate that conclusion and determine the appropriate further response.
19. Measuring the Effectiveness of Audit Findings
Traditional internal audit performance measures often emphasize the number of findings issued and the percentage of recommendations implemented.
Those measures can be misleading.
An audit department that issues 100 recommendations has not necessarily created more value than one that identifies 10 significant risks and obtains effective management responses.
More useful measures may include:
Percentage of significant findings with management-owned action plans.
Timeliness of management responses.
Percentage of action plans completed by agreed dates.
Percentage of completed plans independently validated.
Number of recurring deficiencies.
Reduction in significant residual risks.
Number of unresolved high-risk matters reported to the Audit Committee.
These measures place greater emphasis on accountability and results.
They also reinforce that management, not Internal Audit, is responsible for implementing corrective action.
20. Practical Internal Audit Finding Template
The following structure can be adopted for internal audit reports.
Finding title: A concise description of the deficiency.
Risk rating: The significance of the finding using the organization's established criteria.
Criteria: The policy, procedure, control objective, regulatory requirement, or other appropriate benchmark.
Condition: The facts established through audit testing.
Root cause: The underlying reason the deficiency occurred, when reasonably determinable.
Effect or risk: The actual or potential consequences.
Management response: Management's position concerning the finding, including any disagreement.
Management Action Plan: The corrective action developed and owned by management.
Accountable owner: The individual responsible for ensuring implementation.
Target date: The agreed completion date.
Internal Audit evaluation: The auditor's assessment of whether the action plan adequately addresses the finding and its underlying risk.
Follow-up: The procedures Internal Audit intends to use to confirm implementation and, where appropriate, effectiveness.
This format supports clear communication without requiring the auditor to prescribe an operational solution.
21. Why SPIN Should Be Part of Internal Audit Tradecraft
Effective internal auditing requires more than technical knowledge.
Auditors must understand human behavior, organizational culture, management incentives, communication, and resistance to change.
An auditor may identify a serious control deficiency and prepare a technically correct report.
But if management does not understand the risk or accept responsibility for addressing it, the audit may have limited practical impact.
SPIN questioning provides a structured way to improve that conversation.
Situation questions establish understanding.
Problem questions identify the weakness.
Implication questions help management recognize the consequences.
Need-Payoff questions help management identify the value of corrective action.
This approach requires active listening, professional skepticism, and strong communication skills.
It also requires the auditor to recognize that management may possess important information the auditor has not yet considered.
The objective is not to win an argument.
The objective is to achieve a well-supported understanding of the risk and obtain an appropriate management-owned response.
Conclusion: Internal Audit Should Identify the Problem, Not Own the Solution
A strong internal audit finding should explain what is wrong, why it matters, and what risk the organization faces.
It should be supported by sufficient, relevant, and reliable evidence.
But the auditor should not automatically prescribe how management must operate the business.
Management has responsibility for the organization's internal control framework.
Management also generally has deeper knowledge of its operational systems, personnel, processes, and practical constraints.
For those reasons, I favor Management Action Plans over auditor recommendations.
The SPIN Selling methodology provides a useful approach for overcoming defensiveness and helping management understand the need for change.
It moves the discussion away from the auditor telling management what to do and toward management identifying how it will address a recognized risk.
Internal Audit must still evaluate the proposed plan, challenge inadequate responses, and independently confirm implementation.
The resulting allocation of responsibility is both clear and effective:
Internal Audit owns the evidence, finding, and independent evaluation. Management owns the decision, corrective action, and results.
That is how an internal audit finding can become a meaningful contribution to stronger governance, risk management, and internal control.
Develop Stronger Internal Audit Reporting and Communication Skills With CCS
Corporate Compliance Seminars (CCS) provides continuing professional education for internal auditors, Chief Audit Executives, and Audit Committee members.
Our programs address internal audit reporting, root cause analysis, risk assessment, professional skepticism, communication skills, internal controls, and the Global Internal Audit Standards.
Effective auditors must be able to identify risks, develop defensible findings, and communicate with management in ways that lead to meaningful corrective action.
Explore our internal auditing and professional development programs at www.compliance-seminars.com
Comments