The Five Elements of an Effective Audit Finding: How Internal Auditors Turn Problems Into Corrective Action
Condition, Criteria, Cause, Effect, and Recommendation — A Practical Guide to Writing Audit Findings That Management Will Act Upon
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Internal Auditing, Audit Reporting, and Internal Controls
An internal audit finding should accomplish more than identify something that went wrong.
A well-developed finding explains what happened, why it matters, what caused the problem, and what management needs to address to prevent it from recurring.
Unfortunately, many audit reports contain findings that identify deficiencies without providing enough information to support meaningful corrective action.
Some findings describe a problem but never establish the requirement that was violated.
Others recommend additional procedures without identifying the underlying cause. Still others focus on minor compliance exceptions without explaining the organization's exposure to risk.
The result is an audit report that may be technically accurate but fails to influence management.
The purpose of an effective audit finding is not simply to document a deficiency. It is to help management understand the risk, accept responsibility, and implement corrective action.
One practical approach is to structure audit findings around five elements:
Condition — What did the auditor find?
Criteria — What should have happened?
Cause — Why did the problem occur?
Effect — What is the consequence or risk?
Management Action Plan — What is management's plan?
These elements provide a framework for communicating audit results clearly and persuasively.
However, the most important principle is that management owns the internal control framework and the corrective action plan. Internal Audit provides independent assurance and recommendations; it does not assume responsibility for management's controls.
1. Condition: What Did the Auditor Find?
The condition describes the actual situation identified during the audit.
It should be factual, specific, objective, and supported by sufficient, reliable, relevant, and useful evidence.
The condition answers a simple question:
What is happening?
For example:
"During testing of 40 vendor master file changes, Internal Audit identified 9 changes to vendor banking information that lacked documented independent verification."
This statement identifies the population tested, the number of exceptions, and the control deficiency.
It is more informative than a vague statement such as: "Vendor controls need improvement."
An effective condition should explain the deficiency without exaggeration or unnecessary criticism.
Best practices for documenting the condition
Auditors should identify the process reviewed, testing performed, exceptions discovered, and supporting evidence.
Where appropriate, the condition should quantify the frequency or magnitude of exceptions.
However, auditors should distinguish between exceptions identified in a sample and conclusions about the entire population.
For example, finding 9 exceptions in a sample of 40 transactions does not automatically establish that 22.5% of all transactions are deficient.
The sampling methodology and applicable audit evidence must support any broader conclusion.
The condition establishes the facts. It should not substitute assumptions for evidence.
2. Criteria: What Should Have Happened?
The criteria establish the standard against which the condition is evaluated.
Criteria may come from laws, regulations, contracts, organizational policies, management-approved procedures, control objectives, or recognized frameworks.
The criteria answer: What is the expected requirement or acceptable level of performance?
For example:
"Company policy requires all changes to vendor banking information to be independently verified using previously established contact information before the change is approved."
The condition can now be evaluated against a specific requirement.
Without criteria, the finding may represent the auditor's personal preference rather than a demonstrable control deficiency.
Sources of audit criteria
Common sources include:
Organizational policies and procedures.
Laws and regulatory requirements.
Contractual obligations.
COSO Internal Control–Integrated Framework.
GAO Standards for Internal Control in the Federal Government.
Industry-specific control requirements.
Management-approved performance objectives.
Established control objectives and risk tolerances.
Auditors should use criteria applicable to the organization and engagement.
For example, the GAO Green Book is mandatory for federal agencies and may also be adopted or applied in other governmental environments. It should not automatically be described as legally binding on every private company or public school district.
When no formal policy exists, the auditor may identify a relevant risk or control objective and discuss appropriate criteria with management.
The auditor should not invent a policy and then report that management violated it.
3. Cause: Why Did the Problem Occur?
The cause identifies the underlying reason the condition exists.
This is often the most difficult and most valuable element of an audit finding.
It answers: Why did the control fail?
Auditors frequently identify the immediate symptom but fail to investigate the underlying cause.
For example: "Employees did not follow the vendor verification procedure."
That statement may describe the immediate failure, but it does not explain why employees failed to follow the procedure.
Possible causes could include inadequate training, unclear responsibilities, insufficient supervisory review, poorly designed workflows, conflicting performance expectations, or ineffective management monitoring.
Each possibility suggests a different corrective action.
Root cause analysis
An effective root cause analysis examines the organizational conditions that allowed the deficiency to occur.
Auditors can use techniques such as the Five Whys, process walkthroughs, interviews, and control design analysis.
Consider this example:
Problem: Vendor banking changes were processed without independent verification.
Why 1: Employees approved changes based on email instructions.
Why 2: The workflow did not require independent authentication before approval.
Why 3: The system permitted employees to complete changes without recording verification.
Why 4: Management had not established a mandatory verification control within the workflow.
Why 5: The vendor change process had not been adequately evaluated for business email compromise and payment diversion risks.
The analysis suggests a process design and risk assessment weakness rather than merely an employee performance problem.
The auditor should verify the cause through appropriate evidence and management discussions.
Not every apparent cause will be supported.
Why the cause matters
A finding that does not identify the underlying cause may lead management to implement a superficial corrective action.
For example, additional employee training may not solve a problem caused by an ineffective system design.
Correcting symptoms without addressing causes allows control deficiencies to recur.
4. Effect: Why Does the Finding Matter?
The effect explains the actual or potential consequences of the condition.
It answers:
So what?
An audit finding becomes more meaningful when management understands the risk created by the deficiency.
Effects may involve financial losses, fraud exposure, regulatory noncompliance, operational inefficiency, inaccurate reporting, reputational damage, or failure to achieve organizational objectives.
For example:
"Failure to independently verify changes to vendor banking information increases the risk that fraudulent requests could redirect payments to unauthorized bank accounts."
This statement explains the potential consequence without claiming that fraud actually occurred.
Actual effects versus potential effects
Auditors must distinguish between documented consequences and possible risks.
Potential effect: Inadequate banking change verification increases the likelihood that future payments could be diverted.
Both may be important, but they are not interchangeable.
A potential loss should not be presented as an actual loss.
Similarly, auditors should avoid unsupported statements that every control deficiency creates a material weakness.
Materiality and deficiency severity require evaluation under the applicable framework and circumstances.
Quantifying the effect
Where reliable information is available, auditors should quantify the consequences.
Examples include the dollar amount of unsupported payments, hours spent correcting errors, number of affected customers, or value of transactions exposed to a control deficiency.
Quantification helps management prioritize corrective action.
However, a control weakness can be significant even when no loss has yet occurred.
The absence of a detected loss does not prove that the control is effective.
5. Manatement Action Plan: What is Management's Plan?
The management action plan identifies the control improvement or corrective direction that should address the underlying cause and reduce the risk.
It answers:
What needs to change?
For the vendor banking example:
"Management will establish a mandatory independent authentication control for vendor banking changes, supported by documented verification and appropriate supervisory oversight."
This action plan is jointly developed by the auditee and the auditor. It belongs to management and identifies the necessary control objective and assumes responsibility for implementing the solution.
Management should determine the specific workflow, responsible personnel, technology, implementation schedule, and monitoring arrangements.
The management action plan should ordinarily include an accountable owner, specific corrective actions, target completion dates, and a method for demonstrating completion.
Internal Audit can assess whether the proposed plan appropriately addresses the identified risk and subsequently evaluate whether the actions were implemented effectively.
Internal Audit should not take ownership of management's remediation responsibilities.
This separation supports objectivity and accountability.
6. A Complete Example of the Five Elements
Consider an internal audit of accounts payable vendor data management.
Finding element | Example |
Condition | Nine of 40 sampled vendor banking changes lacked documented independent verification |
Criteria | Company policy requires independent verification using established contact information |
Cause | The vendor change workflow did not enforce verification or require evidence before approval |
Effect | Unauthorized banking changes could result in fraudulent payment diversion |
Management Action Plan | Management approaches the implementation of enforced verification control and monitor compliance |
Example audit finding
Finding Title: Inadequate Verification of Vendor Banking Changes
During testing of 40 vendor banking changes, Internal Audit identified 9 changes that lacked documentation of independent verification.
Company policy requires banking changes to be authenticated using previously established vendor contact information before approval.
The review identified that the existing workflow permitted banking changes to be completed without recording evidence of independent verification. This design weakness contributed to inconsistent application of the policy.
The absence of effective verification increases the risk that fraudulent banking instructions could result in payments being redirected to unauthorized accounts.
Internal Audit recommends during the reporting phase of the audit that management strengthen the vendor banking change process by establishing a mandatory verification control, requiring evidence of authentication, and implementing appropriate monitoring.
Management response and action plan: To be prepared and owned by Accounts Payable management, with a responsible owner and target completion date.
This example demonstrates how the five elements create a logical and actionable finding.
7. How COSO Supports Effective Audit Findings
The COSO Internal Control–Integrated Framework provides a useful foundation for identifying deficiencies and evaluating corrective actions.
COSO includes five integrated components: Control Environment, Risk Assessment,
Control Activities, Information and Communication, and Monitoring Activities.
For example, an accounts payable deficiency may involve several components.
A weak vendor authentication procedure may indicate a Control Activities problem.
Failure to identify business email compromise as a relevant risk may indicate a Risk Assessment weakness.
Inadequate reporting of repeated exceptions may indicate weaknesses in Information and Communication or Monitoring Activities.
A strong audit finding should consider whether the immediate control failure reflects a broader weakness in the organization's internal control system.
This helps management avoid correcting only an isolated transaction problem when the underlying risk affects multiple processes.
8. The IIA Global Internal Audit Standards and Audit Findings
The Institute of Internal Auditors' Global Internal Audit Standards provide important guidance for developing and communicating engagement findings.
Standard 14.3, Evaluation of Findings, addresses evaluating potential engagement findings, including the significance of identified conditions and their causes and effects.
Standard 14.4, Recommendations and Action Plans, addresses developing recommendations, requesting management action plans, and evaluating whether the proposed actions adequately address identified risks.
Standard 15.1, Final Engagement Communication, addresses the final communication of engagement results.
Standard 15.2, Confirming the Implementation of Recommendations or Action Plans, addresses confirming whether management has implemented recommendations or action plans.
These standards reinforce the importance of clear findings, appropriate recommendations, management accountability, and follow-up.
They also recognize that an effective audit engagement extends beyond identifying deficiencies.
The objective is to communicate information that supports appropriate management action and organizational improvement.
9. Why Some Audit Findings Fail to Influence Management
Audit findings may fail to produce corrective action for several reasons.
The finding is too vague
Statements such as "Controls should be improved" provide little useful information.
The criteria are unclear
Management may dispute the finding because the auditor has not established the expected requirement or control objective.
The root cause is missing
Management may address the symptom without correcting the underlying weakness.
The effect is not explained
Management may perceive the issue as a minor administrative matter rather than a meaningful risk.
The auditor recommendation is impractical
A recommendation may require excessive resources or fail to consider the organization's operating environment.
Management was not adequately engaged
The auditor may finalize a finding without understanding management's perspective or evaluating additional evidence.
The finding is written as an accusation
Emotionally charged or unnecessarily critical language can create defensiveness and distract from the underlying risk.
Effective audit findings should be evidence-based, objective, persuasive, and focused on organizational improvement.
10. Using S.P.I.N. Selling Techniques to Discuss Audit Findings
Internal auditors can improve management discussions by borrowing concepts from S.P.I.N. Selling, developed by Neil Rackham.
S.P.I.N. stands for Situation, Problem, Implication, and Need-Payoff.
Although originally developed for consultative selling, the approach can help auditors structure conversations that encourage management to recognize risks and consider corrective action.
Situation questions
These questions establish how the process currently operates.
"How are vendor banking changes received and approved?"
"Who is responsible for independently verifying banking information?"
Problem questions
These questions identify weaknesses or difficulties.
"What happens when a banking change request arrives without sufficient supporting documentation?"
"Can employees bypass the verification step?"
Implication questions
These questions help management consider the consequences.
"What would happen if a fraudulent banking change resulted in a significant payment being redirected?"
"How would the organization detect the problem before funds were transferred?"
Need-Payoff questions
These questions encourage management to identify the value of improvement.
"How would a mandatory authentication step reduce the risk of unauthorized banking changes?"
"What benefits would management gain from having documented evidence of every verification?"
The purpose is not to manipulate management into agreeing with an unsupported finding.
The purpose is to create a constructive discussion grounded in evidence, risk, and organizational objectives.
Why this approach works
Managers are more likely to support corrective action when they understand the underlying problem and recognize the business value of addressing it.
The auditor should remain independent and objective.
Management should retain responsibility for selecting and implementing the corrective actions.
11. Audit Finding Severity and Prioritization
Not every audit finding requires the same urgency.
Auditors should evaluate findings based on risk and organizational significance.
Relevant considerations include the likelihood of an adverse event, potential impact, effectiveness of compensating controls, frequency of exceptions, and the importance of the affected process.
A missing approval signature on a low-risk transaction may warrant a different response from a control deficiency that permits unauthorized changes to supplier banking information.
Similarly, a deficiency involving senior management override may have significant governance implications even when the immediate dollar amount is small.
Organizations should use an established methodology for evaluating and prioritizing findings.
The auditor should explain the basis for the assigned severity.
12. Management Responses and Corrective Action Plans
A complete audit reporting process should provide management an opportunity to respond to findings.
The management response should address whether management agrees with the finding, the corrective action it proposes, the person accountable, and the expected completion date.
For example:
Management Action Plan
"Accounts Payable management will implement a workflow requiring independent telephone verification of vendor banking changes using previously established contact information. Verification evidence will be retained in the vendor management system. The Accounts Payable Manager will review monthly exception reports to monitor compliance."
Responsible owner: Accounts Payable Manager.
Target completion: Within 90 days.
The action plan should be sufficiently specific to permit follow-up.
If management accepts a risk rather than implementing corrective action, Internal Audit should evaluate the response under the applicable standards and organizational risk acceptance procedures.
Significant unresolved risks may require escalation.
13. Following Up on Audit Findings
An audit finding is not resolved merely because management states that corrective action has been completed.
Internal Audit should apply an appropriate follow-up methodology to determine whether the action was implemented and whether it addresses the underlying risk.
For example, management may report that a new vendor authentication procedure has been issued.
That does not necessarily establish that employees are consistently following the procedure.
Internal Audit may need to examine a sample of subsequent vendor banking changes, review retained verification evidence, and evaluate monitoring results.
The extent of follow-up should be risk-based.
The objective is to confirm that the deficiency has been addressed effectively.
14. Using AI to Improve Audit Finding Development
Artificial intelligence can assist auditors in organizing evidence, identifying possible root causes, improving the clarity of audit reports, and comparing findings with applicable control frameworks.
For example, an auditor might provide an approved AI system with a de-identified draft finding and ask it to identify missing elements.
A useful prompt would be:
"Review this internal audit finding for completeness. Identify the condition, criteria, cause, effect, and recommendation. Highlight unsupported conclusions, missing evidence, unclear criteria, and recommendations that improperly assign management responsibilities to Internal Audit."
AI may also help generate alternative wording that makes findings easier for executives and Audit Committees to understand.
However, auditors must verify all AI-generated content.
AI should not invent criteria, infer unverified causes, exaggerate risks, or manufacture management responses.
Confidential organizational information must be protected in accordance with applicable policies and security requirements.
AI can improve the communication of audit findings, but the auditor remains responsible for the evidence, professional judgment, and final conclusions.
15. Ten Questions to Ask Before Issuing an Audit Finding
Before finalizing a finding, auditors should consider:
Is the condition supported by sufficient evidence?
Are the criteria clear, applicable, and defensible?
Has the underlying cause been investigated?
Does the effect explain the actual or potential risk?
Is the recommendation directed toward the underlying cause?
Has management had an appropriate opportunity to provide information?
Is the finding written objectively and professionally?
Is the assigned severity supported by the risk assessment?
Does management understand its responsibility for the action plan?
Can Internal Audit evaluate whether the corrective action has been effective?
These questions can significantly improve audit report quality.
Conclusion: The Best Audit Findings Lead to Better Management Decisions
The five elements of an effective audit finding—Condition, Criteria, Cause, Effect, and Recommendation—provide a practical framework for communicating deficiencies.
Each element serves a distinct purpose.
Condition establishes the facts.
Criteria identify the expected standard.
Cause explains why the deficiency occurred.
Effect communicates the consequences or risks.
The Action Plan identifies the improvement needed.
Together, they create a finding that management can understand and act upon.
However, an effective finding is not simply a well-written report paragraph.
It is the result of sound audit evidence, root cause analysis, professional judgment, and constructive communication.
Internal Audit identifies and communicates the risk. Management owns the solution. The Audit Committee provides oversight.
When these responsibilities are understood, audit findings become more than records of deficiencies.
They become instruments for strengthening internal controls, improving accountability, and helping organizations achieve their objectives.
Strengthen Your Internal Audit Skills With Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) provides professional CPE training in internal auditing, audit report writing, audit evidence, internal controls, COSO, fraud risk management, and the IIA Global Internal Audit Standards.
Our programs help auditors strengthen the practical skills needed to identify risks, evaluate control deficiencies, develop persuasive findings, and communicate results effectively.
Recommended CPE training
Internal Audit Report Writing
Learn how to communicate audit findings clearly, develop effective reports, and present meaningful recommendations to management and Audit Committees.
Navigating the Global Internal Audit Standards
Understand the IIA standards governing audit planning, engagement performance, findings, recommendations, reporting, and follow-up.
Testing the Design and Operating Effectiveness of Internal Controls
Develop practical skills for evaluating control design, testing operating effectiveness, and documenting audit evidence.
Explore CCS Training Programs
Visit Corporate Compliance Seminars to explore upcoming live webinars and in-person CPE events.
Better audit findings lead to better management decisions—and stronger internal controls.
Comments