Draft an audit finding: criterion, condition, cause, and action
A useful draft finding explains the expected condition, the observed deviation, why it matters, and a response that addresses the cause. Separate supported facts from hypotheses. An impressive-sounding risk statement cannot rescue a finding that lacks evidence or a clear criterion.
Build a finding the reader can act on
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Criterion and condition | Compare the applicable expectation with the evidenced deviation. | Saying “controls are poor” without specifying what failed. |
| Cause and consequence | Investigate why the deviation occurred and assess the exposure it creates. | Presenting an untested cause or hypothetical loss as an established fact. |
| Response | Develop a suitable recommendation or agreed action with responsibility and timing. | Requesting more training when the actual cause is missing system access. |
Criterion and condition
Compare the applicable expectation with the evidenced deviation.
Avoid: Saying “controls are poor” without specifying what failed.
Cause and consequence
Investigate why the deviation occurred and assess the exposure it creates.
Avoid: Presenting an untested cause or hypothetical loss as an established fact.
Response
Develop a suitable recommendation or agreed action with responsibility and timing.
Avoid: Requesting more training when the actual cause is missing system access.
A decision path you can use
- 1What should happen?
- 2What happened and why does it matter?
- 3What response addresses the cause?
Understand the method
Work through the reasoning
Build the finding from the evaluated condition
Start with what the evidence establishes and the criterion used to evaluate it. “Approvals are poor” is vague. A precise finding identifies which approvals were missing or late, the relevant population and period, and the requirement not met. Keep the wording within the coverage of the work.
Separate the observed condition from its consequences. A missing approval can expose the organization to unauthorized transactions without proving that a loss occurred. State an actual loss only when supported. Explain potential exposure in proportion to the evidence and the assessed likelihood and impact.
Explain cause without inventing certainty
A useful action addresses why the condition arose. Explore whether the cause involves unclear responsibility, inadequate design, access permissions, training, capacity, or another factor. Work with management where possible to understand the process. “Human error” often restates the event without explaining the mechanism that allowed it.
If the cause is not established, say so and identify the work or action needed. Avoid attributing intent from a control exception alone. A defensible finding can distinguish confirmed facts, management’s explanation, and unresolved questions without losing clarity or significance.
Connect recommendations and actions to the risk
A recommendation should address the evaluated gap and be practical for the objective. If users can bypass an approval rule, reminding them of the policy may not address the system design. Management retains responsibility for choosing and implementing the response. Audit evaluates whether the proposed response adequately addresses the finding.
Identify action ownership and expected completion dates in the communication as applicable. Vague commitments such as “improve controls soon” are difficult to monitor. Where disagreement persists, follow the function’s process and represent the respective positions accurately instead of hiding the disagreement in ambiguous wording.
Write a conclusion the reader can use
Arrange the communication so the reader can understand the objective, scope, significant findings, and conclusion. Use clear language and explain technical terms that matter to the decision. Detail should support understanding, not obscure the main risk behind a long chronology of fieldwork.
Check accuracy, objectivity, clarity, concision, constructiveness, completeness, and timeliness. Include relevant limitations and positive context where it affects interpretation. Review the final wording against the evidence: a stronger adjective or broader claim introduced during editing still needs support.
Original teaching example
Apply the method to a decision
The scenario
Policy requires a second approval before vendor bank changes activate. Six of 30 examined changes activated first. System configuration permits one user to enter and release a change.
The decision
Draft the finding around premature activation and the configuration weakness, with the tested scope made explicit.
A stronger action addresses release permissions or workflow, not just a reminder email. Do not claim that six unauthorized payments occurred unless payment evidence supports that further statement.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A draft turns exposure into an unsupported loss claim
The situation
Testing finds missing review evidence for several credit adjustments. The draft says the weakness caused a material loss, but the team has not established that any adjustment was improper.
Reason through it
The missing review can support a control finding and an explanation of potential unauthorized adjustments. It does not establish the asserted loss. Investigate outcomes separately if needed.
Take the decision
Describe the supported condition and exposure, and remove the unsupported causal loss statement.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Should a draft finding include management’s disagreement?
Investigate factual disagreement and document significant unresolved differences through the engagement process. Revise when evidence warrants it; do not remove a supported issue solely to obtain agreement.
Does concise reporting mean omitting supporting context?
No. Remove unnecessary repetition while retaining the objective, relevant scope, evidence-based condition, significance, and action information the reader needs. Brevity should not conceal limitations or make the conclusion impossible to assess.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Engagement Supervision and Communication (10% of Part 2). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 11.2, 14.3-14.5, and 15.1. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 2: Internal Audit Engagement. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.