A finding is not an accusation against a person; it describes a gap between what should be and what is, with its cause, its effect, and what is proposed to fix it.
1 The five elements of a finding
Criteria
What should be?
Condition
What did we actually find?
Cause
Why did it happen?
Effect
What follows from it?
Recommendation
What is proposed to fix it?
A finding missing one element opens the door to argument instead of to repair
Weak wording: “The procurement department does not follow the procedures.”
Professional wording:
- Criteria: the procurement policy requires an approved purchase order before any payment.
- Condition: of a sample of 40 payment requests, 4 totalling SAR 620,000 were paid with no prior purchase order.
- Cause: the system permits an override in “urgent” cases with no mandatory subsequent approval and no amount ceiling.
- Effect: payment without prior control raises the risk of erroneous or unauthorised payment, and undermines reliance on the control as a whole.
- Recommendation: activate a mandatory subsequent approval within 24 hours for urgent cases, with an amount ceiling and a monthly exceptions report submitted to the CFO.
The difference: the first is an opinion that can be denied; the second is a set of facts that can be acted on.
2 The root cause
The weakest thing in many reports is that the cause is written up as “employee negligence”. That describes the outcome, not the cause. Ask “why?” three to five times until you reach something that can actually be fixed:
| Question | Answer |
|---|---|
| Why was it paid with no purchase order? | Because the request was urgent |
| And why was that allowed? | Because the system offers an “urgent payment” option |
| And why was it not reviewed afterwards? | Because there is no exceptions report |
| And why is there no report? | It was not requested when the system was designed |
| Root cause | A gap in the design of the control, not in an employee’s behaviour |
Why does the root cause matter?
Because the recommendation is built on it. A cause of “negligence” produces a recommendation to “warn the employee”, and the breach recurs. A cause of “a design gap” produces a recommendation that closes the door for everyone.
3 Rating significance
| Rating | Meaning | Expected remediation timeframe |
|---|---|---|
| High | Material effect, a breach of law, or a key control not operating | Immediate to 30 days · reported to the board |
| Medium | A weakness that raises risk without a current material effect | 60 to 90 days |
| Low | An improvement opportunity or a procedural observation | Within the normal improvement cycle |
4 Management’s response
Findings are discussed with management before the report is issued — not to soften them, but to verify the accuracy of the facts and agree a workable plan. Management’s response should state: its position, the action, the owner and the date.
When management rejects the recommendation
Management may refuse and accept the risk, and the auditor may record that refusal and their own view in the report. If the accepted risk exceeds what the organisation can bear, the matter is escalated to the audit committee to decide. The disagreement is not deleted — it is documented.
5 The shape of the report
- An executive summary on one page: the overall opinion and the three most significant findings.
- Objective and scope, the period, and what was explicitly excluded.
- The findings ordered by significance, each with its five elements.
- Management’s responses with owner and date.
- Appendices covering methodology, sample size and detailed tables.
The report is addressed to the audit committee with a copy to executive management, in neutral professional language: facts and figures, with no sarcasm and no individuals named unless strictly necessary.
Lesson summary
- A finding has five elements: criteria, condition, cause, effect and recommendation.
- The root cause is extracted by asking “why” repeatedly, and the recommendation is built on it.
- Findings are rated by significance, each rating with an expected remediation timeframe.
- Management’s response states its position, the action, the owner and the date.
- A rejected recommendation is documented, and escalated when it exceeds risk appetite.
6 Test your understanding
Three quick questions
Pick the answer you believe is correct and you will see the result immediately.
1. The cause of a finding was written as “employee negligence”. What is the problem?
The root cause usually lies in the design of the control, the system or the training — not in one particular person.
2. Management rejected a recommendation on a high-significance finding. What should be done?
Accepting risk is management’s right, but whoever owns that decision at organisation level must know about it.
3. What is the purpose of discussing findings with management before issuing the report?
The discussion ensures the facts are right and the plan is realistic; it does not give management a veto over the report.