How to Write Audit Findings: The 5 Cs Explained
An audit is only as useful as the findings it produces. You can test every control, sample every ledger and document every walkthrough, but if the finding that lands on the Chief Executive’s or Audit Committee’s desk is vague, defensive or impossible to act on, the work has largely been wasted. Weak findings get disputed, ignored or “noted”, and the same issue reappears in next year’s report.
This guide sets out a practical, step-by-step approach to writing audit findings using the five attributes many audit teams call the “5 Cs”: criteria, condition, cause, effect and recommendation (the fifth “C” is sometimes called “corrective action”). It works for internal auditors, external auditors raising management letter points, and risk and compliance officers reporting control gaps










