An audit is only as useful as the findings it produces. You can test every control, sample every ledger and document every walkthrough, but if the finding that lands on the Chief Executive’s or Audit Committee’s desk is vague, defensive or impossible to act on, the work has largely been wasted. Weak findings get disputed, ignored or “noted”, and the same issue reappears in next year’s report.
This guide sets out a practical, step-by-step approach to writing audit findings using the five attributes many audit teams call the “5 Cs”: criteria, condition, cause, effect and recommendation (the fifth “C” is sometimes called “corrective action”). It works for internal auditors, external auditors raising management letter points, and risk and compliance officers reporting control gaps.
Why the structure matters
The IIA’s Global Internal Audit Standards, effective from 9 January 2025, build this logic directly into how engagement work is performed. Under Standard 14.2 (Analyses and Potential Engagement Findings), a potential finding arises when internal auditors compare the condition (what actually exists) against the criteria (what should exist). Standard 14.3 (Evaluation of Findings) expects auditors to determine the root cause where possible and to judge the significance of each finding. Standard 14.4 (Recommendations and Action Plans) deals with agreeing what will be done about it, and Standard 15.1 requires the final communication to set out findings with their significance and prioritisation.
In other words, the 5 Cs are not a writing style; they are the evidence trail of your audit reasoning. A finding missing any one of them is usually a finding with a gap in the thinking behind it.
The five attributes explained
| Attribute | The question it answers | Good practice |
|---|---|---|
| Criteria | What should be happening? | Cite the specific policy, regulation, contract clause, procedure or accepted good practice. “Best practice” alone is not a criterion. |
| Condition | What is actually happening? | State facts you tested, with numbers: population, sample size, exceptions found and their value. |
| Cause | Why is there a gap? | Identify the root cause (process, system, people, oversight), not just the symptom. |
| Effect | So what? | Explain the actual or potential impact in financial, operational, compliance or reputational terms. Quantify where you can. |
| Recommendation | What should be done? | Address the cause, be specific and practical, and lead to an agreed action plan with an owner and date. |
A step-by-step approach to writing a finding
Step 1: Confirm the criteria before you write a word
Go back to the source document. If the procurement manual says quotations are required above USD 1,000, quote that threshold and the section. For a Zimbabwean public entity, criteria might be the Public Procurement and Disposal of Public Assets Act, Treasury instructions or the entity’s own board-approved policies. For a bank, it may be a Reserve Bank directive or an internal credit policy. If you cannot point to a criterion, you may have an observation or an improvement opportunity, not a finding.
Step 2: State the condition with evidence
Be precise. “Some payments lacked approval” invites argument. “Of 60 payment vouchers sampled from January to June, 14 (23%), totalling USD 48,200, had no evidence of approval by an authorised signatory” does not. Where records are kept in both ZiG and USD, state the currency clearly and say how any conversion was done, so the figures cannot be challenged on a technicality.
Step 3: Dig for the root cause
Ask “why?” until you reach something management can fix. “The finance officer forgot” is rarely the real answer. Perhaps the approval matrix was never updated after a restructure, the ERP allows payments to be released without a workflow approval, or there is no secondary review. Discuss the cause with the process owner; agreeing on the cause is the single best predictor that the recommendation will be accepted.
Step 4: Quantify and explain the effect
Translate the gap into consequences: potential loss, exposure to fraud, regulatory penalty, donor disallowance for an NGO, or misstatement risk. Where possible, test the full population rather than a sample so you can state the actual exposure; for large transaction files, a dedicated tool such as ProDataTool can help you summarise and filter millions of rows to put a firm number on the effect.
Step 5: Write a recommendation that fixes the cause
If the cause is a system that allows unapproved releases, “remind staff to obtain approval” will not work. “Configure mandatory approval workflow in the ERP for all payments above USD 1,000, and review the system access report monthly” will. Then agree an action plan: what management will do, who owns it, and by when.
Step 6: Rate and prioritise
Apply your methodology’s rating scale (for example High, Medium, Low) consistently, based on the significance of the effect and likelihood. This lets the Audit Committee focus on what matters most.
A simple finding template
| Section | Example content |
|---|---|
| Title | Payments released without authorised approval |
| Rating | High |
| Criteria | Finance Policy section 4.2 requires all payments to be approved by an authorised signatory per the approval matrix. |
| Condition | 14 of 60 sampled payments (USD 48,200) had no evidence of approval. |
| Cause | The ERP payment module does not enforce an approval step; reliance is placed on manual sign-off. |
| Effect | Unauthorised or fraudulent payments could be made without detection, leading to financial loss. |
| Recommendation | Enable mandatory system approval workflow and introduce a monthly review of payments released. |
| Management action plan | Agreed. IT and Finance to configure workflow. |
| Owner / due date | Finance Manager / 31 December |
Common mistakes to avoid
- Confusing cause with condition. “Payments were not approved” is the condition, not the cause.
- Vague criteria. Citing “good governance” or “best practice” without a specific reference weakens your position.
- No numbers. Findings without population, sample and exception figures are easy to dismiss.
- Exaggerated effect. Overstating impact damages credibility; state what is actual and what is potential.
- Recommendations that treat symptoms. “Staff should be reminded” rarely fixes a design weakness.
- Accusatory tone. Name processes and roles, not individuals, and keep the language factual.
- Surprising management. Every finding should be discussed with the process owner before the draft report is issued.
- No follow-up. A finding without an owner and due date tends to come back next year.
A quick quality check before you issue
- Can a reader who was not on the audit understand the finding in under a minute?
- Is every fact traceable to a working paper?
- Does the recommendation clearly address the stated cause?
- Is the rating consistent with similar findings in other reports?
- Has management’s response been captured with an owner and date?
Conclusion
Strong audit findings are clear, evidenced and actionable. By anchoring each one in criteria, condition, cause, effect and recommendation, you make your reasoning transparent, reduce disputes with management and give the Audit Committee something it can act on. Start by applying the template above to your next engagement and compare how management responds.
If your team still drafts findings in Word and tracks action plans in spreadsheets, Auditors Track GRC can help you digitise the whole process. It supports risk assessments, audit reviews, findings and report writing, evidence attachments, dashboards by department and engagement type, and multi-user department assignments, with built-in libraries of controls, audits, working papers and risks. Book a free demo of Auditors Track GRC to see how it can bring consistency to your audit findings and reporting.