An audit finding is a formal, documented conclusion by an auditor that a specific condition in an organization fails to meet an established standard, regulation, contract term, or internal policy. Audit findings are not casual criticisms. They carry defined consequences depending on how the auditor classifies their severity, and at the top of that scale they can trigger SEC disclosure obligations, enforcement actions, and personal criminal liability for the officers who sign a company’s financial reports.
Understanding a finding means understanding three things: what makes it a finding rather than a suggestion, how serious the auditor considers it, and what the organization is now obligated to do about it.
The Five Elements That Make a Finding Formal
Audit standards, including the Government Auditing Standards published by the U.S. Government Accountability Office, structure each finding around a consistent set of elements. A properly developed finding contains all five, and each links to the next.
- Condition. The situation the auditor actually observed, documented with specific evidence. This is the factual baseline.
- Criteria. The standard the organization should have met — a law, regulation, contract, grant agreement, internal policy, or industry benchmark.
- Cause. The reason the condition deviated from the criteria. Without a root cause, any fix risks addressing symptoms rather than the underlying problem.
- Effect. The actual or potential consequence of the gap: financial loss, security exposure, regulatory penalty, or harm to program beneficiaries.
- Recommendation. The auditor’s suggested corrective action, aimed at the cause and designed to prevent recurrence.
When any of these elements is missing or weakly developed, the finding becomes harder for management to act on and easier to dispute.1U.S. Government Accountability Office. Government Auditing Standards: 2024 Revision
Findings vs. Observations
Auditors draw a sharp line between the two. A finding is measured against a concrete benchmark and demands a written management response and tracked corrective action. An observation is an informal suggestion for improvement. An auditor might observe that a process could run more efficiently, but unless that inefficiency violates a standard or creates a control gap, it stays an observation and requires no formal action.
The distinction has real weight. Findings create a paper trail with regulatory implications. Certain findings must be disclosed to shareholders and the SEC. For government grant recipients, findings can affect future funding. Observations carry none of that, which is exactly why auditors are careful about which label they apply.
Severity Classifications
Not every finding is equal. The classification an auditor assigns determines who has to be told, whether the issue becomes public, and how urgently it must be fixed.
Material Weakness
A material weakness is the most serious classification. It means a deficiency, or combination of deficiencies, in internal control over financial reporting is severe enough that a material misstatement in the financial statements could reasonably fail to be prevented or detected in time.2Public Company Accounting Oversight Board. Auditing Standard 5 Appendix A – Definitions
For a publicly traded company, a material weakness means management cannot conclude that internal controls are effective, and that conclusion must appear in the annual report.3U.S. Securities and Exchange Commission. Office of the Chief Accountant and Division of Corporation Finance – Frequently Asked Questions Investors, analysts, and regulators all read those disclosures closely.
Significant Deficiency
A significant deficiency is less severe than a material weakness but still important enough to require attention from those responsible for overseeing financial reporting.2Public Company Accounting Oversight Board. Auditing Standard 5 Appendix A – Definitions Under the Sarbanes-Oxley Act, a public company’s CEO and CFO must certify that they have disclosed all significant deficiencies to the external auditor and to the audit committee.4Office of the Law Revision Counsel. 15 U.S. Code 7241 – Corporate Responsibility for Financial Reports Significant deficiencies don’t require public disclosure the way material weaknesses do, but the internal reporting obligation is not optional.
Minor Control Deficiencies
Below the significant deficiency threshold, auditors still identify control weaknesses that warrant management’s attention without rising to formal governance reporting. In public company audits, PCAOB standards require the auditor to communicate material weaknesses and significant deficiencies in writing to management and the audit committee. Lesser deficiencies follow a less formal path.5Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements For non-public entities, auditors may communicate minor deficiencies to management in writing or orally, at their professional judgment. These issues don’t reach public filings, but they can erode into larger problems if ignored.
Disclosure and Officer Liability for Public Companies
Public companies face two overlapping disclosure obligations created by the Sarbanes-Oxley Act.
Section 404 requires each annual report to contain a management assessment of internal control over financial reporting, including a conclusion about whether those controls are effective.6GovInfo. 15 USC 7262 – Management Assessment of Internal Controls If a material weakness exists at fiscal year-end and has not been remediated, it must be publicly disclosed in that annual report, and management cannot conclude that controls are effective.3U.S. Securities and Exchange Commission. Office of the Chief Accountant and Division of Corporation Finance – Frequently Asked Questions For larger public companies, the external auditor must separately attest to management’s assessment.
Section 302 adds a personal certification layer. The CEO and CFO must sign each periodic report certifying that they have disclosed all significant deficiencies and material weaknesses in internal controls to the auditor and audit committee, along with any fraud involving employees with significant internal control roles.4Office of the Law Revision Counsel. 15 U.S. Code 7241 – Corporate Responsibility for Financial Reports
These certifications are not a formality. An officer who knowingly certifies a noncompliant report faces up to $1,000,000 in fines and 10 years in prison. If the false certification is willful, the penalties rise to $5,000,000 and 20 years.7Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
What Management Has to Do Next
When a finding lands, the first step is a clear position: does management agree or disagree with the auditor’s conclusion? Agreement is more common and simpler to process, but disagreement is a legitimate response when management believes the auditor misapplied the criteria, misjudged the severity, or overlooked context. A disagreement has to be backed by specific counter-evidence or an alternative reading of the applicable standard. Vague objections don’t hold up, and unresolved disputes typically escalate to the audit committee.
Whether or not management agrees, the response should address every element of the finding. Engaging with the condition, the criteria, and especially the identified cause signals that management takes the finding seriously. Responses that touch only the surface condition without engaging the root cause almost guarantee the same problem will reappear in the next audit cycle.
The Corrective Action Plan
The corrective action plan is the core of the response. Federal agency guidance consistently requires the same basic elements: specific actions to correct the identified problem, a schedule with deadlines for each step, and named individuals accountable for carrying out each action.8Federal Transit Administration. How to Write SMART Corrective Action Plans The plan should trace back to the root cause identified in the finding, not the symptom. If the cause was a lack of training, the corrective action needs a training program with completion targets, not a policy revision that sits on a shelf.9Centers for Medicare & Medicaid Services. Corrective Action Plan Process
Remediation, Follow-Up, and Closure
Submitting a corrective action plan starts the clock; it doesn’t resolve anything. The organization has to execute each step, document the changes, and preserve evidence that the new controls actually work. Updated policies, revised system configurations, training records, and transaction testing results all become part of the file auditors will review.
Follow-up verification can come from the external auditors, an internal audit team, or a dedicated compliance function, depending on the finding’s severity and how the organization is structured. Verifiers check whether the corrective actions were implemented as described, whether they address the root cause, and whether the control operates effectively in practice. A finding reaches closure only when a verifier confirms the remediation is complete and effective. Until that happens, the finding stays open and continues to appear in status tracking reports.
What Unremediated Findings Cost
Ignoring or slow-walking remediation creates escalating risk. For public companies, failing to maintain adequate internal controls is itself a violation of the Securities Exchange Act, separate from any disclosure failure. The SEC has brought enforcement actions against companies that disclosed material weaknesses in their annual reports but failed to actually fix them, imposing cease-and-desist orders and civil penalties. The SEC’s position is explicit: disclosing a material weakness is not enough without meaningful remediation.
Beyond enforcement, unremediated material weaknesses erode investor confidence, can trigger shareholder litigation, and make raising capital harder. For non-public organizations, unremediated findings from government audits can jeopardize grant funding, trigger increased oversight, or result in placement on a corrective action monitoring program. The cost of fixing a control problem almost always rises the longer it goes unaddressed, and repeat findings on the same issue compound the reputational damage quickly.