How to Present Audit Findings: Reports, Exit Meetings, and Follow-Up

To present audit findings well, build each one on five defensible elements, rank them by severity so priorities are obvious, deliver a written report that opens with a one-page executive summary, and use the exit meeting to align on facts and next steps rather than to surprise the auditee. Do those four things and findings get remediated. Skip any of them and even accurate findings stall.

Build Every Finding on Five Elements

A finding that holds up under pushback contains criteria, condition, cause, effect, and recommendation. The Government Accountability Office’s auditing standards set out these elements explicitly, and dropping one gives management an opening to dismiss the observation.¹

Criteria. The standard the organization should be meeting: a federal regulation such as the internal control requirements under the Sarbanes-Oxley Act, a GAAP principle, an internal policy, or a contractual obligation.²
Condition. What you actually found, documented with bank statements, system logs, interview transcripts, or date-stamped screenshots.
Cause. Why the gap exists. Training failure, broken automated control, staff turnover, a process never designed to catch the issue.
Effect. The actual or potential consequence, quantified wherever possible. “Three wire transfers totaling $47,000 were processed without secondary approval during the review period” carries more weight than “increased risk.”
Recommendation. A specific, actionable fix tied to the cause. Not “improve controls” but “require dual authorization for all outgoing payments above $5,000 and configure the ERP system to enforce this by default.”

The GAO’s 2024 standards reinforce that each element should be developed “to the extent necessary to assist management or oversight officials in understanding the need for corrective action,” and that findings should be put in perspective by quantifying results in dollar terms or relating exceptions to the population tested.¹ Whenever the effect can be tied to a concrete number, tie it. Abstract risk language is the easiest thing for management to argue with.

Rank Findings by Severity

Your report has to make the hierarchy obvious, or every finding competes for attention on equal footing and nothing gets prioritized.

In financial auditing, the sharpest line is between a material weakness and a significant deficiency, both defined in PCAOB standards. A material weakness is a control gap serious enough that there is a reasonable possibility a material misstatement will not be prevented or detected on a timely basis. A significant deficiency is less severe but still important enough to warrant the attention of those overseeing financial reporting.³ The practical gap is large: a material weakness typically triggers mandatory public disclosure, while a significant deficiency is communicated to the audit committee.

Most internal audit shops layer a three-tier rating on top: high, medium, low. High-risk findings get executive attention and short deadlines. Low-risk findings can wait for a later work plan. The point is consistency. A “high” in one department has to mean the same as a “high” in another, and the criteria should be documented so a challenge to the classification has a documented answer.

Materiality itself needs a benchmark. Auditors commonly anchor to 3 to 10 percent of pre-tax profit, though the right benchmark depends on the entity; a startup burning cash may use total revenue or total assets instead. Whatever you pick, write down the rationale.

Structure the Written Report So Readers Can Find What They Need

Repeat readers, especially board members and regulators, should not have to hunt. The IIA’s 2024 Global Internal Audit Standards require internal auditors to communicate engagement results effectively and to collaborate with management on recommendations and action plans.⁴ The GAO’s Yellow Book imposes similar expectations for government engagements, including putting findings in perspective by relating exceptions to the population tested and quantifying dollar impacts.¹

Open with an executive summary of one page or less. State the objective, scope, the number and severity of findings, and the overall conclusion. Assume some readers will read nothing else. Below the summary, present each finding using the five-element structure, ordered by risk severity with the highest first.

Visual aids earn their space when used sparingly. A trend chart showing recurring findings across audit periods tells a story that a paragraph cannot. A heat map organizing findings by department and severity shows where risk is clustering. A side-by-side table of current state against required standard makes the gap visible at a glance. Rapid comprehension is the goal.

One boundary worth flagging. If you are conducting an external financial statement audit, the report culminates in a formal PCAOB opinion (unqualified, qualified, adverse, or disclaimer), and each step down from unqualified carries real consequences.⁵ When findings are severe enough to move the opinion off unqualified, tell management well before the exit meeting.

Run the Exit Meeting as a Discussion, Not an Ambush

The exit meeting is where findings shift from the auditor’s problem to management’s responsibility. The single most important move happens before the meeting: send the draft report to the auditee a day or two in advance. First encounters with unflattering findings in a room full of colleagues produce defensiveness. Advance sight of the draft turns the meeting into a discussion about accuracy and next steps, and lets you fix minor factual errors privately.

Structure the meeting around the report. Open with objective and scope, then walk findings in order of severity. For each one, present condition and criteria side by side so the gap is immediately visible, then explain cause and effect before landing on the recommendation. Keep the tone collaborative. Fixing the problem is the shared goal.

A few habits experienced auditors settle into:

Stay anchored to the evidence. When a manager pushes back with anecdotes or points to unrelated strengths, bring the conversation back to the specific documentation supporting the finding.
Do not expand scope mid-meeting. Issues you noticed but did not formally test do not belong in the exit meeting.
Do not let the room get emotional. If a specific finding gets heated, table it and circle back after tempers cool. A finding confirmed in a calm follow-up is worth more than one extracted through confrontation.
Leave room for context you may have missed. Sometimes what looks like a control failure has a reasonable explanation. If new evidence changes your conclusion, say so. Adjusting on valid evidence builds more credibility than digging in.

When You and Management Genuinely Disagree

Some disagreements survive the exit meeting. The IIA’s 2024 standards require internal audit functions to maintain an established methodology for both parties to express their positions when they disagree about engagement results, recommendations, or action plans.⁴ Management challenging a finding should present supporting evidence, not just a disagreement in principle. If the dispute stays unresolved after senior management is involved, the chief audit executive escalates to the board. That path exists so management cannot quietly veto inconvenient findings.

Issue the Final Report and Require a Real Response

After the exit meeting, incorporate legitimate corrections and finalize the report. Deliver it through secure channels that produce a verifiable receipt: an encrypted internal portal, a board management platform, or registered delivery. The timestamp matters if a regulator later asks when management was notified.

Management’s formal response should identify the specific corrective actions, the person responsible, and a realistic completion date. For audits of federal awards, the rules are explicit: the auditee must prepare a corrective action plan addressing each finding, with a contact person, planned corrective action, and anticipated completion date, and must explain in detail any finding it disagrees with.⁶ The federal agency or pass-through entity responsible for issuing a management decision must do so within six months of the Federal Audit Clearinghouse’s acceptance of the audit report.⁷

Outside federal grants, response timelines vary. Some organizations give management 10 business days, others 30 or more depending on complexity. Enforce whichever deadline you set. Responses that trickle in months late signal that the audit function has no teeth. Once responses are integrated, distribute the final package to the audit committee and any other oversight bodies your governance structure requires. That formal distribution closes the engagement and starts the clock on remediation tracking.

Follow Up and Verify Remediation

Issuing the report is not the finish line. The real test of an audit function is whether findings actually get fixed. Follow-up has three parts: collect information on progress, verify that corrective actions were implemented rather than just claimed, and report results back to senior management and the board.

Verification means testing. If management says they implemented dual authorization on wire transfers, pull a sample of recent transactions and confirm it. If they say staff have been retrained, review the training records and test whether staff can actually demonstrate the procedure.

An aging analysis is one of the most effective pressure tools for overdue action plans: a simple report showing which findings remain open, how long they have been outstanding, and who owns them. Nothing focuses a department head like their name appearing next to a nine-month-old finding on a report going to the board.

When management accepts a level of risk that the chief audit executive believes is unacceptable, the standards require the CAE to raise it with senior management, and to communicate it to the board if it remains unresolved.⁸ This escalation is not optional. Management sometimes has incentives to accept risks the organization as a whole should not tolerate, and the board needs an independent voice flagging the gap.

Once verification confirms that corrective actions adequately address a finding, close it formally and document the basis for closure. Findings that stay perpetually open with no resolution path erode credibility across the entire audit program. If management is not going to fix something, that decision belongs in writing, escalated, and owned at the appropriate governance level rather than aging quietly on a spreadsheet.

One Boundary for Public Companies

If you are auditing a public company, presenting findings is not purely an internal exercise. When an auditor identifies a material weakness in internal controls, they must communicate it in writing to both management and the audit committee before issuing the audit report.³ A material weakness disclosed in the annual report can also trigger Form 8-K obligations, with a general deadline of four business days from the triggering event for most items.⁹ Under SEC Rule 10A-3, the audit committee is directly responsible for overseeing the external auditor’s work, including resolving disagreements between management and the auditor, and the external auditor reports to the audit committee rather than to management.¹⁰ If any of that applies to your engagement, plan how findings will move through those channels before the exit meeting, not after.

1
U.S. Government Accountability Office. Government Auditing Standards 2024 Revision
2
Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls
3
PCAOB. AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
4
The IIA. Global Internal Audit Standards
5
PCAOB. AS 3105 – Departures from Unqualified Opinions and Other Reporting Circumstances
6
eCFR. 2 CFR Part 200 Subpart F – Audit Requirements
7
eCFR. 2 CFR 200.521 – Management Decisions
8
The Institute of Internal Auditors. Audit Reports – Communicating Assurance Engagement Results
9
U.S. Securities and Exchange Commission. Additional Form 8-K Disclosure Requirements and Acceleration of Filing Date
10
eCFR. 17 CFR 240.10A-3 – Listing Standards Relating to Audit Committees