To present audit findings well, structure each one around five attributes (criteria, condition, cause, effect, and recommendation), support every attribute with organized evidence, walk management through the findings in an exit conference before finalizing the report, and follow up until the corrective actions actually resolve the underlying problem. Everything else in the process, from the wording of the report to the room you book for the closing meeting, is in service of those four moves.
Structure Each Finding Around Five Attributes
Internal auditors organize each finding around five fields. This is not a formatting convention. Each field answers a specific question management needs answered before they can respond, and skipping any one of them leaves a gap that weakens the finding.
- Criteria is what should be happening: the rule, policy, regulation, or benchmark the audited area was supposed to follow. Without clear criteria, a finding reads like an opinion.
- Condition is what is actually happening, described from verified facts observed through testing. Save interpretation for other fields.
- Cause is why the gap exists. This one gets shortchanged most often. Stopping at “staff didn’t follow the procedure” identifies a symptom, not a root cause.
- Effect is why it matters: the connection to financial loss, regulatory exposure, or operational risk. Weak effect statements get deprioritized every time.
- Recommendation is what to do about it, and it should address the root cause rather than the surface condition. If the cause is a training gap, recommending that staff “comply with the policy” misses the point.
The five-attribute approach traces back to guidance from the Institute of Internal Auditors, and variations of it appear in virtually every internal audit shop. Organizations working under other frameworks, such as ISO 9001 for quality management systems, apply similar logic when documenting where performance deviates from established requirements.
Back Every Finding With Organized Evidence
Every assertion in the report needs supporting evidence that someone other than the auditor could review and reach the same conclusion. Transaction logs, interview notes, system screenshots, and physical observation records form the evidentiary backbone. If you cannot point to a specific document that proves a finding, that finding is not ready for the report.
Organize the evidence by finding, not by type. Dumping all transaction logs into one folder and all interview notes into another creates extra work for anyone reviewing the report later. Group the supporting documents so that each finding has its own evidence package, cross-referenced to the criteria, condition, and effect fields.
Quantify discrepancies wherever possible. “Several unauthorized purchases were identified” carries far less weight than “fourteen unauthorized purchases totaling $23,400 were processed between March and June.” Specific numbers give management something concrete to investigate and create accountability for the corrective action.
Most organizations maintain an audit report template through their compliance portal or audit management software. These templates standardize the layout and ensure each finding captures all five attributes along with data points like dates of non-compliance, department identifiers, and dollar amounts. If your organization does not have a template, building one around the five-attribute framework is worth the effort for the consistency it produces across engagements.
Put a Dollar Figure on the Effect
The effect field carries more weight when the auditor attaches real numbers to the risk. Where a finding involves regulatory non-compliance, researching the applicable penalty structure gives management a concrete sense of exposure. Failing to file a Form 5500 for a retirement plan on time, for example, triggers an IRS penalty of $250 per day, up to a maximum of $150,000 per late return. The Department of Labor can impose additional penalties of up to $2,529 per day with no cap.1Internal Revenue Service. 401(k) Plan Fix-It Guide – You Haven’t Filed a Form 5500 This Year
For tax-related findings, the IRS imposes an accuracy-related penalty when an individual understates tax liability by the greater of 10 percent of the correct tax or $5,000. For corporations other than S corporations, the threshold is the lesser of 10 percent of the required tax (or $10,000 if greater) and $10 million.2Internal Revenue Service. Accuracy-Related Penalty Including those specific figures in the effect field turns an abstract risk into a dollar amount that gets budget holders’ attention.
Financial impact is not limited to penalties. Calculate the total cost of the condition where possible: the dollar value of questioned transactions, the cost of rework, lost revenue from process delays, and the expense of implementing the corrective action itself. An effect field that reads “$23,400 in unauthorized purchases plus an estimated $8,000 in staff time to investigate and remediate” tells a complete story that a vague reference to “increased risk” never will.
Get the Root Cause Right
The cause field is where audit reports either earn credibility or lose it. “The employee made an error” does nothing to prevent recurrence. Effective root cause analysis needs a structured method.
The simplest approach is the 5 Whys: start with the observed condition and ask why until you reach a systemic issue. An expense report was approved without proper documentation. Why? The approver didn’t check. Why? There’s no checklist in the approval workflow. Why? The workflow was designed before the documentation policy was updated. Now you have something actionable: update the approval workflow to include the current documentation requirements.
For more complex problems with multiple contributing factors, a fishbone diagram maps potential causes across categories like staffing, process design, technology, and training. This visual approach prevents the auditor from anchoring on the first plausible explanation and missing other contributors. Fault tree analysis works similarly, tracing backward from the failure event through layers of contributing causes, and is particularly useful for operational breakdowns involving multiple systems.
Whatever method you use, the test is simple: if management fixed only the cause you identified, would the condition be unlikely to recur? If not, you haven’t dug deep enough.
Write Corrective Actions Management Can Execute
A well-constructed corrective action plan identifies the specific action to correct the issue, names the person responsible, and sets a concrete deadline. Federal agencies often use the SMART framework: specific, measurable, achievable, relevant, and time-bound.3Federal Transit Administration. How to Write SMART Corrective Action Plans “Improve internal controls” is not a corrective action plan. “The Controller will implement a secondary approval requirement for all purchase orders exceeding $5,000 by March 31, with the IT team configuring the automated workflow by February 15” is. Each action needs a measurable indicator so the follow-up audit can objectively verify completion.
Draft corrective action plans in collaboration with management rather than handing them down. The auditor identifies the root cause and recommends a direction; management owns the solution and the timeline. This is practical, not just diplomatic. Management knows operational constraints the auditor may not, and a plan management helped design is far more likely to get implemented.
Run the Exit Conference
The exit conference is the formal meeting where the auditor walks management through the completed findings before the final report is issued. It is not a surprise reveal. By this point the auditee should already have a general sense of the findings from ongoing communication during fieldwork. The meeting confirms accuracy, resolves misunderstandings, and secures management’s commitment to the corrective actions.
Who Should Be in the Room
At minimum, include the lead auditor, the staff members directly involved in the audited process, and at least one level of management above them. For findings that carry significant financial or regulatory risk, the chief audit executive or a representative from the audit committee should attend. Scheduling the right people matters more than scheduling quickly. An exit conference without decision-making authority in the room is a status update, not a closing meeting.
How to Structure the Meeting
Follow the structure of the report. Open with the engagement objectives and scope, then walk through each finding using the five-attribute framework. Spend extra time on the effect and cause fields, since those sections generate the most productive discussion and the most pushback. Present the evidence supporting each finding and give management a chance to offer context or corrections before the report is finalized.
Keep the meeting focused on facts and data. Exit conferences can get tense when findings reflect poorly on a department. The auditor’s job is to stay grounded in the evidence and avoid turning factual findings into personal criticisms. If management disputes a finding, note the disagreement, ask for supporting documentation, and agree on a timeline to resolve it before the final report goes out.
Collecting Management Responses
Organizations typically give management a set number of business days after the exit conference to submit formal written responses. No universal professional standard dictates this timeframe, though 10 to 15 business days is a common window. The written response should address each finding individually, either accepting it with a corrective action plan or explaining why management disagrees. Once management signs off, the report moves to final distribution.
Distribute the Final Report
The chief audit executive decides who receives the final report based on organizational protocols, the audit charter, and the nature of the findings. For public company audits, the auditor must communicate significant findings to the audit committee, including the overall audit strategy, significant risks identified, and any critical accounting estimates or unusual transactions.4Public Company Accounting Oversight Board. AS 1301 Communications with Audit Committees
Limit distribution to individuals whose roles require access. Audit reports routinely contain sensitive financial data, proprietary information, and details about control weaknesses that could be exploited. Many organizations mark reports “For Official Use Only” or apply similar restricted-access designations. Electronic distribution should include a confidentiality notice, and physical copies should be tracked.
For audits involving federal grants or contracts, distribution requirements may be dictated by the funding agency. Single Audit reports under the Uniform Guidance, for example, must be submitted within specific timeframes to the relevant federal agencies and to the Federal Audit Clearinghouse.
Handle Disagreements on the Record
When management disputes a finding, request specific evidence that contradicts the documented condition. If the evidence holds up, revise the finding. If it does not, document the disagreement in the final report alongside management’s response. Readers can then see both perspectives and the underlying evidence.
For public company audits, PCAOB standards require the auditor to communicate significant disagreements with management to the audit committee.4Public Company Accounting Oversight Board. AS 1301 Communications with Audit Committees If the auditor cannot reach an understanding with the audit committee on the terms of the engagement, the auditor should decline the engagement entirely.
In federal audit contexts, findings that remain unresolved six months after issuance trigger escalation. The National Science Foundation reports all open audit recommendations not implemented within six months to senior management and the Office of Inspector General, and includes them in the OIG’s semiannual report to Congress.5U.S. National Science Foundation. Audit Resolution – Manage Your Award Similar mechanisms exist across federal agencies. Unresolved findings do not disappear; they get more attention over time, not less.
Follow Up Until the Fix Holds
Issuing the report is not the end of the engagement. Follow-up verifies that management actually implemented the corrective actions they agreed to. Without it, the audit report is a document rather than a catalyst.
Federal guidelines offer a useful benchmark. Under the framework used by the General Services Administration, management must reach a final resolution on all findings within six months of the report date and complete all corrective actions within twelve months. Recommendations that remain open and overdue for 60 calendar days or more after their initial due date get escalated to upper management.6U.S. General Services Administration. Internal Audit Follow-up Handbook
Private-sector organizations set their own timelines, but the principle holds: high-risk findings need shorter leashes. A finding involving potential regulatory violations or significant financial exposure should be tracked on a 30- to 90-day cycle, while lower-risk process improvements might get a six-month check-in. The follow-up audit itself should test whether the corrective action actually resolved the root cause, not merely whether management checked the box.
If follow-up reveals that a corrective action was implemented but the underlying condition persists, the original root cause analysis was probably wrong. Reopen the finding with a deeper investigation rather than issuing a new finding for the same problem under a different label.