How to Write High-Impact Audit Findings

Findings that describe symptoms, use dramatic wording or end with a weak recommendation rarely lead to change. This guide shows how to turn audit evidence into concise, decision-useful findings.

Use it when drafting findings or reviewing them before the report. The six steps are: state the condition, what is happening now; define the criteria, what should happen instead; explain the risk or consequence in business terms; identify the root cause rather than stopping at the symptom; quantify or illustrate the exposure where evidence allows; and write a recommendation or management action that addresses the cause.

The worked example shows the structure in practice: 27% of sampled supplier bank changes lacked evidence of independent verification; fraudulent bank changes may redirect payments; the root cause is unclear ownership and an ERP workflow that does not require proof before release; and the action is to assign accountable ownership and require verification evidence before the change takes effect. The quick reference reminds you that a finding should help management make a decision, should lead with the issue and risk rather than background, and should use neutral, evidence-based language. Use the auditor prompt, quality check and mini self-check before issuing the finding.