Elements of an Audit Finding
Audit findings should be developed, documented, and reported in accordance with the basic five finding elements, to the extent feasible and practical. Each reported finding should be self-contained and it should stand alone. The elements are:
CRITERIA
CONDITION
CAUSE
EFFECT
RECOMMENDATION
(1) Exceptions
Auditors are expected to use professional judgment and due professional care in obtaining the information needed to report findings according to the above elements. However, situations may occur when it is not feasible or practical to obtain this information or when the audit objectives require that the findings be reported in some other manner.
These exceptions should be discussed with one's supervisor and clearly documented in the working papers. The finding(s) should then be reported in the manner most appropriate to the circumstance(s). All adequately supported material findings should be reported, even if one or more of the elements is missing.
Such exceptions may occur where the auditor is unable to determine the cause of a particular condition, or unable to reasonably ascertain its effect in dollars or other terms. There may also be situations where the auditor is unable to cite a particular law, regulation, or industry standard as the criteria for determining that reportable conditions exist (i.e., professional judgment).
Element Descriptions
The development of audit findings is best measured by comparing what exists with some standard of what is acceptable. The auditor compares what is with what should be. If the developed finding meets all acceptable standards it will be logical and reasonable, and it will provide a means to motivate corrective action. If something is missing, the finding may be disputed, or it may result in grudging action or no action at all. Findings that properly include these elements will represent a strong argument for corrective action.
(1) Criteria: what should be
"Criteria are the standards used to determine whether a program meets or exceeds expectations." The criteria include the goals and objectives that management wishes accomplished, in accordance with the policies, procedures, and standards that management has created, to govern the operation effectively, efficiently, and economically. In our environment these might also include laws, regulations, agency policies and procedures, and industry/other government agencies' standards.
The auditor will also have to determine what is reasonable in those instances where management has not established standards (i.e., there is no written policy, or there are no goals/objectives). In some instances, it may be preferable to obtain agency agreement with auditor-developed criteria before applying them.
(2) Condition: what is
"Condition is a situation that exists. It has been determined and documented during the audit." The gathered information should be sufficient, competent, and relevant, and it should be able to withstand challenge. It must be representative of the total population or system under review or, if an isolated instance, be a significant defect. The auditee may disagree with an auditor's interpretation, but if the condition is properly identified, the auditee will have no reasonable basis to disagree with the facts that the auditor has gathered.
(3) Cause: why the deviation from the criteria occurred
Cause explains why standards were deviated from, why goals were not met, and why objectives were not attained. Recommendations are most effective when they address an identified condition and cause. The auditor may not be able to easily or always identify the cause, and might consult management for their opinion as to what has caused the observed condition.
(4) Effect: what happened or could happen because the condition differed from the criteria
Effect answers the "so what?" question: assuming that all the facts are as represented, what is the result and significance of this? Who or what organization is being harmed, and how badly? Which agency goals and objectives aren't being met, or are costing more money or effort than they should? Effect is the element needed to convince auditees and higher management that the undesirable condition, if permitted to continue, will cause harm and would cost more than the action needed to correct the problem.
(5) Recommendations: what is needed to correct the condition and improve operations
Recommendations describe the course of action management should take to correct the audit-identified condition. "Recommendations are most constructive when they are directed as resolving the cause of identified problems, are action oriented and specific, are addressed to parties that have the authority to act, are feasible, and to the extent practical, are cost-effective."
E. Conclusion
Attached is an Audit Finding Sheet form for those auditors who find its use convenient in developing findings. The use of this form is optional.