How to Write an Audit Finding: The 5 Elements, Wording, and Evidence

A well-written audit finding follows a five-part structure: state the criteria (what should be happening), describe the condition (what you observed), identify the cause (why the gap exists), quantify the effect (what it costs the organization), and prescribe a recommendation targeted at the cause. Learning how to write an audit finding comes down to executing each of those elements with enough precision that management can neither dismiss the finding nor act on it in a way that misses the underlying problem. Skip an element or handle one weakly and the whole finding loses the credibility it needs to drive corrective action.

The Five Elements at a Glance

Auditors call this the “Five C’s,” though the labels shift depending on which standard-setter you follow. The GAO’s Yellow Book uses criteria, condition, cause, and effect, with the recommendation flowing from the cause analysis. The IIA’s framework uses criterion, condition, consequence, cause, and corrective action. The Uniform Guidance at 2 CFR 200.516 requires all of these plus additional detail like questioned costs and sampling methodology. The labels are cosmetic. The logic underneath is identical: state the standard, describe what you found, explain why it happened, measure the impact, and propose a fix.

Each element carries a specific job, and each has a characteristic failure mode when skipped. A finding without a cause treats the symptom, so management’s corrective action misses the target. A finding without a quantified effect gets deprioritized against competing demands. A finding without specific criteria reads as opinion, and management will treat it as one.

State the Criteria

The criteria is your benchmark. It answers one question: what should be happening? This element has to point to something specific and authoritative, not to a general sense that things could be better. Strong criteria come from a hierarchy of sources, roughly in descending authority: federal or state statutes, regulatory requirements, professional standards, contractual obligations, grant terms, and documented internal policies and procedures.

For federal audits, the Yellow Book defines criteria as “the laws, regulations, contracts, grant agreements, standards, measures, expected performance, defined business practices, and benchmarks against which performance is compared or evaluated.”¹ The Uniform Guidance requires “the criteria or specific requirement” for every finding, and it expects the specific statute, regulation, or award term to be cited.²

In practice, this means writing something like: “Per the organization’s Procurement Policy 301, all purchase orders exceeding $10,000 require written approval from a Director-level executive before processing.” The criteria is a concrete threshold tied to a specific policy number, not a vague reference to “proper authorization.” The more precisely you state it, the harder it becomes for management to argue the standard doesn’t apply.

When multiple sources establish overlapping requirements, cite the highest authority. A federal regulation trumps an internal policy. If an internal policy merely restates the regulation, reference the regulation as the primary criteria and treat the policy as supporting context. Management can revise an internal policy to make your finding disappear on paper. They cannot revise a federal statute.

Watch for outdated criteria. If you reference a policy that was superseded six months before the audit period, you’ve undercut your own finding. Confirm the criteria was in effect during the period under review.

Describe the Condition

The condition is what you actually observed. It answers: what is happening? Keep it factual, drawn directly from the evidence gathered during fieldwork, stated without interpretation or blame.

A strong condition reads like a data point: “Of 50 purchase orders sampled during the period January through December 2025, 15 transactions totaling $450,000 did not contain the required Director-level approval.” That level of specificity does two things. It makes the finding verifiable, since anyone can pull those 15 transactions and confirm what you found. It also gives management no room to characterize the deficiency as isolated or trivial.

The Uniform Guidance requires findings to include “the condition found, including facts that support the deficiency,” along with information that provides “proper perspective for evaluating the prevalence and consequences” of the finding.² Indicate whether the exceptions represent an isolated instance or a systemic problem, relate the exceptions to the total population examined, and note whether the sample was statistically valid.

The condition is where auditors most often blur the line between fact and conclusion. “The department has weak controls over procurement” is a conclusion. “15 of 50 sampled purchase orders lacked required approval” is a condition. Save interpretive language for the effect and recommendation. The condition should be something a camera could record.

When your testing involves statistical sampling, include enough detail about the methodology that a reader can evaluate the reliability of the results. State the population size, sample size, selection method, and confidence level. If you extrapolate to estimate total exceptions across the full population, make the projection method transparent and distinguish the point estimate from any confidence interval you applied.

Identify the Root Cause

The cause is the analytical engine of the finding. It answers the question management cares about most: why did this happen? Getting this right requires the most rigorous thinking in the entire process, because the cause determines whether the recommendation actually fixes the problem or papers over it.

The Yellow Book defines cause as “the factor or factors responsible for the difference between the condition and the criteria” and notes that common factors include “poorly designed policies, procedures, or criteria; inconsistent, incomplete, or incorrect implementation; or factors beyond the control of program management.”¹ That last category matters. Sometimes the honest answer is that management’s resources don’t match the standard they’re held to.

The critical distinction is between the cause and the condition itself. The missing signature is the condition, not the cause. Ask why the signatures were missing. Was it because staff didn’t know the policy existed? Because the approval workflow in the procurement system routes orders incorrectly? Because the Director position was vacant for three months and nobody assigned a delegate? Each of those root causes leads to a fundamentally different recommendation.

A structured approach helps. The “five whys” technique, where you keep asking why each successive explanation occurred, is a starting point, though the PCAOB has noted that it “appears to be too linear and limiting for complex problems” and may miss the interrelationships between multiple causes and effects.³ For findings involving systemic breakdowns, map the contributing factors across multiple dimensions: people, processes, technology, and oversight. A purchase order might lack approval because of a training gap, a system that doesn’t enforce routing rules, and a supervisor who doesn’t review exception reports, all at once.

The cause must be logically traceable to the condition. If you claim the root cause is inadequate training, you need evidence that training was in fact absent or deficient. Interviews, training records, or the lack thereof should support the causal link. A cause that reads like speculation will undermine the entire finding.

Quantify the Effect

The effect is where you make the case for why anyone should care. It answers: so what? This element assigns urgency by translating the gap between criteria and condition into a measurable consequence.

Wherever possible, express the effect in dollars. If your testing identified 15 purchase orders totaling $450,000 that bypassed the approval control, and three of those orders turned out to be duplicate payments totaling $87,000, lead with the $87,000 in confirmed improper payments. The Yellow Book describes the effect as “a measure of those consequences” resulting from the difference between the condition and the criteria, and notes it may be used “to demonstrate the need for corrective action.”¹

When direct financial loss isn’t immediately apparent, quantify the risk exposure instead. Project the sample error rate to the full population to estimate total potential exceptions. Calculate the regulatory penalties the organization faces for noncompliance. Describe the increased probability of fraud going undetected. For federal award audits, any known questioned costs exceeding $25,000 for a major program must be reported as a finding, so the financial quantification isn’t optional in that context.²

If your finding is based on a statistical sample, you can extrapolate to estimate the total effect across the full population. This typically involves calculating a point estimate of the total error and constructing a confidence interval around it. The projection must correspond to the sampling design, and the confidence level should be stated explicitly. Auditors commonly use a 90% or 95% confidence level. A finding that says “based on our sample, we estimate total improper payments of $2.1 million with 95% confidence” carries substantially more weight than one that simply reports the exceptions found in the sample.

The connection between condition and effect must remain demonstrable. If the control failure is in accounts payable, the effect should follow: increased risk of duplicate payments, undetected vendor fraud, or financial statement misstatement. Speculative effects that don’t flow from the observed condition weaken the finding.

Write the Recommendation

The recommendation is the only forward-looking element in the finding, and it must target the root cause directly. If the cause was inadequate training, the recommendation should address training, not add a layer of supervisory review that sidesteps the underlying problem.

Vague recommendations are the single most common reason findings stall in implementation. “Management should strengthen internal controls” tells management nothing they can act on. Compare that with: “Implement mandatory annual training on Procurement Policy 301 for all staff with purchasing authority, with completion tracking managed by the Training Department and first cycle completed by Q3 2026.” The second version specifies the action, the population, the responsible party, and the deadline.

Recommendations should be proportionate to the effect. A finding with $2 million in questioned costs warrants a systemic process overhaul. A finding involving a single missed approval on a low-dollar transaction probably doesn’t justify hiring additional staff. When the cost of the fix would exceed the cost of the risk, say so. Auditors gain credibility by acknowledging practical constraints rather than issuing recommendations detached from operational reality.

The IIA’s Global Internal Audit Standards require that the final engagement communication include “recommendations and/or action plans if applicable” and specify “the individuals responsible for addressing the findings and the planned date by which the actions should be completed.”⁴ Building those elements into your recommendation from the start streamlines the management response process.

Classify the Severity

Not every control deficiency rises to the same level, and the classification you assign determines who gets notified, what gets reported publicly, and how urgently management must respond. The PCAOB’s framework establishes three tiers of severity for public company audits.

A deficiency exists when a control’s design or operation doesn’t allow employees to prevent or detect misstatements in the normal course of their work. Many deficiencies are reported to management but not disclosed externally.
A significant deficiency is a deficiency, or combination of deficiencies, “less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.” These get reported to the audit committee.
A material weakness is a deficiency, or combination of deficiencies, where there is “a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis.” When even one material weakness exists, the company’s internal controls cannot be considered effective.

The severity assessment depends on two factors: whether there’s a reasonable possibility that the control will fail to prevent or detect a misstatement, and the magnitude of the potential misstatement that could result.⁵ Multiple deficiencies affecting the same account or assertion can combine into a material weakness even when each one standing alone would be less severe.

For federal award audits under the Uniform Guidance, auditors must report significant deficiencies and material weaknesses in internal control over major programs, along with material noncompliance with federal award terms.² Getting the classification right matters: a material weakness in a Single Audit triggers federal agency review, potential corrective action plans, and possible restrictions on future funding.

Word Choices That Get Findings Accepted

Structure gets a finding into the right format. Writing quality determines whether anyone acts on it. The IIA Standards require that final communications be “accurate, objective, clear, concise, constructive, complete, and timely.”⁴ A few habits make findings harder to dismiss.

Findings that assign blame get fought. Findings that describe facts get resolved. “Management failed to” sounds like an accusation. “Purchase orders were processed without the required Director-level approval” describes the same condition without pointing a finger. The second version gets concurrence faster because management isn’t defending their competence while reading it.

Adjectives like “inadequate” and “ineffective” trigger defensiveness rather than action. Describe the specific gap instead. Rather than calling controls inadequate, state that the approval workflow does not require system-enforced routing above the $10,000 threshold. Let the reader reach the conclusion on their own.

Watch for qualifiers that undermine your credibility. Phrases like “it appears that” signal uncertainty. In audit work, things either are or they aren’t. If your evidence supports the condition, state it directly. If it doesn’t, you need more evidence, not softer language.

Executives rarely start at page one and work through methodically. They scan for dollar amounts, severity ratings, and deadlines. Front-load the effect in your finding’s opening sentence when possible. “An estimated $2.1 million in improper payments resulted from…” immediately communicates urgency. Burying the dollar figure in the third paragraph behind methodological detail guarantees it gets missed.

Keep language specific and measurable. “A high rate of noncompliance” means different things to different readers. “A 30% noncompliance rate across 200 sampled transactions” means one thing. Wherever you can replace a qualitative judgment with a number, do it.

Back It Up With Documentation

A finding is only as strong as the workpapers behind it. Professional standards require audit documentation “in sufficient detail to support the conclusions reached” in the auditor’s report. The PCAOB standard puts the consequence bluntly: if documentation “does not exist for a particular procedure or conclusion related to a significant matter, it casts doubt as to whether the necessary work was done.”⁶

For each element of the finding, your workpapers should contain the specific evidence that supports it. The criteria should trace to the actual policy document, regulation, or statute you cited. The condition should be supported by testing schedules, transaction listings, or system screenshots showing the exceptions. The cause should connect to interview notes, process walkthroughs, or training records. The effect should tie to calculations, extrapolation models, or risk assessments.

If someone who wasn’t on the engagement picked up your workpapers, they should be able to understand what you tested, what you found, and how you reached your conclusions without needing to call you. That experienced-auditor benchmark, where documentation must be understandable to a qualified professional with no prior connection to the engagement, is the standard most frameworks apply. Oral explanations alone are never sufficient to replace missing documentation.

Which Standards Apply to Your Engagement

The required elements and reporting thresholds shift depending on which framework governs your work. Confirm which one applies before you draft.

Government Auditing Standards (the Yellow Book), issued by the GAO, apply to financial audits, attestation engagements, and performance audits of government entities. The 2024 revision requires auditors to develop the criteria, condition, cause, and effect “to the extent that these elements are relevant and necessary to achieve the audit objectives.” The 2024 standards are effective for engagements beginning on or after December 15, 2025.¹⁷
The IIA’s Global Internal Audit Standards took effect in January 2025. Standard 15.1 requires that each assurance engagement’s final communication include “the findings and their significance and prioritization,” along with conclusions on the effectiveness of governance, risk management, and control processes.⁴
The Uniform Guidance at 2 CFR 200.516 applies to Single Audits of organizations spending federal awards. It requires specific elements including criteria, condition, cause, effect, questioned costs, sampling methodology, and identification of repeat findings.²
PCAOB standards govern audits of public companies. AS 2201 establishes the framework for evaluating and classifying control deficiencies, with the amended standard effective December 15, 2026.⁵

Whichever framework governs your engagement, the underlying logic is the same. Establish what should be. Describe what is. Explain why the gap exists. Quantify the consequences. Prescribe a solution aimed at the root cause. Master that sequence and the framework-specific requirements become details rather than obstacles.

1
U.S. Government Accountability Office. Government Auditing Standards 2024 Revision
2
eCFR. 2 CFR 200.516 Audit Findings
3
Public Company Accounting Oversight Board. Spotlight – Root Cause Analysis
4
The Institute of Internal Auditors. Global Internal Audit Standards
5
Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
6
Public Company Accounting Oversight Board. AS 1215 – Audit Documentation – Appendix A
7
U.S. Government Accountability Office. Yellow Book – Government Auditing Standards