Audit Finding

Auditors compare practice with a criterion such as a policy, law or standard. A well-formed finding says what was found, what standard it was measured against, why it happened, what could go wrong as a result, and what to do about it. Findings are rated, for instance high, medium or low, based on impact and likelihood. Management replies with an action plan, an owner and a deadline; the auditor then tracks closure and may test the fix. Terms vary: observation, issue and exception are common, and some firms keep observation for minor points and finding for control failures. Findings feed into the overall audit opinion and go to the audit committee. Overdue and repeat findings are watched as signs of how seriously a business treats controls.

In an audit of supplier payments at a manufacturer, the team tests 60 payments and finds 9 released without a second approver, against a policy requiring two. The report rates the finding high, gives the cause as a system setting that allows one-person release, and recommends changing it. Management agrees to fix the setting within 60 days.