A good audit observation answers four questions: what did you find (condition), what should have happened (criteria), why did it happen (cause) and what is the impact (effect). Add a practical recommendation and the reader can act without a follow-up call.
Last reviewed: 17 October 2026. Facts checked. We searched for how audit training material defines the elements of a finding and found the same four elements plus a recommendation, with small differences in labels. The examples below are made-up illustrations, not real clients, and the figures in them are invented for teaching only.
The elements of an observation
| Element | Question it answers | One-line test |
|---|---|---|
| Criteria | What should be happening? | Can I point to a policy, law or standard? |
| Condition | What did we actually find? | Is it a fact we can evidence? |
| Cause | Why did the gap arise? | Does it explain the reason, not restate the gap? |
| Effect | So what? | Is the impact real or clearly marked as potential? |
| Recommendation | What should change? | Is it specific and doable? |
Some teams call this "the five Cs" or "CCCE". The labels differ, but the thinking is the same.
Criteria: the yardstick
Criteria are the benchmark you measured against. Good sources include:
- A written company policy or approval matrix.
- A law or regulation.
- A contract term.
- A recognised framework.
- A good practice that management has agreed to follow.
If you cannot name a yardstick, you may have an opinion, not an observation. Say so, or drop it.
Condition: the fact
State what you found in plain numbers. Give the sample size, the period and how many exceptions. Avoid adjectives like "poor" or "weak". Facts persuade more than adjectives.
Cause: the root, not the symptom
This is the part most often done badly. "Approvals were missing because they were not obtained" is not a cause. Ask "why" until you reach something management can fix:
- No one owns the step.
- The system allows posting without approval.
- The policy changed and staff were not told.
- The team is short-staffed at month end.
Effect: the consequence
Explain the risk in terms the audit committee cares about: money, regulatory exposure, fraud, delay, reputation. If nothing has gone wrong yet, call it a potential effect. Do not exaggerate.
Worked example 1: vendor master changes
- Criteria: The procurement policy requires a second person to approve any change to vendor bank details.
- Condition: In a sample of 25 bank-detail changes in the last six months, 7 had no second approval on record.
- Cause: The ERP lets the same user make and release the change. The approval step is a manual email that is not enforced.
- Effect: An unauthorised change to bank details could send a payment to the wrong account, and the company would not detect it.
- Recommendation: Configure the system so the maker cannot release their own change. Until then, run a weekly report of changes and have finance review it.
Worked example 2: expense claims
- Criteria: The travel policy requires original bills for claims above the limit set in the policy.
- Condition: Of 40 claims reviewed, 9 above the limit had photocopies or no bill.
- Cause: Approvers are not told to check bills, and the reimbursement form has no tick box for it.
- Effect: Claims could be inflated or duplicated without detection.
- Recommendation: Add a bill-attached check to the form and to the approver's checklist. Reject claims without bills.
Worked example 3: statutory dues
- Criteria: Payroll deductions must be deposited by the due date set by the relevant law.
- Condition: In 4 of 12 months reviewed, the deposit was made after the due date.
- Cause: The deposit depends on one person, and there is no calendar alert or backup.
- Effect: The company may pay interest or penalties and face notices.
- Recommendation: Set up a compliance calendar with a named backup, and review it monthly.
Writing the recommendation
- Start with a verb: configure, review, approve, train.
- Fix the cause, not only the instance.
- Say who should do it and by when, as agreed with management.
- Be realistic about cost and effort.
- Offer an interim step when the full fix takes months.
A short checklist before you issue
- Is the criteria a real, citable source?
- Is the condition backed by evidence in the file?
- Does the cause explain why, not what?
- Is the effect honest about what happened versus what could happen?
- Is the recommendation specific?
- Would a busy director understand it in 30 seconds?
- Has management seen the facts and confirmed them?
Our observation report generator gives you a template, and the issue rating matrix generator helps you rate how serious each observation is.
Frequently Asked Questions
Do I need all four elements every time?
For significant observations, yes. For small housekeeping points, a short note with condition and recommendation may do. Be consistent about the rule you apply.
What is the difference between cause and effect?
Cause looks backwards: why did it happen? Effect looks forwards: what could it lead to?
Can AI draft observations?
It can help with wording once you have the facts, but a person must confirm the evidence and the cause. We cover this in our article on whether AI can write an internal audit report.
How long should an observation be?
Usually half a page or less. Put detail in an annexure.
What if management disagrees?
Record their response next to the observation. If the facts are wrong, fix them. If they accept the facts but not the risk, say so in the report and let the audit committee decide.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error