A finding is the unit of internal audit output. The IIA Global Internal Audit Standards present the work in a specific order: gather information that is relevant, reliable and sufficient (Standard 14.1), compare criteria with condition (14.2), evaluate significance (14.3), and agree on recommendations or action plans (14.4). The implementation text of Standard 14.3 lists the elements a finding template documents: criteria, condition, root cause when possible, effect, and significance with prioritization. This post turns those standards into a template with one complete example.
Step 1: Information that supports a finding
Standard 14.1 sets three tests for information. It must be relevant (consistent with the objectives and scope), reliable (factual and current, strengthened when obtained directly by an internal auditor or from an independent source, corroborated, or taken from a system with effective governance, risk management and control processes) and sufficient (enough that a prudent, informed and competent person could repeat the work program and reach the same conclusions). If relevant evidence cannot be obtained, the auditor decides whether that absence is itself a finding.
Step 2: Criteria against condition
Standard 14.2 requires auditors to analyze information to determine whether there is a difference between the evaluation criteria and the existing state of the activity, called the condition. A difference indicates a potential finding that must be noted and evaluated further. If initial analyses do not give enough evidence, auditors use due professional care to decide on additional analyses, and the work program is adjusted with the chief audit executive's approval. If there is no difference and no more analysis is needed, the engagement conclusion gives assurance on effectiveness.
The implementation text adds that auditors should understand and use technology that makes analysis more efficient, including software that tests an entire population instead of a sample.
Step 3: Cause, effect and significance
Standard 14.3 requires each potential finding to be evaluated for significance. Auditors must collaborate with management to identify root causes when possible, determine the potential effects, and evaluate the significance, considering the likelihood of the risk occurring and its impact. A significant risk must be documented and communicated as a finding. Other risks may be reported as findings depending on circumstances and methodology. Each finding must be prioritized using the methodology the chief audit executive established.
The implementation text adds three practical points:
- Root cause is described as an underlying or deeper issue than the direct reason a condition exists, and at its simplest it involves asking a series of questions about why the difference exists. See /us/blog/5-whys-root-cause-analysis-for-control-failures.
- To judge significance, auditors identify and evaluate existing controls for design adequacy and effectiveness and then determine the residual risk, the risk that remains with the controls in place.
- The chief audit executive may provide a template that captures criteria, condition, root cause when possible, effect (risk or potential exposure), and significance and prioritization. Findings are written succinctly, in plain language the management of the activity understands.
Worked finding: duplicate vendor payments
This is a hypothetical example.
Criteria. Accounts payable procedure 4.2 requires the system to reject an invoice with the same vendor and invoice number as an existing one, and requires the AP supervisor to review the duplicate-payment exception report weekly.
Condition. Internal audit tested all 18,400 invoices paid in the 12-month period under review using a full-population match on vendor, amount and invoice date, ignoring invoice number. It found 31 pairs where the second payment matched the first on vendor and amount and the invoice numbers differed by a trailing character or a leading zero. The total of the second payments was $187,400. The system's duplicate check compared invoice numbers exactly. The weekly exception report was run but no review evidence exists for 40 of 52 weeks.
Cause. The ERP duplicate check does not normalize invoice numbers, and the supervisor review was never assigned a backup during absences. The control design therefore relied on exact matching and an undocumented review.
Effect. Overpayments of $187,400 to date, of which AP has recovered $42,000 as of the end of fieldwork. Residual risk is high: the volume of invoices is high, the review control is the only detective control, and prior overpayments suggest the exposure will recur.
Priority. High, because a preventive control and the detective control both failed over the period.
Recommendation. Configure the system to strip leading zeros and punctuation before comparing; add a fuzzy match on amount, vendor and date; document the weekly review with a signed exception report; assign a backup reviewer. The AP supervisor agrees and sets a completion date for each step.
Standard 14.4 requires auditors to decide whether to develop recommendations, request action plans or agree actions with management. The actions should resolve the difference between criteria and condition, reduce risk to an acceptable level, address the root cause and improve the activity. Recommendations must be discussed with management, and if the two disagree, the established methodology lets both sides state their positions and reach a resolution.
Step 4: The conclusion and the file
Under Standard 14.5, the engagement conclusion summarizes results against the engagement objectives and management's objectives, and states the auditors' judgment on the overall significance of the aggregated findings. An assurance conclusion includes a judgment on the effectiveness of governance, risk management or control processes and acknowledges where processes are effective. A report with only exceptions misses that last requirement.
Standard 14.6 requires documentation that lets an informed, prudent auditor repeat the work and derive the same results, review by internal auditors and the engagement supervisor, and review and approval by the chief audit executive. Workpapers for the example would hold the population extract, the matching logic, the 31 pairs, the sample of payments traced to bank records, the exception report history and the management response.
Pitfalls
- Reporting the symptom (duplicate payments) without the cause (exact-match design).
- A finding with no criteria, so management argues the benchmark.
- Effect stated as "risk of loss" with no quantification attempt. The implementation text says the extent of exposure is often an estimate informed by professional judgment and input from management, and tells auditors to explore how the impact may be quantified.
- Rating every finding high.
For the report that carries findings to the audit committee, see /us/blog/internal-audit-final-report-contents-standard-15-1.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- The IIA, Global Internal Audit Standards (2024), Standards 14.1 through 14.6: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error