F.10 Attributes of a Well-Developed Audit Finding

  1. Attributes to be discussed:
    1. Condition (What is…?)
    2. Criteria (What should be…?)
    3. Effect (So what?)
    4. Cause (Why did it happen?)
    5. Recommendation (What should be done?)

A. Condition

  1. The statement of condition identifies the nature and extent of the finding or unsatisfactory condition. It is the facts. It often answers the question: "What is wrong?" Normally, a clear and accurate statement of condition evolves from the internal auditor's comparison of results with appropriate evaluation criteria.

B. Criteria

  1. This attribute establishes the legitimacy of the finding by identifying the evaluation criteria, and answers the question: "By what standards was it judged?" In operational or management audits, criteria could be contribution to management objectives, compliance with objectives, plans, industry or Office of the Auditor General of Canada (Office) standards, contracts, policies, procedures, guidelines, laws or regulations, and expectations for efficiency, effectiveness, and economy. In financial audits, criteria could be accuracy, materiality, consistency, or compliance with applicable accounting principles and legal or regulatory requirements. In audits of efficiency, economy, and program results (effectiveness), criteria might be defined in mission, operation, or function statements; performance, production, and cost standards; contractual agreements; program objectives; policies, procedures, and other command media; or other external sources of authoritative criteria.

C. Effect

  1. This attribute identifies the real or potential impact of the condition and answers the question: "What effect did/could it have?"

  2. The significance of a condition is usually judged by its effect. In operational audits, reduction in efficiency and economy, or not attaining program objectives (effectiveness), are appropriate measures of effect. These are frequently expressed in quantitative terms; e.g. dollars, number of personnel, units of production, quantities of material, number of transactions, or elapsed time. If the real effect cannot be determined, potential or intangible effects can sometimes be useful in showing the significance of the condition.

  3. Accurate evaluation of the real or potential effect is crucial in determining the effort, resources, or control that should be applied to improve the situation, as well as in getting management’s buy-in on the issue.

D. Cause

  1. The fourth attribute identifies the underlying reasons for unsatisfactory conditions or findings, and answers the question: "Why did it happen?"

  2. If the condition has persisted for a long period of time or is intensifying, the contributing causes for these characteristics of the condition should also be described.

  3. Identification of the cause of an unsatisfactory condition or finding is a prerequisite to making meaningful recommendations for corrective action. The cause may be quite obvious or may be identified by deductive reasoning if the audit recommendation points out a specific and practical way to correct the condition. However, failure to identify the cause in a finding may also mean the cause was not determined because of limitation or defects in audit work, or was omitted to avoid direct confrontation with responsible officials.

  4. An internal auditor’s failure to thoroughly investigate down to the real root cause can also contribute to a less-than-adequate recommendation, possibly fixing the wrong thing or correcting the symptom rather than the real cause. Frequently, the real root cause is a “soft” issue that otherwise would not be addressed.

E. Recommendations

  1. This final attribute identifies suggested improvement action and answers the question: "What should be done?"

  2. The relationship between the audit recommendation and the underlying cause of the condition should be clear and logical. If a relationship exists, the recommended action will most likely be feasible and appropriately directed.

  3. The quality and sustainability of the improvement action will be significantly enhanced if management is brought into the discussion and takes part with internal audit in jointly developing the solution.

  4. Recommendations in the audit report should state precisely what improvement action has been agreed upon. More generalized recommendations (e.g. greater attention be given, controls be reemphasized, a study be made, or consideration be given) should not be used in the audit report, although they are sometimes appropriate in summary reports to direct senior management's attention to specific areas.

  5. Unless benefits of taking the recommended action are very obvious, they should be stated. Whenever possible, the benefits should be quantified in terms of additional revenue, lower costs, or enhanced effectiveness or efficiency. The cost of implementing and maintaining recommendations should always be compared to risk.

  6. Recommendations should be directed to the individual with both adequate knowledge and effective responsibility or authority to ensure implementation of improvement action.

  7. In line with Office Performance Audit policies on recommendations, management responses are required to clearly indicate if they agree or disagree with the recommendation. All responses must be kept to a maximum of 200 words, and should include actions that the area under audit intends to take to respond to the recommendation. A detailed action plan will be included separately with timelines and a breakdown of what will be completed. If management does not agree with the recommendation, the response must state the reason. This reason is also included in the audit report.

Summary

  1. Well-written internal audit findings should result in recommendations that add value to the Office by including the nature of the findings, the criteria used to determine the existence of the condition, the root cause of the condition, the significance of its impact, and what the internal auditors (with management’s input) recommend should be done to improve the situation.

  2. In describing each of the attributes, the use of client-related terminology and avoidance of internal audit jargon will enhance understanding of the finding.

  3. Fully developed findings containing each of the five attributes are easily understood, convey impact and significance to appropriate management, and enhance the likelihood and sustainability of improvement action.

Last modified:
2018-02-23