An internal audit finding is a result of evaluating evidence against audit criteria. It may support conformity, identify a nonconformity or highlight another relevant conclusion. A useful finding tells the reader what was established and why, without substituting an auditor’s preference for an actual requirement.
The internal audit guide places findings between evidence collection and follow-up. Getting this relationship right matters because vague findings often lead to vague corrective actions.
Identify the criterion before declaring a failure
A nonconformity needs a requirement that was not fulfilled. The criterion may arise from the applicable standard, an adopted internal arrangement, a customer commitment or another relevant obligation within scope. Identify its source and current version.
An auditor may prefer a particular form, approval sequence or software tool. That preference is not itself a criterion. Ask whether the organisation’s chosen method meets the actual requirement and is implemented effectively.
Conversely, an organisation cannot simply disregard its own controlled arrangements without considering their status. If a procedure requires a check that is not performed, the auditor should evaluate that evidence rather than dismiss the procedure as extra paperwork.
Describe evidence precisely
Record what was examined: relevant cases, dates, records, observations or statements. Preserve enough detail that the process owner can locate the evidence. Avoid unnecessary copying of confidential data when a controlled reference is sufficient.
A statement such as training is inadequate leaves several questions unanswered. Which task requires competence, what arrangement applies and what evidence demonstrates a gap? A course certificate may exist while observed performance reveals an unresolved capability issue; absence of a course certificate does not by itself establish incompetence.
Distinguish facts from inference. If three sampled records lack a required approval, state that. If investigation establishes that the system has no approval mechanism, describe the wider evidence supporting that conclusion.
Build a clear nonconformity statement
A practical structure connects the requirement, evidence and gap. The order can vary. The essential point is that a person who was not present should understand the failure without guessing the auditor’s reasoning.
| Weak statement | Why it is weak | Better direction |
|---|---|---|
| Poor document control | No identifiable requirement or example | Identify obsolete instructions found in use and the relevant control |
| Staff need retraining | Prescribes a solution before the cause is known | Describe the demonstrated competence or performance gap |
| Management is not committed | Broad judgement without supporting facts | Identify the unmet responsibility and evidence |
| No risk matrix | Assumes a preferred method is mandatory | Evaluate how relevant risks were considered and addressed |
These examples illustrate writing principles. A real finding needs actual evidence, not a copied formulation.
Separate findings from improvement possibilities
An improvement suggestion identifies a possible beneficial change. It should be clearly optional unless an applicable requirement makes the issue mandatory. Do not present a demonstrated failure as merely an opportunity for improvement to avoid reporting a nonconformity.
Likewise, avoid labelling every difference from common practice as a failure. Two organisations can use different controls and both achieve the required result. The auditor should be able to explain why the evidence meets or does not meet the criterion.
Positive findings can be informative when they explain effective controls or transferable learning. They should remain evidence-based rather than serving as decorative praise to balance a report.
Use grading only with defined meaning
Some organisations grade internal findings by consequence, extent or urgency. If grading is used, explain the categories and decision rules. Do not assume that a certification body’s major and minor classifications automatically govern the internal programme.
A small number of visible examples can reveal a consequential system failure, while a larger number of low-consequence clerical errors may require different treatment. Counting examples alone does not determine severity.
Uncertainty should lead to proportionate enquiry, not arbitrary escalation or downplaying. Where the evidence is insufficient, record the limitation and identify what additional work is needed.
Discuss facts without negotiating evidence away
Share emerging findings with relevant people so they can clarify records and correct misunderstandings. A different document version or omitted approval record may change the conclusion. The auditor should remain willing to revise an inaccurate finding.
However, pressure to maintain a clean report is not evidence. Where disagreement remains, use the organisation’s resolution process and preserve the basis for the finding. Confidentiality and respectful communication help maintain trust without weakening objectivity.
The audit report example shows how findings sit within a report that explains scope and limitations.
Make the finding usable for investigation
The process owner needs a clear problem statement before investigating cause. The finding should not jump straight to retraining, disciplinary action or buying software. Those are possible responses that require their own reasoning.
A precise finding supports assessment of affected work, immediate correction, cause investigation and later effectiveness review. Its quality is measured by the traceable relationship between requirement and evidence, not by the strength of its adjectives or the number of clauses cited.