What it means
An internal auditor may test whether purchases have approval before payment. If some sampled payments lack evidence of approval, the auditor considers whether the gap meets the criteria for a reportable finding, and a single missing signature does not by itself establish the amount of loss or prove fraud.
Check the criteria before reporting, because if a policy was replaced or a contract permits an exception, an apparently missing approval may be valid. The Institute of Internal Auditors describes five useful attributes: condition, criteria, effect, cause and recommendation.
The condition states the observed facts and the criteria identify the policy, law or control objective used for comparison. The effect explains actual harm or a plausible exposure without exaggerating it, and the cause asks why the process failed, whether an employee ignored a working rule or the system routed urgent payments around it.
The recommendation should address the cause where practical, not just repeat "follow the policy". Evidence matters at every step, so define the scope of testing, saying which sites, period and transactions were examined and whether the result came from a sample.
Five exceptions in 50 sampled invoices is a finding about that sample; it is not proof that exactly 10% of all company invoices have the same error. Ask the process owner for context and inspect records.
Fair challenge strengthens a finding, though it does not mean an auditor must accept an unsupported explanation. Explain the effect in business terms and distinguish observed loss from possible loss, since a missing review can permit inaccurate or unauthorised payments, but that is a risk unless an actual wrong payment has been established.
Severity ratings vary across audit teams. A high-rated finding could reflect likely harm, weak compensating controls or a regulatory issue, not merely the number of exceptions, so ask for the rating criteria and consider likelihood and impact.
A low label is not permission to ignore a recurring weakness. A management response should name an owner, action and realistic completion date, because "staff will be reminded" is often weaker than fixing a system approval route and checking the result.
If the full fix takes months, record an interim control and its limits, and keep evidence of implementation. Where auditors and management disagree about root cause or risk, record the evidence and the differing view rather than quietly deleting the issue, escalate unresolved high-risk matters to the audit committee or board, and keep the finding concise, avoiding naming an individual when a broken process is the real cause.
In practice
Real-world examples.
Example
An internal auditor finds that four sampled new suppliers lacked independent bank-detail verification and documents the scope and payment risk. The report states that 40 new suppliers were tested over six months and that no wrong payment was identified. The finding is rated by its potential for fraud, not by any loss that has occurred.
Example
A warehouse policy requires two checks before dispatch, but a tested shift used one. Management checks whether an approved exception existed. It turns out the night shift had a written temporary arrangement approved by the operations director, so the auditor revises the wording of the finding.
Example
A finding about dormant user accounts is closed only after access is removed and a later test confirms the monthly review works. The first follow-up showed the accounts had been disabled, but the review had not been run again. The auditor keeps the finding open until the second monthly review is evidenced.
Formula
Calculation
Illustrative on-time closure rate = findings verified closed by due date / findings due in the period x 100. If 16 of 20 due findings were verified closed on time, the rate is 16 / 20 x 100 = 80%. A separate count of overdue high-risk findings prevents this average from hiding serious open issues.
A sample exception rate is calculated differently: exceptions / items tested. Five exceptions in 50 sampled invoices is 5 / 50 = 10% of the sample. If those five payments averaged $4,000, the unapproved payments in the sample total 5 x $4,000 = $20,000, which describes exposure in the sample, not a proven loss.Case study
Seen in the real world.
This illustrative and entirely fictional case follows Beacon Supplies, an invented wholesaler. Its internal auditor tested 50 supplier changes and found five with no evidence of a callback to a verified number. The written finding cited the approval policy, sample and risk of paying a false account, without claiming that fraud occurred. The finance head found that the system allowed urgent changes to skip the callback field.
She assigned a system change and a temporary daily review, with dates and owners. A later sample checked that the callback was documented; closure was based on evidence rather than a promise. The audit committee received a short summary showing the finding, the cause and the closure evidence. Because the fix addressed the system gap instead of reminding staff, the next year's test found no exceptions in a sample of the same size.
Watch out
Common mistakes.
- Calling a sample exception proof of company-wide loss, fraud or a precise population error rate.
- Writing a recommendation that restates the rule without investigating why the process failed.
- Marking a finding closed on an owner's assurance without checking that the action works.
Questions
People also ask.
What is an audit finding?
It is a documented issue supported by evidence against relevant criteria, with an explanation of its effect or risk. Reporting format depends on the audit.
Does every finding involve an accounting error?
No. A finding can concern a control, process, compliance or safety risk without a quantified accounting error. Treat any proposed journal separately.
What happens next?
Management implements the action; an auditor or assigned control reviewer checks evidence under the organisation's follow-up process. Implementation and effectiveness may have separate statuses.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%