Audit reporting, findings, corrective action, and follow-up
Anatomy of a finding
Criteria (the requirement), condition (what was found, with evidence), cause (why it happened), effect or risk (business impact if it recurs), and recommendation. Missing cause produces findings that recur year after year; missing criteria makes the finding arguable.
The report
State objective, scope, criteria, period, team, summary opinion, findings by grade (major nonconformity, minor nonconformity, observation or opportunity for improvement), management responses, and distribution. Be accurate, concise, timely and constructive - describe the requirement and the condition, not the person.
Corrective action
Management owns the action. Agree the root-cause correction, an owner, a due date, and the evidence that will demonstrate completion. Recommendations should not name a vendor or design the solution; that returns you to consultancy.
Follow-up
Verify two things separately: implementation (was it done?) and effectiveness (did the risk actually reduce?). For significant findings, closure should rest on verified effectiveness, not on a promise or a submitted document. Escalate overdue actions to the audit committee or sponsor.
Traps
Prescribing a product; closing a finding because an updated plan was emailed; grading everything major, or nothing; raising a finding with no criteria or no evidence; forgetting escalation when actions slip.
Rule of thumb: if a second auditor, given only your working papers, could not reach the same conclusion, the finding is not yet reportable.