Engagement Communication
Findings have a structure - use it
Communication runs throughout the engagement, not only at the end. Interim communication alerts management to significant risks, fraud indicators, or control failures while correction is still possible. An exit conference confirms factual accuracy with the engagement client before the final report is issued. The final report states objectives, scope, findings, conclusions, and management's responses and action plans.
Findings are best built on five elements: criteria (what should be), condition (what is), cause (why it happened), effect (the risk or exposure), and recommendation (what to do). Reports must be accurate, objective, clear, concise, constructive, and timely; they separate fact from opinion, disclose scope limitations, and go to those with the authority to act.
Traps that show up in questions
- Holding a serious fraud or safety issue until the final report.
- Jumping to a recommendation without establishing root cause.
- Asserting a speculative effect without labeling it as an estimate.
- Omitting management's response or documented disagreement.
- Letting the engagement client change the auditor's conclusion at the exit conference - they correct facts, not conclusions.
- Overstating assurance when scope was limited.
Rule of thumb: no finding without all five elements. If the cause is unknown, the recommendation will treat a symptom.
Worked example: purchasing splits orders to stay under a $10,000 approval threshold. Criteria: purchases above $10,000 require competitive bids. Condition: 14 of 60 sampled orders were split. Cause: the threshold exists in policy but is not configured in the ERP. Effect: uncompetitive spend of a stated amount. Recommendation: enforce the limit systemically and monitor split orders.