Findings Management

A finding is the unit of audit value — but only if it is structured. The professional standard is Condition, Criteria, Cause, Effect, Recommendation: what is wrong, what should be, why it happened, what it costs, and what to do. A finding that states a problem without the criteria it breaches or the cause it stems from cannot drive remediation and cannot survive management challenge. The discipline is what separates an audit observation from an actionable, rateable issue.

Across the public sector, the same findings recur year after year — and the AGSA general report names them precisely because they are never closed out properly. When findings live in a report PDF rather than a tracked register, there is no owner, no target date, no severity rating and no line of sight to closure. The finding ages, the next audit re-raises it, and the entity slides toward a qualified or disclaimer opinion on the back of unresolved control weaknesses.

A structured findings register breaks that cycle. Every finding follows the five-part structure, is rated Informational to Critical, is assigned to an owner with a target date, and is tracked through follow-up testing to verified closure — so an issue raised once is actually fixed, not merely re-discovered.