Identifying and Documenting Findings
Recording deviations in a verifiable way
An audit finding is a deviation between what should exist according to a reference criterion, whether a standard, an internal policy or a best practice, and what was actually observed during the review. Identifying it correctly requires separating the objective fact from its interpretation, and documenting it in enough detail for a third party to understand what was assessed, what evidence supports it and why it constitutes a deviation, without depending on the memory or personal judgment of the auditor who wrote it. In practice, each finding should include the criterion applied, the condition observed, the root cause when identifiable and the associated effect or risk, following a consistent structure throughout the report. Documenting a finding poorly, for example describing only the symptom without the cause, usually leads to remediation plans that fix the symptom but leave the underlying problem intact.