“During our review of user access, we noted certain instances where access removal was not always performed timely. Management should ensure access is removed in accordance with policy.”
Nobody disagrees with that finding. Nobody will act on it, either. It names no numbers, cites no policy, diagnoses nothing, threatens nothing, and asks management to “ensure” — the verb that has never once changed an organization. Multiply it by every audit report published this quarter and you have the profession’s quiet crisis: technically accurate findings that die on contact with a busy executive.
The cure has been sitting in audit methodology for decades: the 5 C’s — condition, criteria, cause, consequence, corrective action. Most auditors can recite them. Very few have been taught what each element must actually contain, how the five lock together into a single causal argument, and what separates a finding that survives management pushback from one that folds. That is this guide: the definitive treatment of each element, then three real-shaped findings dissected and rebuilt in front of you, weak version against strong.
This guide was rewritten in September 2026 to add what the August version left out: a reference table for the five elements with the challenge each must survive and the failure each most often suffers, two more dissections drawn from the worked engagements on this site (a reconciliation review that took eleven seconds per account, and purchasing-card transactions split around a limit), a fifteen-question checklist to run before a finding leaves the team, and the map from the five C’s to the places they land in the report, the rating memo and the issue log. The element-by-element masterclass and the three original dissections are unchanged. Standard 14.3 names criteria, condition, cause and effect as the elements of a finding and Standard 14.4 adds the recommendation or action plan; the five C’s are those elements with the vocabulary most functions actually use.
In this guide
- The 5 C’s are a chain, not a checklist
- Condition: what is, provable
- Criteria: what should be, sourced
- Cause: why, at the level management can fix
- Consequence: so what, in their currency
- Corrective action: the fix that closes the cause
- The five elements on one page: challenge, content, failure, source
- Dissection #1: the access finding, rebuilt
- Dissection #2: the vendor finding, rebuilt
- Dissection #3: the reconciliation finding, rebuilt
- Dissection #4: the reconciliation review finding, rebuilt
- Dissection #5: the split-transaction finding, rebuilt
- Assembly mechanics: order, length, and the five-sentence test
- The fifteen-question checklist
- Where the five C’s land: the report, the rating memo and the issue log
- Where to go next
The 5 C’s are a chain, not a checklist
Treat the 5 C’s as five boxes to fill and you get five disconnected sentences. Treat them as what they actually are — the load-bearing joints of one argument — and the finding writes itself. The argument runs: here is what we found (condition), here is the standard it violates (criteria), here is why it is happening (cause), here is what it costs you (consequence), and here is the action that stops it (corrective action). Each element exists to survive a specific challenge from the reader: “prove it,” “says who,” “why,” “so what,” and “then what.” A finding fails at its weakest joint, not its average quality — which is why one lazy element sinks four strong ones.
The Global Internal Audit Standards frame findings exactly this way: engagement findings emerge from comparing criteria against condition, with cause and effect analyzed to develop them (Standard 14.2), and recommendations or management action plans building on that analysis (Standard 14.4). The vocabulary shifts by shop — some say “effect” for consequence, some say “recommendation” for corrective action, government auditors run a four-element version under the Yellow Book — but the underlying logic is universal, and it long predates any particular standard because it is simply how persuasion works: evidence, warrant, diagnosis, stakes, prescription.
One planning note before the masterclass: the C’s are cheap to assemble at the moment you find the exception and expensive to reconstruct three weeks later. The discipline in our annotated model workpaper — exception analysis that runs cause to ground and quantifies the affected population while fieldwork is still open — is precisely what makes strong C’s possible. Findings written from thin workpapers are thin findings, no matter who edits them.
Condition: what is, provable
The condition is the factual core: what you found, stated so concretely that a skeptical reader could re-verify it from your workpapers. The quality test is photographability — could someone picture exactly what you saw? “Access removal was not always timely” is fog. “9 of 31 payment-portal revocations in the period exceeded the 3-business-day standard, including one contractor whose access remained active for 11 business days” is a photograph.
A strong condition carries four properties. It is quantified: counts, rates, dollar amounts, date ranges — numerators and denominators, never “certain instances.” It is bounded: the population and period are explicit, so the reader knows what the numbers describe and what they do not. It is neutral: the condition states facts and lets them be damning; adjectives (“egregious,” “pervasive”) are editorializing that gives management something to argue with other than the facts. And it is traceable: every figure ties to a workpaper a reviewer can open. The sins, in rough order of frequency: hedging quantifiers (“some,” “various,” “not always”), burying the worst instance inside an average, mixing multiple distinct problems into one blended condition, and smuggling the cause or the judgment into the condition sentence, where it starts fights the facts could have won alone.
Criteria: what should be, sourced
Criteria are the standard the condition is measured against — and the element auditors treat most casually, because it feels obvious. It is not obvious. “In accordance with policy” invites the two deadliest responses in the findings business: “which policy?” and “that policy doesn’t say that.” Strong criteria name the source, section, and version: “Information Security Policy §6.4 (v4.2, effective January 2025) requires revocation within three business days of termination effective date.” When the source changed mid-period, say which version governed which months — or watch the whole finding unravel over a technicality.
Criteria come in a hierarchy of authority, and you should cite the strongest available: regulation and law first, then external standards and frameworks the organization has adopted, then internal policy, then management’s own stated intentions (a target in a board deck is criteria), and finally — weakest but legitimate — reasonable business practice, argued explicitly. The last tier matters because operational audits frequently examine areas where no written standard exists; the honest move there is to establish the criteria with management during planning, so the measuring stick is agreed before anyone knows the measurement. What you may never do is leave criteria implicit, because a finding without criteria is not a finding — it is an opinion wearing one’s clothes.
Cause: why, at the level management can fix
Cause is the element that separates professionals, because it is the only one that requires investigation rather than observation — and because the corrective action inherits all of its flaws. Write “human error” as the cause and the action becomes “remind staff,” which fixes nothing and guarantees the repeat finding two years from now (ask any function about its repeat-finding rate before believing this is rare). The working method is the five whys with a professional stop rule: keep asking why until you reach the deepest level management can actually act on, then stop. Go too shallow and you prescribe reminders; go too deep and the cause becomes “budget constraints” or “company culture” — true, unactionable, and read by executives as the auditor grandstanding.
In practice, causes cluster into a short taxonomy worth memorizing: design gaps (the control never covered this case — our access-revocation example: the portal was never wired into the automated feed), resource and ownership gaps (the task exists but nobody owns it — a queue with no coverage during a team transition), knowledge gaps (the standard exists but the people executing never learned it), incentive conflicts (the process rewards the wrong behavior — quarter-end pressure versus cutoff discipline), and deliberate acts (handle per your fraud protocol, not per the routine findings process). Naming the cluster does two things: it disciplines the corrective action, and it lets your annual reporting aggregate causes across findings — the analysis audit committees remember, because “40% of this year’s findings trace to unowned handoffs” is an insight no single finding can deliver.
Consequence: so what, in their currency
Consequence answers the only question executives actually ask: why should I spend attention and money on this? The element fails in two symmetrical ways. Understatement — “this could result in inappropriate access” — wastes the finding. Catastrophizing — conjuring regulatory doom from a parking-expense exception — spends your credibility, and credibility is the only asset a findings writer has. The craft is calibrated escalation: state the consequence that actually follows from the condition, quantified where the data allows, scenario-based where it does not.
Three moves upgrade most consequence statements. Convert rates into exposure: “9 late revocations” becomes “for a combined 47 business days during the period, separated personnel retained the ability to initiate payments” — same facts, now in risk language. Distinguish realized from potential: if any late-access account was actually used, that is a realized event and belongs in the first sentence; if not, say “no inappropriate use was identified in our testing” — the honesty strengthens rather than weakens the finding, because it shows you looked. Borrow the organization’s own numbers: the fraud-loss figure in the ERM report, the regulator’s penalty schedule, the cost of the last comparable incident. A consequence built from management’s own accepted numbers cannot be dismissed as audit theater. For calibration ammunition, the ACFE’s 2024 Report to the Nations puts the median occupational fraud loss at $145,000 with a typical 12 months before detection — the kind of external benchmark that turns “could result in loss” into a number the CFO recognizes.
Corrective action: the fix that closes the cause
The final element is where findings go to die politely. The test is unforgiving: the corrective action must close the cause — not the condition. If the cause is a portal outside the automated deprovisioning feed, then “remediate the 9 late revocations” fixes the symptom and leaves the disease; the real action is integrating the portal into the feed (or building a compensating detective control with an owner and a cadence) plus a one-time cleanup. Actions that merely restate the criteria — “management should ensure compliance with the policy” — are not actions at all; they are the finding admitting it has no idea what to do.
Strong actions share five properties: a named owner (a role, not a department), a date, a verifiable end state (write it so the validator can test it later — you are drafting the future closure test, as our issue validation guide makes painfully clear), proportionality (a $40,000 fix for a $4,000 risk is its own finding), and management’s fingerprints. That last one is a genuine philosophy choice the Standards leave open (Standard 14.4 permits either auditor recommendations or collaboratively developed management action plans): the recommendation model protects independence of thought; the action-plan model buys ownership and implementation speed. The working compromise most mature functions land on — audit specifies the outcome that must become true, management designs the mechanism — gets both, and it changes the negotiation from “we disagree with your recommendation” to “here is how we will meet the requirement.”
The five elements on one page: challenge, content, failure, source
Before the dissections, the element-level craft above compressed into a table you can pin next to the report template. The second column is the reader’s challenge the element exists to survive; the fifth is the workpaper or analysis the words are harvested from, because an element with no source is an element someone will have to invent at the review stage. Each row links to the guide that treats that element at full length.
| Element | Survives the challenge | Must contain | Fails most often by | Harvested from |
|---|---|---|---|---|
| Condition | Prove it | Numerator and denominator, period, population, the worst instance, a workpaper reference for every figure | Hedged quantifiers; an average that hides the worst case; two problems blended into one sentence; the cause or a judgment smuggled in | The exception analysis in the testing workpaper: what was tested, what failed, how the population was bounded |
| Criteria | Says who | Source, section, version and effective date; for unwritten standards, the criteria agreed with management at planning | “In accordance with policy”; a version that did not govern the period; criteria asserted after the measurement was known | The planning memo’s criteria list and the policy register; for regulatory criteria, the obligation inventory |
| Cause | Why | The deepest level management can act on, named by family: design gap, ownership gap, knowledge gap, incentive conflict, deliberate act | “Human error”; a cause so deep it is a budget or a culture; the condition restated as its own cause | The root cause analysis run while fieldwork is open, with the process owner in the room |
| Consequence | So what | The exposure in the reader’s currency: dollars, days, obligations, customers; realized separated from potential; the organization’s own figures where they exist | “Could result in”; catastrophe conjured from an administrative exception; a rate left as a rate instead of converted to an exposure | The population data behind the sample, the ERM register’s loss figures, the last comparable incident, the rating memo’s impact dimensions |
| Corrective action | Then what | An owner by role, a date, a verifiable end state, proportionality to the exposure, and management’s design of the mechanism | Restating the criteria as the action; fixing the condition and leaving the cause; a date with no end state a validator could test | The cause statement, inverted; the process owner’s own proposal, tested against the cause |
Two observations about the table. The “harvested from” column is the argument for building findings during fieldwork rather than after it, which the model workpaper shows in practice; every column to its left is a rewrite of something that should already exist in the file. And the failures in the fourth column are not random: each is the element defaulting to the next-easier thing to write, a hedge instead of a count, a policy name instead of a section, a symptom instead of a cause, a possibility instead of an exposure, an instruction instead of a mechanism. Knowing the default is most of the cure, which is what the checklist later on this page is for.
Dissection #1: the access finding, rebuilt
Return to the finding that opened this article — the one nobody would act on — and run it through the machine, element by element:
| Element | The weak version | Why it fails | The strong version |
|---|---|---|---|
| Condition | “Certain instances where access removal was not always performed timely” | No count, no population, no period, no worst case — unphotographable | “9 of 31 payment-portal revocations (Jul 2025–Jun 2026) exceeded the 3-business-day standard; longest: 11 business days for a contractor with payment-initiation access” |
| Criteria | “In accordance with policy” | Which policy? Which requirement? Unverifiable | “Information Security Policy §6.4 (v4.2): revocation within 3 business days of termination effective date” |
| Cause | Absent entirely | Nothing to aim the fix at | “The portal is not integrated with the automated deprovisioning feed; revocation depends on a manual task whose queue lost its owner during a team transition” |
| Consequence | Implied, at best | No stakes, no priority, no budget case | “Separated personnel retained payment-initiation capability for a combined 47 business days; no inappropriate use identified in testing, but the quarterly access review would not have caught use until April” |
| Corrective action | “Management should ensure access is removed in accordance with policy” | Restates the criteria; no owner, no date, no mechanism | “IAM Operations Manager to integrate the portal into the automated feed by Oct 31; interim weekly reconciliation of terminations to portal access, owned by IAM Ops, starting immediately” |
Read the strong column top to bottom and notice what happened: it became an argument a CFO can act on in ninety seconds, and every clause of it traces to the testing file — this is, deliberately, the same fact pattern as our model workpaper’s exception analysis, because that is where these sentences come from. Findings are not written; they are harvested.
Dissection #2: the vendor finding, rebuilt
Weak: “The vendor management program has opportunities for improvement. Several vendors did not have current risk assessments on file, and monitoring activities were informal. We recommend management strengthen the vendor management program.”
The autopsy is quick because almost nothing survives. “Opportunities for improvement” is severity-laundering — if it belongs in a finding, it is a deficiency; say so and rate it. “Several vendors” fails the numerator-denominator test. “Informal” is not a condition, it is a shrug. There are no criteria at all — and this is the interesting failure, because many organizations genuinely lack an internal standard here, which is exactly when you reach up the criteria hierarchy to an external source. From September 15, 2026, internal audit has a gift-wrapped one: the IIA’s Third-Party Topical Requirement, whose requirement statements (complete inventory, risk-based reassessment, monitoring with verified information) are precisely the criteria this finding was missing.
Strong: “14 of the 22 vendors tiered as critical did not have a risk reassessment within the 12-month cycle required by TPRM Policy §3.2 — including both payment processors; the oldest assessment was 31 months old. [Condition] Reassessments stalled because the responsible analyst role has been vacant since November and no interim owner was assigned. [Cause] Until reassessed, the organization is relying on stale due diligence for the vendors with the highest concentration of customer data and payment flow — the exposure class the IIA’s Third-Party Topical Requirement makes a mandatory assurance baseline as of September 2026. [Consequence] The CPO will assign an interim reassessment owner by September 15 and clear the backlog by December 31, prioritized by tier; the vendor management office will add a monthly aging report on reassessment currency to its operating cadence. [Corrective action]”
Dissection #3: the reconciliation finding, rebuilt
Weak: “Bank reconciliations were not always completed timely and contained unresolved reconciling items. Management should complete reconciliations in a timely manner and resolve items promptly.”
Strong: “5 of 12 monthly reconciliations for the primary operating account (avg. balance $18M) were completed 10–24 days after the close deadline in Accounting Policy §4.1, and the June reconciliation carried $412,000 in unresolved items aged over 60 days, of which $87,000 remained unexplained at fieldwork end. Preparation sits with one accountant whose workload doubled after the March consolidation of two entities, with no cross-trained backup. Late, unresolved reconciliations delay detection of errors and unauthorized disbursements on the account that processes 80% of company cash — the control that would catch a fraudulent payment is running up to three weeks behind the money. The Controller will redistribute entity-level reconciliations and cross-train a second preparer by October 31, investigate and disposition the $87,000 by September 30, and report reconciliation timeliness monthly to the CFO until two consecutive clean quarters.”
Same facts a tired writer would compress into “not always timely” — but this version answers prove-it, says-who, why, so-what, and then-what in four sentences. Notice the consequence sentence’s move: it does not predict fraud; it states, accurately and coolly, that the detection control runs three weeks behind the money. Precision is scarier than adjectives.
Dissection #4: the reconciliation review finding, rebuilt
The three dissections above were built to teach; the two that follow come from the worked engagements elsewhere on this site, with the numbers the fieldwork produced. The first is from the Lakeshore account reconciliation program audit, where the reconciliation tool’s own timestamps showed one of the nineteen reviewers approving 210 monthly reconciliations in forty minutes. Here is how a tired writer reported it, and how the engagement actually did.
Weak: “The review of account reconciliations could be more robust. We noted some instances where reviews appeared to be performed quickly and reviewer comments were not always documented. Management should reinforce the importance of a thorough review.”
| Element | The weak version | Why it fails | The strong version |
|---|---|---|---|
| Condition | “Some instances where reviews appeared to be performed quickly” | No count, no time, no population; “appeared” concedes the fact before management disputes it | “One reviewer approved 210 of the 1,860 June monthly reconciliations between 08:10 and 08:50 on working day three, a mean of eleven seconds each, per the tool’s approval timestamps; the 210 included 14 of the 41 reconciliations carrying unexplained items aged over 90 days, and none of the 210 has a review comment; across the year, three reviewers accounted for 61 percent of all approvals and a query was recorded on 2 percent of reviews” |
| Criteria | Absent; “thorough” is doing the work of a standard | Nothing to measure against; thoroughness is not a testable requirement | “The Reconciliation Standard defines what a reconciliation must contain, itemization, an independent source and aging, but not what a review is; the policy requires only approval by a reviewer independent of the preparer. The engagement therefore agreed the review criteria with the Controller at planning, as the criteria hierarchy above requires where no written standard exists: a review inspects the support for every reconciling item above $10,000 or aged over 60 days and records a conclusion in the tool” |
| Cause | Absent | The action will be a reminder, because nothing else is aimed at | “The program has never defined what a review is, so the tool’s approval is a single click with no required field; the reviewer is assigned 210 accounts against a median of 80 across the nineteen reviewers; and the close calendar sets the review deadline on day three, so the assignment could not be completed as the agreed criteria describe in the time allowed even by a reviewer who tried” |
| Consequence | Implied | No exposure, so no priority against the other six findings | “For the 210 accounts the review control did not operate in June. They include accounts prepared by three of the eight preparers who also hold posting rights, so for those accounts no independent person examined the balance at all, and they carried $0.6 million of the $1.1 million in unexplained aged items the engagement identified” |
| Corrective action | “Reinforce the importance of a thorough review” | Restates the criteria; a reminder does not change a workload or a tool | “The Controller will add a definition of the review, what is inspected and how it is evidenced, to the Reconciliation Standard by September 30; cap reviewer assignments at 80 monthly reconciliations by re-allocating across the nineteen reviewers before the September close; Finance Systems will configure the tool to require a review comment on any reconciliation with items above $10,000 or aged over 60 days by October 15; a second reviewer will re-perform the 210 June reviews by August 31; and the financial control team will sample five percent of reviews monthly and report the results to the CFO” |
What the rebuild changed is where the finding points. The weak version pointed at a person, which is why management’s first response was that the reviewer is experienced and knows the accounts. The strong version points at a missing definition, an assignment, a tool configuration and a calendar, all of which the Controller can change; the reviewer was not negligent by the program’s standard, because the program had no standard for what a review was, and the finding was written about the program. Notice also where the criteria came from: not from a section number, because there was none, but from the agreement made with the Controller at planning, which is the honest move the criteria section above describes and the reason the rating survived the exit meeting. It was rated Medium on the matrix: Moderate impact, because the exposure was bounded by the re-performance, Likely, because the assignment repeats every month. The re-performance found two errors, both under $10,000, which the report said in the consequence sentence, because the honest statement of what was and was not found is what let the rating stand without an argument.
Dissection #5: the split-transaction finding, rebuilt
The second comes from the MidState purchasing card audit: 210 cards, $3.4 million of spend, 28,000 transactions, a $2,500 single-transaction limit. The analytics found 61 clusters of transactions on the same card with the same vendor inside 48 hours whose combined value exceeded the limit, at three depots, and 44 of the 61 were with one fleet maintenance vendor that the accounts payable audit had already found being split around the purchase order threshold.
Weak: “We noted instances of transactions that may have been split to circumvent the single-transaction limit. Splitting transactions is prohibited by the purchasing card policy. Management should reinforce cardholder training on the policy requirements.”
Strong: “Of 28,000 card transactions in the year, 61 clusters of two or more transactions on the same card with the same vendor within 48 hours combined to exceed the $2,500 single-transaction limit, at three depots; 44 of the 61 clusters, totalling $148,000, were with one fleet maintenance vendor, and the largest combined to more than three times the limit. [Condition] Purchasing Card Policy section 3.1 sets the single-transaction limit at $2,500 and section 3.4 prohibits dividing a purchase to stay within it; purchases above the limit are required to go through a purchase order under Procurement Policy section 2.2. [Criteria] The fleet maintenance vendor is not set up in the purchasing system, so a depot with a vehicle off the road has no compliant route to a repair above $2,500 inside a day; and the program administrator’s monthly review contains no query for split transactions, so the pattern was invisible to the only control designed to see it. [Cause] The $148,000 bypassed the purchase order approval and the two-quote requirement that applies above $2,500, and the depots’ fleet maintenance spend was, in effect, sole-sourced at retail rates by whoever held the card; no evidence of personal benefit was found in the 44 clusters, and the engagement says so. [Consequence] The Fleet Manager will set the vendor up with a blanket purchase order per depot by October 31; the program administrator will add a monthly split-transaction query, same card, same vendor, 48 hours, combined value above the limit, reviewed by the AP Manager from the November cycle; the limits on the cards at the three depots will be reviewed against actual need by the same date; and repeat splitting after November will result in card cancellation under section 3.6. [Corrective action]”
Three things to notice. The condition says “combined to exceed the limit”, not “were split to circumvent the limit”, because intent is a conclusion and the tool’s data shows a pattern; the criteria and the cause carry the argument that the pattern is a policy breach without the condition having to accuse anyone. The cause explains why the depots did it, which is the fact that makes the corrective action a purchase order rather than a training session; training people not to do the only thing that gets a truck repaired is the reminder the profession keeps writing. And the consequence names what was not found, personal benefit, in the same breath as what was, because the process owner reads the finding looking for that sentence, and its absence reads as an accusation. The finding was rated High rather than Medium, and the reason is in the condition’s last clause: the same vendor had already been found being split around the purchase order threshold in the accounts payable audit, so the pattern had crossed a control boundary twice and the likelihood anchor moved up. The engagement’s other High was the approval routing finding, where four cardholders including the program administrator were routed to approve their own statements, which is the kind of fact that needs no adjective at all.
Assembly mechanics: order, length, and the five-sentence test
Three closing disciplines turn good elements into good findings. Order for the reader, not the methodology. The C’s are an analytical sequence, not a presentation sequence: in the published report, lead with a title that carries the consequence (“Separated employees retained payment access for weeks” beats “User Access Administration — Observation 3”), open with condition-plus-consequence for the executive skim, and let criteria and cause follow for the reader who wants the reasoning. Hold the five-sentence test. Every finding, however complex, should survive compression to five sentences — one per C — and that compressed version is your executive summary entry, your committee talking point, and your check that each element actually exists. If you cannot write sentence three, you have not finished fieldwork; you have finished observing. Write the closure test now. The corrective action you draft today is the validation standard someone tests in six months — vague actions become unclosable issues, and unclosable issues become the aging report that embarrasses everyone. Draft every action asking: what evidence would prove this done?
The fifteen-question checklist before a finding leaves the team
Every finding on this site’s model reports went through the questions below before the process owner saw it, three per element, and the questions are phrased so that the answer is either a fact in the workpaper or an admission that the element is not finished. Run them on the draft, not in your head; the ones that get skipped are always the ones that would have failed.
Condition. 1. Does every figure have a numerator, a denominator and a period, and does each tie to a workpaper reference? 2. Is the worst instance stated, not averaged away? 3. Could a reader who disagrees with our conclusion still agree with every word of this sentence?
Criteria. 4. Is the source named to the section and version that governed the period tested? 5. If no written standard exists, were the criteria agreed with management before the results were known, and does the workpaper show that? 6. Is this the strongest criteria available in the hierarchy, or a weaker one that was easier to find?
Cause. 7. Is the cause something a named role can change, neither “human error” nor “culture”? 8. Was it established with the process owner during fieldwork, or inferred at the desk afterward? 9. Which family is it, design, ownership, knowledge, incentive or deliberate act, and does the action match the family?
Consequence. 10. Is the exposure in the reader’s currency, dollars, days, obligations or customers, rather than a rate or a possibility? 11. Are realized and potential consequences separated, and is what was not found stated as plainly as what was? 12. Does the consequence justify the rating on the matrix, dimension by dimension, and would the rating memo say the same?
Corrective action. 13. Does the action close the cause, not just the condition? 14. Does it have an owner by role, a date and an end state a validator could test without asking anyone? 15. Is the cost of the action proportionate to the exposure in question 10?
Question 3 is the one that catches the most. A condition sentence that a hostile reader cannot agree with has a judgment in it somewhere, an adjective, an inferred intent, a cause dressed as a fact, and the exit meeting will find it faster than the reviewer did. Question 12 is the one that connects this guide to the severity matrix: a consequence written in the reader’s currency is also the impact dimension of the rating memo, so a finding that fails the question is a rating that cannot be defended. And question 14 is the one that decides how the finding dies. An action with a testable end state closes when the evidence exists; an action without one closes when everyone is tired of it, which is the origin of every aged issue in every issue log.
Where the five C’s land: the report, the rating memo and the issue log
The C’s are written once and then used in five places, in different orders and at different lengths, and a finding that reads well in the detailed section can still fail in the executive summary if the compression was done carelessly. The table shows where each element goes and in what form; the report anatomy guide and the report template set show the pages themselves.
| Where | Which elements | In what form | Length |
|---|---|---|---|
| Finding title | Consequence, sometimes condition | A sentence that carries the stakes: “Separated employees retained payment access for weeks”, not “User access, observation 3” | Under twelve words |
| Executive summary | Condition and consequence | One sentence per finding, the compressed version from the five-sentence test, with the rating | One sentence, two at most |
| Findings table | Rating, title, owner, date | A row the committee scans: rating, the title, the action owner and the target date | One row |
| Detailed finding | All five, in reader order | Condition and consequence first, then criteria and cause for the reader who wants the reasoning, then the action plan | Half a page to a page |
| Management action plan | Corrective action, with cause as its justification | Owner, mechanism, date, end state, written by management to meet the outcome audit specified | Three to six lines |
| Rating memo | Consequence (the impact dimensions), cause (aggregation), condition (the facts the likelihood rests on) | The derivation of the rating through the matrix, filed in the workpapers | One page |
| Issue log | All five as fields, plus the closure evidence | Condition as the issue description, corrective action as the closure test, cause as the family code for annual reporting | One record, updated until validated closed |
The cause family deserves a word, because it is the element that pays off after the report. A function that records the family for every finding can tell its audit committee, at year end, that a third of the year’s findings traced to controls that were never designed for a case that now occurs, or that unowned handoffs produced more Highs than any other cause, and that is the analysis committees remember and management cannot get from anywhere else. It requires nothing more than a field in the log and the discipline of filling it from the cause statement rather than from memory in December. The life-of-a-finding guide follows one finding through all seven of the places in the table, from the analytics hit that produced its condition to the validation that closed it.
Final Thoughts
The 5 C’s endure because they map to the five challenges every finding must survive: prove it, says who, why, so what, then what. Master the element-level craft, photographable conditions, sourced criteria, causes at the actionable level, consequences in the reader’s currency, actions that close the cause, and the chain assembles itself; skip one and the whole argument hangs by its weakest joint. The five dissections on this page are the same lesson five times: nothing in the strong versions was invented at the writing stage, it was all harvested from fieldwork that ran the exception to ground while the process owner was still in the room, which is why the strongest thing you can do for your findings is to build them the day you find the exception. Practice on your last report: pick its softest finding, run the autopsy table from Dissection #1 and the fifteen questions, and rebuild it. Then see the craft at full scale in our library of annotated model audit reports, where findings like these sit inside complete reports, and for the upstream discipline that makes them possible, the model workpaper and our guide to issue validation close the loop from evidence to fix.
Where to go next
Each element has its own full-length guide in the writing series: conditions, cause statements, consequences and recommendations, with the finding makeovers as the practice set. The severity matrix rates what the five C’s build, the negotiation guide defends it in the exit meeting, and the management response guide decides whether the action plan that comes back is worth accepting. The Findings & Reporting and Writing categories hold the rest.
Related guides
- Writing Airtight Audit Conditions — the seven properties of a condition and twelve rewrites.
- Writing Cause Statements That Point to the Fix — the six cause families and the patterns that name them.
- Writing Impact That Lands — consequences in dollars, risk and plain sight, with methods for each.
- Writing Audit Recommendations Management Can Actually Implement — actions that close the cause, with owners, dates and end states.
- Finding Makeovers: Five Audit Findings Rewritten — five weak findings rebuilt element by element.
- Finding Severity Ratings: The Calibrated Matrix — the anchors, the grid, twelve rated cases and the rating memo.
- Root Cause Analysis for Audit Findings — five-whys worked examples with the professional stop rule.
- A Library of Model Audit Report Examples (Annotated) — complete reports with findings like these inside them.
- Anatomy of an Internal Audit Report — where each element lands on the page.
- The Internal Audit Report Template Set — full, short-form and memo shells, annotated.
- The Life of a Finding — one finding followed from observation to closure.
- Negotiating Audit Findings Without Watering Them Down — the exit meeting where the five C’s are tested.
- Evaluating Management Responses — when to accept an action plan and when to push back.
- The Finding and Issue Log Template — the fields that carry the five C’s after the report.
- The Annotated Model Workpaper — the exception analysis the strong versions were harvested from.
- Issue Validation in Internal Audit — the closure test the corrective action drafts today.
- How to Audit Account Reconciliations as a Program — the engagement behind Dissection #4.
- How to Audit Purchasing Cards — the engagement behind Dissection #5.
- Operational audit criteria — where the criteria come from when no framework exists
- Getting audit recommendations adopted — from finding to fix that lasts.
- The audit escalation ladder — when and how to take a disagreement up a level.
Leave a Reply