The four guides before this one take the elements of a finding apart: conditions that cannot be disputed, causes that point to the fix, consequences that earn the rating, and recommendations that can be done on a Monday. This one puts them back together. Five findings, each written first the way findings are usually written, at the end of a long fieldwork week by an auditor who knows what happened and assumes the reader will too, and then rewritten element by element with the diagnosis between the two versions. The findings are real-shaped: they come from the engagements written up across this site, at the three organizations used throughout, and their numbers are the numbers those guides report. The first drafts are the kind of draft every one of them started as.
Read the makeovers for the method rather than the content. Each follows the same four steps: read the first draft as the hostile reader, diagnose each element against its guide’s checklist, rewrite the elements in order with the condition first and the recommendation last, and then check the rating against the rewritten consequence, because the rating often moves once the consequence has a mechanism in it. The five cover the five most common failures: the condition that editorializes, the cause that blames, the consequence that says “risk that”, the recommendation that ensures, and the finding that is really two findings. At the end is a table of the patterns across all five and a checklist for running the same makeover on your own draft.
In this guide
- The method: diagnose, rewrite in order, re-check the rating
- Makeover 1: vendor bank-detail changes (the condition that editorializes)
- Makeover 2: sole-source awards (the cause that blames)
- Makeover 3: balance sheet reconciliations (the “risk that” consequence)
- Makeover 4: reconciliation certifications (the recommendation that ensures)
- Makeover 5: expense approvals (the finding that is two findings)
- The patterns across the five
- Running the makeover on your own draft
- Where to go next
The method: diagnose, rewrite in order, re-check the rating
A makeover is not an edit. Editing a weak finding produces a smoother weak finding, because the problems are structural: the wrong element is doing the work, or an element is missing, or the numbers are not there to be polished. The makeover starts by reading the draft as the process owner will, with one question per element: is this what happened, why does it say that, so what, and what exactly do you want me to do. Each element is then diagnosed against its checklist, and the diagnoses are written down before any rewriting starts, because the diagnosis is what the auditor learns from. The rewrite goes in order, condition first, because the cause has to explain the condition as rewritten and the consequence has to extend it, and the recommendation last, because it has to address the cause as rewritten. Then the rating is re-checked against the scale’s anchors using the rewritten consequence, and it is not unusual for it to move: a Medium whose consequence turns out to contain a realized loss becomes a High, and a High whose consequence turns out to be an abstract noun becomes a Medium. The five below took between forty minutes and two hours each, most of it in the diagnosis and the search for the numbers the first draft had left in the workpapers.
Makeover 1: vendor bank-detail changes (the condition that editorializes)
From MidState Beverage’s accounts payable audit. The first draft is the one the fieldwork auditor wrote on the last day of testing.
First draft. Controls over vendor bank account changes are weak. Our testing found that call-backs are frequently not performed before changes are processed, contrary to AP procedure 4.2. This is because AP staff did not follow the procedure. There is a risk that fraudulent changes could result in payments being misdirected, causing financial loss and reputational damage. Management should ensure that the call-back procedure is consistently followed and that staff are reminded of its importance. Rating: Medium.
| Element | Diagnosis |
|---|---|
| Condition | “Weak” and “frequently” carry the meaning; no count, no denominator, no period; the criteria (“contrary to procedure 4.2”) is in the condition sentence |
| Cause | The condition restated with blame: staff did not follow the procedure. No mechanism; nothing an action could change except the staff |
| Consequence | “Risk that”, three abstract nouns, no mechanism, no magnitude, no tense; the realized instance in the file, the stopped attempt, is not mentioned |
| Recommendation | “Ensure” and “remind”; no object, owner, date or measure of done; training against a design cause |
| Rating | Medium, set from the exception count; the consequence as written supports nothing |
Rewritten. Vendor bank-detail changes can take effect without independent verification. Rating: High. Condition: of the 46 vendor bank-detail changes made between March and April, 31 had no record of a call-back to a contact on file; 14 of the 31 were followed within ten days by a payment above 25,000 dollars, the largest 212,000 dollars. One of the 14 was a business email compromise attempt for 62,000 dollars, stopped by the bank’s own fraud screening after the payment had been released. Criteria: AP procedure 4.2 requires a call-back to a telephone number on file before any bank-detail change takes effect, and a monthly review of all changes signed by the AP manager. Cause: the ERP applies a bank-detail change on save, with no system requirement for a verification record or a second approver; clerks accept emailed remittance letters as the source of the change; the monthly change report is generated but has never been signed, so the absence of call-backs was invisible. The workflow was exempted from dual approval during the depot roll-out to speed vendor onboarding, and no master-data role has owned it since the acquired distributors were migrated. Consequence: one clerk can redirect any vendor’s next payment by keying an emailed change, and the attempt in the period reached the bank; the payment population in any ten-day window averages 1.1 million dollars, and recovery of a misdirected wire depends on noticing within hours. Recommendation: configure the vendor master workflow so that no bank-detail change takes effect until a second approver has confirmed a verification record showing a call-back to a number on file (controller, by 30 June), and assign ownership of the change process to a master-data role independent of accounts payable (chief financial officer, by 30 September); until the workflow is live, the AP supervisor reviews every change against its call-back record before each weekly payment run and signs the change report. Management response: agreed; the vendor portal with dual approval will be live by September, the master-data analyst recruited by October, and the monthly review signed from July. Owner: controller.
The rating moved from Medium to High, and the move was made by the consequence: the stopped attempt was in the workpapers all along, and the first draft had left it there because the auditor was thinking about the procedure rather than the money. The rewrite is four times longer and took ninety minutes, most of it finding the 14, the 212,000 and the 1.1 million in the payment file. The closing meeting on this finding lasted eleven minutes.
Makeover 2: sole-source awards (the cause that blames)
From Brightwater Foods’ procurement audit. The first draft’s condition was reasonable; its cause, consequence and recommendation were not.
First draft. Sole-source awards are not adequately justified. We reviewed 15 sole-source awards and found that six could have been competed, as alternative suppliers were readily available. Justification memos were generally weak. This is because procurement staff have not exercised sufficient rigor in challenging sole-source requests and the plant buyers prefer incumbent suppliers. The organization may not be achieving value for money and could be exposed to allegations of favoritism. Management should reinforce the sole-source policy and ensure that procurement staff challenge requests more rigorously. Rating: Medium.
| Element | Diagnosis |
|---|---|
| Condition | A sample stated without its population (57 awards, 2.9 million dollars); “generally weak” is a verdict; the approval-level fact (40 of 57 at the right level) is missing; “readily available” hides the twenty-minute market check that proved it |
| Cause | Blame on two groups; “insufficient rigor” is a verdict; the design cause, a policy with no memo standard, no market-check requirement and no elevated approval, is absent |
| Consequence | “May not” and “could be”; no number, although the 11 percent renewal saving from the analytics run was in the file; favoritism is an allegation, not a consequence |
| Recommendation | “Reinforce” and “ensure”; aimed at the people the cause blamed; nothing to validate |
| Rating | Medium; defensible for the sample, wrong for the population and the design |
Rewritten. Sole-source awards are approved on assertion rather than demonstration. Rating: High. Condition: in the eighteen months to June, 57 awards above the 10,000-dollar quotation threshold, 2.9 million dollars in total, were made on a sole-source basis: 31 on compatibility grounds, 14 on uniqueness, 12 as emergencies. Approval one level above the normal authority was evidenced for 40 of 57. On a re-performed market check for 15 of the awards, plausible alternative suppliers were identified for six within twenty minutes each. The sole-source rate rose from 9 to 16 percent of award value over six quarters, and one emergency purchase of sanitation chemicals recurred in five consecutive quarters from the same supplier with no follow-up competition. Criteria: the procurement policy permits sole-source awards only for unique supply, compatibility or emergency, requires a written justification approved one level above normal authority, and requires an emergency award to be followed by competition for the ongoing need. Cause: the policy sets no standard for what a justification must demonstrate and requires no market check, so an assertion of uniqueness is accepted as a demonstration of it; the elevated approval is not enforced by the system; and the follow-up competition after an emergency has no owner and no date, so an emergency award renews by default. Consequence: 2.9 million dollars of spend was placed without demonstrated competition; where the analytics run had forced a re-bid on one incumbent, the renewal price fell 11 percent, which applied to the population would be about 300,000 dollars a year; and the pricing on the six awards with available alternatives cannot be shown to be market-based. Recommendation: adopt the justification memo standard (requirement, basis, market check performed, price reasonableness, duration and the date the need will be competed, conflicts statement, elevated approval) for every award above threshold; enforce elevated approval in the purchasing system; assign the follow-up competition after each emergency award to the category buyer with a date; and report the sole-source rate by category and buyer to the procurement committee quarterly (head of procurement, from the next quarter). Management response: agreed after review of the six market checks; the memo template adopted, the sanitation chemicals supply competed, elevated approval configured. Owner: head of procurement.
Management argued with this finding harder than with any other in the report and accepted it faster once the rewrite was on the table, because the rewrite argued with nobody: it named a policy and a system, and the head of procurement, who had felt accused by “insufficient rigor”, found himself agreeing with a cause that was about the tools he had been given. A year later the rate was 11 percent and the memo was in use on 17 of 19 awards.
Makeover 3: balance sheet reconciliations (the “risk that” consequence)
From Pennine Foods plc’s financial close audit. The first draft had the numbers; it did not know what they meant.
First draft. Balance sheet reconciliations are not completed in a timely manner. At year-end, 38 accounts had not been reconciled for over two months and 14 had unexplained differences totalling 2.1 million pounds. Reconciling items are frequently carried forward. This is due to resourcing pressures in the finance team and the volume of month-end activity. There is a risk that balances are misstated and that errors are not detected on a timely basis, which could affect the accuracy of financial reporting. Management should ensure that reconciliations are completed and reviewed in accordance with the group accounting manual, and consider whether additional resources are required. Rating: High.
| Element | Diagnosis |
|---|---|
| Condition | Numbers present but unbounded: 38 of what, 2.1 million gross or net, “frequently” carried forward; the nine accounts with identical items for six months and the three external auditor points open twelve months are in the file and absent here |
| Cause | “Resourcing pressures” is true and too shallow; the design causes, the tool’s roll-forward setting, the unescalated status report and the two accountants who own both the reconciliations and the corrections, are missing |
| Consequence | “Risk that”; “could affect”; the realized consequence, four of the external auditor’s six adjustments from two of these accounts, is in the file; the Provision 29 material-control implication is absent |
| Recommendation | “Ensure” and “consider”; no act, no layer, no interim; the same recommendation the external auditor had made twice |
| Rating | High, correct, but supported by nothing in the consequence as written |
Rewritten. Balance sheet reconciliations carry unexplained differences that reach the audited accounts. Rating: High. Condition: at year-end, 38 of the 410 balance sheet accounts in the program had not been reconciled for more than two months; 14 carried unexplained differences totaling 2.1 million pounds gross and 0.6 million pounds net; nine accounts had carried identical reconciling items described as timing for six months or longer; and three external auditor management letter points on the same accounts had been open for more than twelve months. Criteria: the group accounting manual requires every account above the threshold to be reconciled by working day six, reviewed by day eight and cleared of differences within sixty days; the reconciliation review is one of the twelve financial reporting material controls in the Provision 29 declaration. Cause: two accountants own 140 of the reconciliations and also prepare the post-close journals that correct what the reconciliations miss, so lateness in one becomes volume in the other; the reconciliation tool permits aged items to roll forward without re-investigation; and the status report is produced monthly but escalated to no one. Consequence: balances of 2.1 million pounds gross whose support cannot be demonstrated; four of the external auditor’s six adjustments in the year, 1.7 million pounds net, arose from two of the fourteen accounts that the internal status report had shown as unexplained for most of the year; and a material control in the declaration that cannot currently be shown to operate, which the board will have to consider in its statement. Recommendation: redistribute ownership of the 140 reconciliations across the team and remove post-close journal preparation from reconciliation owners (controller, by the next close); disable roll-forward of aged items in the tool and escalate the status report to the chief financial officer monthly (controller, this month); clear the fourteen unexplained differences by the half-year, with internal audit re-performing those accounts at that date; and report reconciliation status to the audit committee quarterly until two consecutive clean quarters (chief financial officer). Until the redistribution, the controller reviews the fourteen accounts weekly. Management response: agreed; owner the chief financial officer, at the audit committee’s request.
The rating did not move; the reason for it did. The first draft’s High rested on the auditor’s sense that 2.1 million pounds was a lot; the rewrite’s High rests on four external auditor adjustments and a material control, which is a sentence the audit committee acted on the day it read it. The ownership moved to the chief financial officer at the committee’s request, which the management responses guide covers, because the controller had made the first draft’s recommendation to the external auditor a year earlier and not delivered it.
Makeover 4: reconciliation certifications (the recommendation that ensures)
From Lakeshore Bancorp’s reconciliation program audit. The first draft’s condition and consequence were close to right; the cause and the recommendation were the problem, and they were the same problem.
First draft. Quarterly account certifications are not reliable. In Q4, 22 account owners certified accounts that had unexplained differences over 90 days old without noting an exception. This indicates that owners are signing certifications without reviewing the underlying reconciliations. As a result, the audit committee and examiners receive assurance that may not be accurate. Management should ensure that account owners review reconciliation status before certifying, and should reinforce the importance of the certification process through communication and training. Rating: Medium.
| Element | Diagnosis |
|---|---|
| Condition | “Not reliable” is a verdict, but the second sentence is a sound condition: count, period, mechanism. It lacks the denominator (all accounts certified, 100 percent, in all four quarters) and the fact that delegates complete most certifications |
| Cause | “Signing without reviewing” is the condition restated as an accusation; the design cause, a form that does not display the tool’s status and is completed by delegates, is absent, although it was in the interview notes |
| Consequence | Nearly right: the bearer (committee, examiners) is named; “may not be accurate” hedges what the condition has already shown; the examiner’s next step is the missing mechanism |
| Recommendation | “Ensure”, “reinforce”, “communication and training”: three unmaking words and a training fix for an information cause; nothing a validator could inspect |
| Rating | Medium, right |
Rewritten. Account certifications are signed over exceptions the certifier’s own tool displays. Rating: Medium. Condition: certifications were signed for 100 percent of accounts in all four quarters; in the fourth quarter, 22 account owners certified accounts that, at the certification date, carried unexplained differences older than ninety days in the reconciliation tool, without noting an exception. In most business units the certification was completed by the owner’s delegate. Criteria: the certification confirms that the owner’s accounts are reconciled to the program standard and that any exception is disclosed. Cause: the certification form is a list of accounts with a signature line; it does not display the tool’s status for the accounts listed, and nothing prevents a certification from being signed for an account with an open exception, so an owner or delegate has no visible reason not to sign. Consequence: the quarterly assurance the audit committee and the bank’s examiners receive does not reflect the program’s own records; the examiner’s last letter asked for suspense aging, and a certification that contradicts the tool would convert a process weakness into a question about the accuracy of what the board is told. Recommendation: generate certifications from the reconciliation tool with open exceptions pre-populated for each account, require the owner to acknowledge each exception explicitly before the certification can be signed, restrict signature to the owner or a delegate the owner has designated in the tool, and report the count of certifications signed with exceptions to the audit committee quarterly (controller, from the next quarter). Management response: agreed; the tool’s certification module reconfigured for the next quarter. Owner: controller.
The business unit heads had objected to the first draft’s cause, “signing without reviewing”, on the ground that delegates signed and owners never saw the exceptions. They were right, and their objection was the cause: the rewrite adopted it, which turned a finding about the owners’ diligence into a finding about a form, and the owners stopped objecting to a finding that was no longer about them. The recommendation changed from training people to configuring a module, and it closed on inspection the following quarter.
Makeover 5: expense approvals (the finding that is two findings)
From MidState Beverage’s travel and expense audit. The first draft is long, and its length is the symptom.
First draft. Expense approval controls are ineffective and policy compliance is poor. Approvers are not reviewing reports properly: six approvers handle a large share of volume and approve very quickly, and most flagged items are approved without comment. In addition, three effective expense policies exist across the group with different receipt thresholds, the acquired distributors have no corporate card program and claim in cash, two promotions were still invoicing at promotional prices after their end dates, mileage claims exceed mapped distances, and 14 gifts to customers were coded as meals. This is due to a lack of management oversight of the expense process following the acquisitions. There is a risk of unauthorized and non-compliant expenditure and potential compliance exposure. Management should strengthen approval controls, harmonize expense policies, extend the card program, and review gifts and entertainment practices. Rating: High.
| Element | Diagnosis |
|---|---|
| Structure | At least three findings: approval theater (a design finding about the workflow), policy fragmentation and the card program (a governance finding from the acquisitions), and gifts to customers (a compliance finding that belongs with counsel). Promotions and mileage are separate Mediums. One rating cannot fit them |
| Condition | “Ineffective”, “poor”, “properly”, “large share”, “very quickly”, “most”: every number is in the file (six of 38; 44 percent; six seconds; 94 percent; 21,400 lines; 2.6 million dollars) and none is on the page |
| Cause | “Lack of management oversight” is a verdict; the causes differ by finding: a workflow with no comment requirement and no velocity metric; a migration that integrated revenue and not policy; a gifts rule that is one sentence |
| Consequence | “Risk of”; the base rate (30,900 dollars on 2.6 million, 1.2 percent) and the compliance mechanism (the customers’ own supplier codes) are absent |
| Recommendation | Four “strengthen, harmonize, extend, review” verbs for four different findings, none with an owner or date |
Rewritten as two findings (the gifts item became a third, handled with counsel).
Finding 1. Expense approval operates as acknowledgment. Rating: High. Condition: six of the 38 expense approvers handled 44 percent of the year’s 21,400 expense lines at a median of six seconds per report; 94 percent of policy-flagged items were approved without a comment; two depot managers approved each other’s reports for fourteen months; and the chief financial officer’s reports were approved by the controller, who reports to her. Criteria: the expense policy requires approvers to review each report against policy and to address flagged items before approval, and prohibits approval by a subordinate or by a reciprocal pair. Cause: the expense system presents reports for approval in bulk, does not require a comment or action on a flagged item before approval, does not enforce the hierarchy rule for reciprocal or subordinate approvals, and reports no approval-velocity or flag pass-through metric to anyone. Consequence: an approval that takes six seconds is not a review, and 94 percent of the control’s flags are discarded unread; the 30,900 dollars of exceptions found in the year, 1.2 percent of 2.6 million dollars of spend and 60 percent of it in nineteen submitters, is the floor of what an unread approval permits, and the executive population’s flag rate of 2.1 times the company average with 100 percent pass-through carries the tone-at-the-top weight the audit committee will recognize. Recommendation: configure the expense system to require an action on every flagged item before approval, block reciprocal and subordinate approvals from the hierarchy, and report approval velocity and flag pass-through by approver to the chief financial officer monthly (controller, by quarter end); route the six approvers’ patterns to their managers through management channels, not through this report. Owner: chief financial officer.
Finding 2. The group operates three expense policies and two evidence standards. Rating: High. Condition: three expense policies were in force in the year: a 75-dollar receipt threshold and actual-cost reimbursement at legacy MidState, a 25-dollar threshold at one acquired distributor, and no threshold with a meal per diem at the other; none had been reviewed since 2022. The corporate card is mandated at head office and the ten legacy depots; the two acquired distributors, about 90 submitters, claimed 100 percent of their spend in cash against scanned receipts. Criteria: the group policy framework requires one expense policy across entities, reviewed annually, and the corporate card for travel spend. Cause: the acquisitions integrated the distributors’ revenue and payroll but not their expense policy or card program, and no owner was assigned to the expense policy after the integration. Consequence: the acquired distributors’ spend is claimed on the weakest evidence class available, scanned receipt images, which is where the year’s one referral arose; threshold hugging ran at 2.7 times expected density at the legacy threshold; and the three populations cannot be compared or monitored as one. Recommendation: adopt one expense policy across the group by the end of the quarter and extend the corporate card program to the acquired distributors within two quarters (chief financial officer). Owner: chief financial officer.
The first draft’s single High became two Highs and a Medium, plus a compliance matter walked with outside counsel, and the report became clearer by becoming longer. The test that split it was the cause: when the auditor tried to write one cause for the draft’s list, three different mechanisms appeared, and three mechanisms are three findings. The names of the six approvers, which the first draft had not included but the HR director feared, went to their managers through the channel the issue log tracks, which is the concession that costs nothing in the negotiating findings guide.
The patterns across the five
Five makeovers is a small sample, but the patterns in it are the ones that appear in every file review on this site, and they are worth stating as a table so that the next draft can be checked against them before anyone else reads it.
| Pattern in the first drafts | Seen in | The fix, in one line |
|---|---|---|
| The numbers were in the file and not on the page | All five | Write the condition from the disposition grid, on the day of the test |
| An adjective did the work of a count | 1, 2, 5 | Run the editorializing list; replace each adjective with the number it was standing in for |
| The cause blamed people, or restated the condition | 1, 2, 4, 5 | Ask why until the answer is a mechanism, and make the mechanism the subject |
| “There is a risk that” with abstract nouns | 1, 3, 5 | Mechanism, magnitude, likelihood, bearer; find the realized instance in the file |
| The realized instance was omitted | 1, 3 | The stopped attempt and the auditor’s adjustments were the strongest facts in each file; look for what already happened |
| “Ensure”, “strengthen”, “consider”, “reinforce” | All five | Verb, object, owner, date, measure of done, interim |
| Training or reminders against a design cause | 1, 2, 4 | Match the recommendation to the cause family |
| The rating set from the exception count | 1, 2 | Re-check the rating against the rewritten consequence; it moved in two of five |
| Several findings in one | 5 | If the cause needs “and”, split the finding |
| Management’s objection was the cause | 2, 4 | Listen to the objection for the mechanism in it, and adopt the mechanism without the excuse |
Two of the five ratings moved, both upward, and both because the consequence had been written without the realized instance that was sitting in the workpapers. That is the most consequential pattern in the table: first drafts under-rate, because the auditor writing at the end of fieldwork is thinking about the procedure that was breached rather than about the money that moved, and the makeover’s re-check of the rating is where the finding recovers the significance the evidence always supported.
Running the makeover on your own draft
Makeover checklist. 1. Read the draft as the process owner and write down the first thing they would say about each element. 2. Condition: circle every adjective and adverb; replace each with a number or delete it; add the denominator, the population and the period; move any criteria, cause or consequence out. 3. Cause: if it contains a person, a team or “management” as its subject, rewrite with a mechanism as the subject; name the family; ask one more why. 4. Consequence: delete “there is a risk that”; write the mechanism as a path; find the realized instance in the file; put a number on it by one of the eight methods; add the base rate; name the bearer. 5. Recommendation: replace ensure, strengthen, consider and review with an act; add the object, the owner as a role, the date, the measure of done, and the interim for a High. 6. Structure: if the cause needed “and”, split the finding; if two findings share a cause, consider combining them under it. 7. Rating: place the rewritten consequence on the scale’s anchors and move the rating if it belongs elsewhere. 8. Title: state the problem as a consequence in under twelve words. 9. Read the rewrite aloud to a colleague who was not on the engagement, and change whatever they ask about. 10. Record the diagnosis in the finding record, because the diagnosis is what the function learns from.
Where to go next
Run the checklist on the next draft before it goes to review, and keep the diagnosis. The elements are covered in depth in writing airtight conditions, writing cause statements, writing impact that lands and writing recommendations; the structure they sit in is the five Cs masterclass; the block they appear in is described in the anatomy of an audit report; the scale the re-check uses is the severity ratings guide; and the conversation a made-over finding makes short is in the negotiating findings guide.
Related guides
- Writing airtight conditions — the first element, with twelve rewrites
- Writing cause statements that point to the fix — the second, with ten
- Writing impact that lands — the third, with ten
- Writing audit recommendations management can implement — the fourth, with ten
- The 5 C’s of audit findings — the structure, with dissected examples
- Finding severity ratings — the anchors the re-check uses
- Anatomy of an internal audit report — the finding block
- The life of a finding — the stages the makeover belongs to
- Evaluating management responses — the responses to the rewritten findings
- Negotiating audit findings — what happens to a made-over finding at the closing meeting
- Internal audit report examples — three complete reports written to this standard
- How to audit accounts payable, procurement, the financial close, account reconciliations and travel and expense — the engagements the five findings come from
- Writing guides and findings and reporting guides — the full collections
Leave a Reply