The condition is the only part of a finding that is entirely the auditor’s. The criteria belong to a policy or a standard, the cause belongs to management’s process, the consequence is an argument, and the recommendation is a proposal. The condition is a statement of fact, made by the person who gathered the evidence, and it is the sentence everything else stands on. When it is airtight, the rest of the finding can be argued about and the finding survives; when it leaks, the argument goes to the facts and the finding dies there, whatever the cause and consequence said. Most conditions leak in the same three places: they state a judgment where a fact was needed, they state a sample where a population was needed, and they state a topic where a problem was needed.
This guide is about writing conditions that do not leak. It covers what a condition is and is not, the seven properties of an airtight one, the words that editorialize and their replacements, how to state numbers so that they carry the finding, the difference between a sample condition and a population condition and why it decides the rating, a checklist to run before the draft leaves the auditor’s hands, twelve conditions from the engagements on this site rewritten from their first drafts, and the mistakes that let leaks in. It is the first of five guides on writing the parts of a finding, alongside causes, impact, recommendations and the finding makeovers, and it assumes the structure the five Cs masterclass sets out.
In this guide
- What a condition is, and what it is not
- Where conditions come from: the grid to the sentence
- The seven properties of an airtight condition
- The words that editorialize, and their replacements
- Numbers: how to state them so they carry the finding
- Sample conditions and population conditions
- Conditions for the four kinds of finding
- Length, order and the three-sentence shape
- Reading your condition as the auditee
- Conditions in follow-up reports, advisory memos and referrals
- The condition checklist
- Twelve conditions rewritten
- Common mistakes
- Where to go next
What a condition is, and what it is not
Standard 14.3 requires findings to be evaluated by establishing, among other things, the condition: the factual evidence the auditor found. The word that matters is factual. A condition states what exists, what happened, how many times, over what period, in what population, as observed by the auditor and confirmed with the people who own the process. It does not state whether that is good or bad, because that is the criteria’s job and the comparison the reader makes between the two. It does not state why, because that is the cause. It does not state what might follow, because that is the consequence. And it does not recommend. A condition that does any of those things has borrowed from the other elements and left its own job half done, and the leak is usually in the half that was left.
The test is simple and unforgiving: could a hostile reader, given the workpapers, dispute any word of the condition on the evidence? If the condition says “controls over vendor bank changes are weak”, the reader disputes “weak” and there is no evidence for or against an adjective. If it says “31 of the 46 vendor bank-detail changes made between March and April had no record of a call-back to a contact on file, and 14 of those 31 were followed within ten days by a payment above 25,000 dollars”, the reader can dispute the 31, the 46, the dates, the “no record” or the 14, and the workpapers answer every one. The second condition took longer to write and will take no time at all to defend, which is the trade every airtight condition makes.
Where conditions come from: the grid to the sentence
An airtight condition is not written at the end of fieldwork; it is assembled from a record that was kept during it. The record is the disposition grid the model workpaper describes, one line per item tested or hit examined, with the attribute, the result, the evidence reference and the disposition. The condition is the grid summarized: the count of lines with a given result, over the count of lines, for the population the grid covers, in the period the grid covers. Written that way, the condition cannot leak, because every clause in it is a query on the grid, and a hostile reader who disputes a clause is disputing a line that has an evidence reference. The practical habit is to draft the condition sentence on the day the test is completed, while the grid is open and the exceptions are fresh, and to write it into the potential findings list beside the observation. The life of a finding calls this stage 2; the auditors who do it find that the condition at stage 4 is the stage 2 sentence with the corroboration added, and the auditors who do not find themselves reconstructing counts from memory in the week the draft is due.
Two things about the grid decide the condition’s shape. The first is whether it covers a population or a sample, which decides whether the condition can say “of the 46” or must say “of the 25 sampled from 214”, and the sampling memo the template describes is where that decision was made. The second is what the grid was testing: an attribute of a control, in which case the condition counts the attribute’s failures; or an outcome, in which case the condition counts the outcomes and states their value. Confusing the two produces the most common mixed condition, “the control did not operate and 41 duplicate payments occurred”, which is two conditions about two populations and should be written as two sentences with two denominators.
The seven properties of an airtight condition
| Property | What it means | Leaks when | Example of the property holding |
|---|---|---|---|
| 1. Factual | Every clause states something observed, counted or documented | An adjective or adverb carries the meaning: weak, inadequate, frequently, generally | “The reconciliation for the wire suspense account listed the same 41,200-dollar reconciling item, described as timing, in each of the twelve months” |
| 2. Quantified | Every count has a denominator and every amount has a population | “Several”, “a number of”, “many”, “most” | “2,300 of 48,000 credit memos were approved by the representative who issued them” |
| 3. Bounded | The period, the population and the location are stated | The reader cannot tell when, where or how widely | “…in the fourteen months to June, across all twelve depots” |
| 4. Specific | The thing that happened is named at the level the evidence supports, no higher | “Controls are not operating effectively” stands in for the thing that did not happen | “…had no record of a call-back”, not “were not properly verified” |
| 5. Confirmed | Management has agreed the facts, or their contrary evidence has been examined | The condition is written from the sample and shown to management in the draft | A fact-validation record dated before the draft, referenced in the file |
| 6. Separated | Criteria, cause and consequence are elsewhere; the condition does not argue | “…which is contrary to policy and exposes the company to loss” | The criteria sentence follows the condition; the consequence has its own paragraph |
| 7. Proportioned | The number is put in the context that makes it mean what it means | “410,000 dollars of unsupported credits” with no revenue figure beside it | “…410,000 dollars, 0.1 percent of revenue and 0.9 percent of credits issued” |
The words that editorialize, and their replacements
Editorializing is the leak that auditors see least in their own writing, because the words that do it feel like precision. “Inadequate” feels like a technical term; it is a verdict. “Frequently” feels like a measurement; it is an impression. The table lists the words that most often carry a judgment where a fact was needed, with the question each one is hiding and the replacement that answers it. The rule is not that the words are forbidden elsewhere in the finding; the consequence element can say “significant” and the cause can say “inadequate design”. The rule is that they do not appear in the condition.
| The word | The question it hides | The replacement |
|---|---|---|
| Inadequate, insufficient, weak, poor, ineffective | Inadequate for what, measured how? | The specific thing that did not happen: “was not reviewed by a second person”, “did not include the ledger balance” |
| Frequently, often, regularly, routinely, consistently | How many times out of how many? | The count and the denominator: “in 31 of 46 changes” |
| Several, numerous, a number of, various, many, most, some | How many? | The number |
| Significant, material, substantial, considerable | Compared to what? | The amount and the base: “1.1 million dollars, 0.2 percent of the balance sheet accounts’ gross value” |
| Timely, promptly, in a timely manner, delayed | By when, and when did it happen? | The dates or the interval: “a median of eleven working days against a calendar of eight” |
| Properly, appropriately, adequately, correctly | Against what standard? | Delete; the criteria states the standard and the condition states what happened |
| Failed to, neglected to, did not bother to | Who is being blamed, and is blame a fact? | “did not”, “was not”, “no record of” |
| Appears to, seems to, may have, it is likely that | Did it or did it not? | State what was found; if the evidence does not support a statement, the condition is not ready |
| Management has not ensured, ownership was lacking, accountability was unclear | What specifically was absent? | The absent artifact or act: “no owner was recorded for 22 of 340 close tasks” |
| Best practice, industry standard, leading practice | Whose practice, and is it a criterion? | Delete from the condition; if it is a criterion, cite the source in the criteria element |
Numbers: how to state them so they carry the finding
A condition is carried by its numbers, and numbers can be stated badly. Five rules cover most of it. State the count with its denominator every time, in the same clause: “31 of 46”, never “31 changes” in one sentence and “46 changes were made” three sentences later. State the population the denominator came from, so that the reader knows whether 46 is the year, the sample, or the changes above a threshold. State amounts with their base, and choose the base the reader would choose: the year’s revenue for a revenue leak, the account’s gross value for a reconciliation difference, the spend for a procurement finding. State the period with dates, not with “the review period” or “the year”, because the report will be read after both have changed. And when a number is an estimate, say so and say how it was made, because an estimated number stated as a count is the first thing a hostile reader checks.
Two further habits separate a condition that carries from one that merely reports. Put the most important number first, so that the sentence’s weight lands where the finding’s does: “31 of 46 changes had no call-back record” rather than “of the 46 changes reviewed, records were found for 15”. And write the number in a form the reader can hold: “one in three”, “a median of six seconds”, “twice the company average” are proportion statements that the count justifies, and they belong beside the count, not instead of it. The model workpaper shows where each number in a condition comes from, and the condition should be traceable to it line by line.
Sample conditions and population conditions
The largest single leak in audit conditions is the sample stated as a population. “Six of 25 vendors sampled had no bank verification” is a sample condition, and it supports a finding about the control, not a statement that a quarter of the year’s 214 vendors were unverified. “31 of the 46 changes in the period” is a population condition, because all 46 were tested, and it supports whatever the 46 support. The difference decides the rating more often than anything else in the finding: a population condition on a control that did not operate is a High almost by definition, while a sample condition on the same control is a High only if the sample was designed to project, and most audit samples were not. The condition has to say which it is. A sample condition names the sample size, the population it was drawn from and the selection method, and stops at the sample; the projection, if the sampling method supports one, goes in the consequence with its confidence stated. A population condition names the population and the test that covered it, which is usually an analytic, and it may say “all”. The habit that prevents the leak is to write the population sentence first, “the population was 214 vendors created in the period”, and the finding sentence second, and to check that the second does not claim more than the first allows.
Conditions for the four kinds of finding
Findings come in four kinds, and the condition is shaped differently for each. A control that exists but did not operate produces a condition that counts the operations that failed: the approvals missing, the reconciliations late, the call-backs absent. A control that does not exist, a design gap, produces a condition that states the absence and its scope: no verification of bank details before first payment for any of the 214 vendors created, because there is no such step. A process that is not documented or not followed as documented produces a condition that states the divergence: the policy requires central procurement above 25,000 dollars and the plants’ buyers sourced up to 100,000 without it. And an outcome, an error, a loss, a misstatement, produces a condition that counts and values the outcome, with the control finding beside it if there is one. The table gives the pattern for each, because the most frequent leak after editorializing is a condition written in the wrong kind’s shape: an outcome stated where the finding was about a control, which invites “but nothing was lost”, or a control stated where the finding was about a loss, which hides the number that would have made the rating.
| Kind of finding | What the condition counts | Pattern | Example |
|---|---|---|---|
| Control not operating | Failed operations over operations | “[Count] of [population] [operations] in [period] [lacked the attribute]” | “31 of 46 bank-detail changes in the period had no call-back record” |
| Control not designed | The absence, and the population exposed | “No [control] exists for [population]; [scope statement]” | “No independent verification of bank details is performed before first payment; 214 vendors were created in the period through the same path” |
| Process not documented or not followed | The divergence between the documented and the performed | “The [policy] requires [X]; in [population], [Y] was performed” | “The procurement policy requires central involvement above 25,000 dollars; the three plants’ buyers sourced 41 purchases between 25,000 and 100,000 dollars without it” |
| Outcome: error, loss, misstatement | The outcomes and their value | “[Count] [outcomes] totaling [amount], [base]; [concentration]” | “41 confirmed duplicate payments totaling 286,000 dollars, 0.2 percent of the period’s payments, 29 through migrated vendor records” |
Length, order and the three-sentence shape
A condition is one to three sentences in most findings, and the sentences have an order. The first carries the fact with its number and denominator, because it is the sentence the reader will quote. The second bounds it: the population, the period, the location, the test that produced it. The third, where there is one, gives the concentration or the pattern: which depots, which representatives, which months, because concentration is where the cause will be found and the reader should be led there. A condition that needs more than three sentences is either two conditions, in which case it should be split with a denominator each, or a condition with narrative in it, in which case the narrative belongs in the cause or the consequence. Within each sentence, the number comes early and the qualification late: “31 of 46 changes had no call-back record” is read differently from “a call-back record could not be found for 31 of the 46 changes reviewed”, although both are true, because the first puts the weight on the fact and the second on the search. The condition is not the place for the search.
Reading your condition as the auditee: a two-minute exercise
Before the draft leaves, read each condition as the person who will receive it, with one question: what is the first thing I would say back? If the answer is “that is not what happened”, the facts have not been validated and the draft is not ready. If the answer is “how many?”, a number is missing. If the answer is “out of how many?”, a denominator is missing. If the answer is “that is not fair”, an adjective is doing the work, or the base rate is absent. If the answer is “that was not in your scope”, the period or population is unstated. And if the answer is “yes, that is what happened”, the condition is airtight, and the conversation that follows will be about cause and action, which is the conversation the finding was written to have. The exercise takes two minutes per finding, and the auditors on this site’s engagements run it aloud with a colleague, because the colleague who was not in the room hears the leaks the author has stopped hearing.
Conditions in follow-up reports, advisory memos and referrals
Three report types change the condition’s shape without changing its rules. In a follow-up or validation report, the condition states what was found on re-test beside what was found originally, with both denominators: “52 changes in the year, 49 with a complete verification record, against 31 of 46 without one at the prior audit”, so that the reader sees the movement and not only the residual. In an advisory memo, where no assurance is given and there are no findings, the equivalent of a condition is an observation, and it is held to the same factual standard for a different reason: an advisory observation that editorializes will be quoted back as an assurance conclusion the function never gave. And where a matter has been referred under the fraud protocol, the condition in the report is written about the control and never about the events: the first 48 hours guide sets out why the report says “two bank-detail changes were made by a payroll user outside the verification control’s scope” and does not say who, how much or what happened next. In all three, the condition’s job is unchanged, to state what is in words nobody can dispute, and the discipline is the same list of seven properties.
One more case deserves a sentence: the positive condition. Reports say what is working, and the sentence that says it is held to the same standard as the findings, because a positive statement that editorializes (“controls over the payment run are strong”) is the one the committee will remember when the payment run fails. “Dual control was evidenced for all ten payment runs sampled, and totals were reconciled to the bank file in each” is a positive condition; it says what was tested and what was found, and it will still be true after the failure, which is the test of a fact.
The condition checklist
Run the checklist on every condition before the draft leaves the auditor, and again at file review. It takes two minutes per finding and it catches the leaks that closing meetings are otherwise spent on.
Condition checklist. 1. Every count has a denominator in the same clause. 2. Every amount has a base the reader would choose. 3. The period is stated with dates. 4. The population is named, and the condition claims no more than the population supports. 5. If a sample: size, population and selection method stated; no projection in the condition. 6. No adjective or adverb carries the meaning; the editorializing list has been run. 7. No “failed to”, “neglected to” or any word that assigns blame. 8. No “appears”, “seems” or “may”; every clause is a statement. 9. The criteria, cause and consequence are absent from the sentence. 10. Every number traces to a workpaper line. 11. Management confirmed every number before the draft, and the confirmation is dated in the file. 12. A reader who has not seen the workpapers can restate the condition in their own words without adding anything.
Twelve conditions rewritten
The first drafts below are the kind auditors write at the end of a long fieldwork week, and each leaks in a way the table names. The rewrites are the conditions as they appeared in the engagements on this site, or as they would have. Read the pairs for the pattern rather than the content: in every case the rewrite is longer, has more numbers, and has fewer adjectives, and in every case it would take a hostile reader longer to find something to dispute.
| First draft | The leak | Rewritten |
|---|---|---|
| “Vendor bank change controls are weak and call-backs are frequently not performed.” | Two verdicts, one impression, no numbers | “Of the 46 vendor bank-detail changes made between March and April, 31 had no record of a call-back to a contact on file; 14 of the 31 were followed within ten days by a payment above 25,000 dollars.” |
| “Several approvers are rubber-stamping expense reports.” | “Several” and “rubber-stamping” are both judgments | “Six of the 38 approvers handled 44 percent of the year’s 21,400 expense lines at a median of six seconds per report; 94 percent of policy-flagged items were approved without a comment.” |
| “Management has not ensured that the sole-source process is properly followed.” | Blame, “properly”, and no fact | “Of the 57 sole-source awards above 10,000 dollars in the eighteen months to June, 2.9 million dollars in total, 17 were approved below the required level; a re-performed market check on 15 found plausible alternative suppliers for six within twenty minutes each.” |
| “The reconciliation process is not operating effectively.” | Topic, not problem; no population | “At year-end, 38 of the 410 balance sheet accounts had not been reconciled for more than two months, and 14 carried unexplained differences totaling 2.1 million pounds gross and 0.6 million net.” |
| “A sample of credit memos showed inadequate support.” | Sample stated as if it were the point; “inadequate” | “All 48,000 credit memos issued in the year were joined to return receipts and pricing claims: 2,300 were approved by their issuer, and 610, totaling 410,000 dollars, had no return, claim or documented concession behind them.” |
| “Assets could not be located during the count.” | No count, no denominator, no value | “Of 180 register items sampled by value across three plants, nine (84,000 dollars net book value) could not be located; seven had been scrapped and two moved without a disposal or transfer record.” |
| “The close is consistently late.” | “Consistently” and “late” against what? | “The month-end close was completed on working day eleven in ten of the twelve months, against a calendar of eight; 31 of 340 tasks were completed after their due day in every month.” |
| “There appears to be a concentration risk in the cloud arrangements.” | “Appears”; risk language in the condition | “The core provider’s disaster-recovery site, the digital banking platform and the account-opening vendor all run in the same public cloud region, per the providers’ subcontractor lists dated within the year.” |
| “Ghost employees may exist on the payroll.” | “May”; the test result is missing | “Of 168 employee records flagged by the ghost analytics across the payroll master and HR master for the fourteen months, nine remained after record elimination and corroboration: six shared a bank account with another employee and three had no timekeeping activity while being paid.” |
| “Post-implementation reviews are not being done.” | True but unbounded; no denominator | “No post-implementation review was performed for any of the six capital projects above 250,000 dollars completed in the year, against a policy requiring one for each.” |
| “Certifications are signed without adequate review.” | “Adequate”; the mechanism missing | “In the fourth quarter, 22 account owners certified accounts that, at the certification date, carried unexplained differences older than ninety days in the reconciliation tool, without noting an exception.” |
| “Duplicate payments were identified as a result of the migration.” | Cause in the condition; no numbers | “Analytics across 61,400 invoices identified 41 confirmed duplicate payments totaling 286,000 dollars; 29 of the 41 were paid through vendor records created by the migration of the acquired distributors, and 241,000 dollars was recovered in the quarter.” |
The eighth pair is worth a second look, because the first draft was not wrong; the concentration was real and the finding was reported. It was written as a risk because the auditor was thinking about the consequence while writing the condition, and the rewrite moved the risk to where it belonged and left a fact that management confirmed in a day. The twelfth pair shows the other common migration: the cause (“as a result of the migration”) had drifted into the condition, where it invited the reply that the migration was over, and the rewrite put the migration back where it could be addressed by the action plan.
Common mistakes
Writing the condition from memory at the end of fieldwork instead of from the disposition grid during it. Letting an adjective do the work a number should do. Stating the sample as the population, or the population without its size. Omitting the period, so that the condition is unbounded and the report is undatable. Putting the criteria in the same sentence (“contrary to policy”), which turns a fact into an accusation. Stating the cause in the condition, which invites the reply that the cause has changed. Hedging with “appears” and “may” because the evidence was thin, instead of getting more evidence or dropping the finding. Writing conditions that management sees for the first time in the draft. Using “management” as the subject of a condition, which assigns blame to a noun that cannot answer. And leaving out the base rate, which is the one omission that makes a true condition read as unfair.
Where to go next
Write the condition from the grid, count everything, name the population, date the period, run the editorializing list, and get the facts confirmed before the draft. Then write the other four elements: the cause that points to the fix, the impact that lands, the recommendation management can implement, and see all four assembled in the finding makeovers. The structure the elements sit in is the five Cs; the block they appear in is described in the anatomy of an audit report; and the conversation an airtight condition makes short is in the negotiating findings guide.
Related guides
- Writing cause statements that point to the fix — the second element
- Writing impact that lands — the consequence element
- Writing recommendations management can actually implement — the action element
- Finding makeovers — five findings rewritten element by element
- The 5 C’s of audit findings — the structure, with dissected examples
- The life of a finding — the corroboration and fact validation stages the condition depends on
- Negotiating audit findings — why a validated condition is not on the table
- Anatomy of an internal audit report — the finding block
- Annotated workpaper examples — the disposition grid the numbers come from
- Audit sample sizes demystified — when a sample can be projected and when it cannot
- Finding severity ratings — why population conditions rate higher than sample conditions
- How to write an internal audit report — the report around the finding
- Internal audit report examples — conditions in finished reports
- Writing guides and findings and reporting guides — the full collections
Leave a Reply