Most of the words you will hear during an internal audit have exact meanings inside the profession, and the exact meaning is usually narrower and less alarming than the everyday one. An exception is one sampled item where a control could not be shown to have operated; it is not an accusation. A finding is a documented gap between the standard your process is measured against and what the auditors observed; it is not a verdict on your team. A rating describes exposure, not effort. This guide translates 60 of those words into plain language, grouped by the stage of the audit at which you will first hear them, and gives you, for each one, what it means in practice for the person being audited and the one question worth asking when you hear it.
The existing 120-term glossary was written for new auditors and defines the words from the inside. This one is written for the other side of the table: the process owner, control owner or manager who hears “we have four exceptions in the sample” in a status meeting and needs to know, before the meeting ends, whether that is a problem and what to do about it. It is organized the way the audit unfolds, from the notification letter to the closed issue, because that is the order in which the words arrive. For the stages themselves, the auditee’s walk through an engagement is in What to Expect During an Internal Audit, and everything else written for people on your side of the table is collected on the Being Audited? hub.
Two rules governed the definitions. Where a term comes from the IIA’s Global Internal Audit Standards, the wording follows the Standards and cites the standard number; where a term is a SOX term, it follows PCAOB Auditing Standard 2201, and the SEC’s 2007 management guidance uses the same definition of a material weakness. Everything else is the vocabulary practitioners actually use, with the variations noted where functions differ. The “what to ask” column is not a script for pushing back. It is the question that gets you the information you need in order to respond well, asked at the moment the word is first used, which is when it is cheapest to ask. A worked example near the end takes one dense paragraph from a hypothetical draft report and translates it line by line, and a final table decodes twelve phrases auditors use in conversation.
In this guide
- Before fieldwork: planning terms
- During fieldwork: requests, walkthroughs and testing
- When something is found: the finding vocabulary
- The report: from closing meeting to distribution
- After the report: follow-up and closure
- The people and rules behind the audit: governance terms
- If your control is a SOX control: the extra vocabulary
- Worked example: one draft finding, translated
- Twelve phrases you will hear, and how to read them
- Questions readers ask
- Related guides
Before fieldwork: planning terms
The planning vocabulary arrives in the notification letter and in the first conversation with the lead auditor, and it sets the boundaries inside which everything else happens. Auditors call one audit an engagement, and they choose engagements from a risk assessment of everything they could audit, which is why the question “why us, why now” has a real answer: the guide to how audit plans choose what gets audited walks through the scoring. By the time you are notified, that choice is made. What is still open is the scope, the objectives and the criteria, and those deserve more of your attention in week one than the request list does.
Scope decides which teams, systems and time periods are touched. It is set in a planning memo you may never see; the auditor-side guide to the engagement scoping memo shows what is in it, which is useful because it tells you which questions the auditors have already answered before they met you. Criteria are the standard your process will be measured against. If the criteria are a policy nobody has updated since the system changed, say so at the opening meeting, because a finding written against obsolete criteria is still a finding until someone corrects the criteria. The month-before preparation, including who to brief and what to assemble, is in How to Prepare for an Internal Audit, and the one-page process narrative that answers half the planning questions before they are asked is in Documenting Your Process Before the Audit.
| Term | Plain meaning | What it means for you | What to ask |
|---|---|---|---|
| Audit plan | The list of audits internal audit intends to perform over a period, usually a year, chosen from a risk assessment of everything it could audit (the “audit universe”). Standard 9.4 requires the plan to rest on a documented risk assessment, refreshed at least annually, with board and management input. | Your area is on the plan because of its risk profile, the time since the last audit, a change, or a request from the board or management. Being selected is not a judgment on your team. | “What put this area on the plan this year, and when was it last audited?” |
| Notification letter (engagement letter, announcement memo) | The written notice, usually from the chief audit executive to your executive and to you, naming the engagement, the lead auditor, the planned dates and the high-level objective. | It starts the clock. Fieldwork typically follows two to four weeks later. Name a coordinator and block calendar time for your key people now. | “Who is the single point of contact on your side, and who do you expect to be ours?” |
| Engagement objective | What the audit is trying to conclude on, for example whether controls over vendor onboarding are designed and operating to prevent unauthorized vendors. Standard 13.3 covers engagement objectives and scope. | Every request should trace back to an objective. A request that does not is fair to question, politely, at the next status meeting. | “Which objective does this request support?” |
| Scope | The boundaries: which processes, locations, systems and time period are in, and which are out. | Scope decides whose team gets requests and whose data gets pulled. It is easiest to correct at the opening meeting and hardest after the draft report. | “Is the new system, the outsourced step or the migration period in or out of scope, and is that written down?” |
| Risk assessment (engagement-level) | The auditors’ analysis, before testing, of what could go wrong in your process and which risks matter most; it decides where testing concentrates. Standard 13.2 covers it. | Your walkthrough answers feed it directly. If you know where the real risks are, say so; it shortens the audit and makes the findings fairer. | “Which risks are you treating as the highest, and what led you there?” |
| Residual risk (and inherent risk) | Inherent risk is the exposure before any controls; residual risk is what remains after the controls operate. Findings are statements about residual risk. | A finding says residual risk is higher than the organization intended. “We have never had a loss” speaks to history, not to residual risk. | “Is the concern that a control is missing, or that the existing control is not reducing the risk enough?” |
| Criteria | The standard your process is measured against: a policy, a regulation, a contract, a framework such as COSO, or recognized good practice. Standard 13.4 covers evaluation criteria. | Criteria are what make a finding a finding. If the criteria are not written anywhere, or you were never told about them, ask to see them before testing starts. | “What criteria are you testing against, and where are they documented?” |
| Work program (audit program) | The list of procedures the auditors will perform to meet the objectives: what they will inspect, re-perform, observe or ask. Standard 13.6 covers it. | It explains why the request list looks the way it does. Auditors rarely share the full program, but they will usually tell you what a test is for. | “Can you tell me what this test is designed to show, so I send the right thing?” |
During fieldwork: requests, walkthroughs and testing
Fieldwork is where most of the vocabulary lives, because it is where the auditors gather evidence. The sequence is nearly always the same: a request list, a walkthrough of the process on one real transaction, a population pulled from the system, a sample drawn from it, and a test of each sampled item against the control as described. The words in the table map onto that sequence. Three of them cause most of the misunderstandings. Population means the complete set of items, and auditors ask how a list was produced before they trust it, which is why what counts as audit evidence matters more than how much of it you send. Exception means one item that failed or could not be evidenced; it is a fact to be explained, not yet a conclusion. IPE means any report your side produced, and the questions that follow it are about the report’s reliability, not your honesty; the auditor’s method is in the IPE testing guide.
The request list has its own guide, The PBC Survival Guide, and the walkthrough has one written from your chair, How to Walk an Auditor Through Your Process. For the testing stage, two auditor-side explanations repay ten minutes each: test of design versus operating effectiveness, which explains why a diligently performed control can still produce a design finding, and where the sample sizes 25, 40 and 60 come from, which explains why a single failure in a sample of 25 is treated as seriously as it is. If the auditors ask to interview you or your staff, what they ask and how to answer covers the conversation, and the companion list of 60 questions auditors ask process owners shows what a good answer contains.
| Term | Plain meaning | What it means for you | What to ask |
|---|---|---|---|
| Opening meeting (kickoff) | The first formal meeting, where the lead auditor presents objectives, scope, timeline, request list and ground rules. | Your best chance to fix scope, agree logistics and set the status-meeting rhythm. Bring the people who know the process, not only the managers. | “How often will we meet on status, and how will you tell us about potential findings as they arise?” |
| PBC list (provided by client) | The request list of documents, reports and data extracts the auditee supplies, each with a due date; also called the document request or request list. “Prepared by client” is the other expansion you will hear. | Expect the first version to run to about twenty items and to grow during fieldwork. Items that are late, partial or produced from memory create work on both sides. | “Which items are needed before fieldwork can start, and which can follow?” |
| Walkthrough | The auditor following one real transaction through your process from start to finish, at the screens of the people who perform each step, to confirm how the process and its controls operate. | It is not a test of the year; it is how the auditor learns your process and chooses what to test. The person who does the work should answer, not the manager. | “Will you pick the transaction, and which steps do you want to see live?” |
| Control | An activity built into a process that reduces a risk: an approval, a reconciliation, a system check, a review, a restriction on access. Auditors separate what the control is from the person who performs it. | Much of what you call “the process” the auditor sees as a chain of controls, each with an owner. Being able to name your controls and their owners changes the tone of the audit. | “Which activities in my process are you treating as the controls, and which of them are key?” |
| Segregation of duties (SoD) | Splitting the steps of a sensitive transaction (initiate, approve, record, reconcile, hold custody) across people so no one person can both make and conceal an error or a fraud. | A small team almost always has SoD conflicts. Auditors accept that where a compensating control exists, is performed by someone independent, and leaves evidence. | “Which combination of duties is the concern, and would an independent review of the output address it?” |
| Population | The complete set of items a control applied to during the period: every payment, every new vendor, every access change. Auditors ask for it before they sample. | Expect to be asked how the list was produced and how you know it is complete. A list typed by your team is not the population; a system extract with its parameters is. | “What date range and status filters do you want in the extract, and do you want the parameters shown?” |
| Sample | The items selected from the population for testing. The common sizes of 25, 40 or 60 for high-frequency controls come from attribute-sampling math at zero expected deviations; smaller numbers apply to monthly or quarterly controls. | The auditor chooses the sample, not you. Every size on the standard grid is a zero-deviation plan, which is why one failure matters so much. | “How many items will you test, and will you select them at random or by judgment?” |
| Test of design (TOD) | Evaluating whether a control, if operated exactly as described, would address the risk: right person, right frequency, right precision, right evidence. | A design finding means the control as written cannot work, however diligently you perform it. The fix is a change to the control, not more effort. | “If the control ran perfectly as described, what risk would it still miss?” |
| Test of operating effectiveness (TOE) | Evaluating whether the control actually operated as designed, consistently, over the period, by inspecting evidence for each sampled instance. | The question is not whether the control exists but whether you can prove it ran each time. Where there is no evidence, auditors treat the instance as not performed. | “For each sampled item, what evidence would show the control operated?” |
| Exception (deviation) | A sampled item where the control did not operate as designed, or where the evidence does not show that it did. An exception is a fact; a finding is a conclusion. PCAOB AS 2201 notes that an individual control does not necessarily have to operate without any deviation to be considered effective, but it requires the auditor to determine the effect of the deviations. | Your first job is cause and extent: isolated or systemic, and whether the error was caught elsewhere. Explaining an exception within a day keeps it from hardening. | “Is this an exception in the control, or in the evidence of it? What would you need to see?” |
| IPE (information produced by the entity) | Any report, extract, query output or spreadsheet your side produces that the auditors rely on. Auditors must test its completeness and accuracy before they rely on it. | Expect questions about where the report comes from, who can change it and what parameters were used. A screenshot of the parameters saves a round trip. | “Which reports will you rely on, and what do you need to see about how they were produced?” |
| Evidence of review | Proof that a review control happened and what it covered: annotations, items questioned, follow-up, resolution, date and sign-off. A signature or a “reviewed” tick on its own shows that a review was claimed, not that it was performed. | Reviewers who leave no trace of what they examined will see their control treated as unevidenced. Keep the questions asked and the answers received. | “What does your evidence standard for a review look like? Do you need the questions raised and how they were resolved?” |
| Potential finding (preliminary finding) | An exception or gap the auditors think may indicate a control that did not operate, placed on a list for corroboration with you before it is rated or written. | Nothing is final at this stage. This is when facts, context and compensating controls change the outcome; after the draft it is much harder. | “Is this confirmed, or still a potential finding? What would change your view?” |
When something is found: the finding vocabulary
A finding has a fixed structure, and knowing it lets you read a draft the way the auditors wrote it. The Standards describe findings in terms of criteria (what should be), condition (what is), cause (why the gap exists) and effect (what it risks); practitioners add a fifth C for the corrective action or recommendation, which gives the 5 C’s of audit findings. Under Standard 14.2, auditors compare condition with criteria and analyze cause and effect; under Standard 14.3, they work with management to identify root causes where possible, determine potential effects and evaluate the significance of each finding, which is where the rating comes from. Each part can be challenged, but with different tools: the condition with evidence, the cause with a better explanation, the effect with a bounded estimate of exposure, and the rating with the function’s own written definitions.
Three terms in this group can change an outcome in your favor if you raise them in time. A compensating control, a real one that addresses the same risk and the same population and is performed by someone independent of the failed step, can lower a rating, though the gap it covers is still reported; the auditor’s test of one is in Compensating Controls: When Plan B Is Good Enough. A self-identified issue, one you had logged and put in motion before the audit, is acknowledged in the report and treated more favorably in most functions; the guide to self-identified issues explains the “documented and in motion” test. And a root cause that points at a process rather than a person leads to a fix that holds; the owner’s method is in root cause analysis from the auditee’s side. For what the rating itself means and how it is derived, Internal Audit Ratings Explained covers the common scales, and for the right way to contest a finding, how to dispute an audit finding properly.
| Term | Plain meaning | What it means for you | What to ask |
|---|---|---|---|
| Finding (issue) | A documented gap between what should be (criteria) and what is (condition), with its cause and effect, rated for significance. Some functions say issue; the lesser, unrated kind is often called an observation, though usage varies between functions. | Every rated finding ends with an owner, an action and a date, or with a documented risk acceptance. Agree the facts before the rating; the rating follows the facts. | “What are the condition and the criteria, in one sentence each?” |
| Condition | What the auditors found: the facts, with the population, the sample and the count of exceptions, stated so that the gap against the criteria is visible. | The condition is the most contestable part of a finding and the only part you can change with evidence. Check every number against your own records. | “Which items were the exceptions, so I can trace each one?” |
| Cause | Why the gap exists: the missing step, unclear procedure, system setting, workload or training gap that produced the condition. Standard 14.3 asks auditors to work with management to identify root causes where possible. | A cause written as “human error” points at your people; a cause written as a process gap points at a fix. Push for the latter when it is true. | “What cause will the report state, and have you discussed it with the people who perform the step?” |
| Effect (impact, consequence) | The risk or cost the gap creates or could create: misstatement, loss, breach, harm, delay. Auditors assess potential effect, not only what has already happened. | “Nothing went wrong” is not a defense, because the effect is about exposure. A specific, bounded effect is fairer to you than a vague one, so help quantify it. | “Is the stated effect actual or potential, and what population does it apply to?” |
| Root cause | The underlying condition that, if corrected, would stop the exceptions recurring; distinct from the direct cause that produced the event. | Your action plan is judged against the root cause. Fixing a symptom leads to a repeat finding. | “Do we agree on the root cause before I write the action plan?” |
| Rating (finding severity) | The significance assigned to a finding, usually High, Medium or Low (some scales add Critical, or use colors or numbers), from the function’s written methodology. Standard 14.3 requires auditors to evaluate significance. | The rating decides who sees the finding, how fast you must act and how it is validated. Argue it from the written definitions and the corrected facts, not from “no loss occurred.” | “Which definition in your methodology does this rating meet, and may I see the scale?” |
| Repeat finding | A finding with the same condition in the same process as one previously reported, after the earlier action plan closed or lapsed. Many methodologies rate a repeat at least one level higher. | A repeat says the earlier fix did not hold, and it is read as evidence about management attention, not only about the control. | “Which prior finding is this a repeat of, and what was closed last time?” |
| Compensating control | A control elsewhere in the process that reduces the same risk when the intended control is missing or weak. It changes the severity of a gap without removing the gap. | Naming a real compensating control, with evidence, can lower a rating, but it must address the same risk and population, be performed independently of the failed step and leave evidence. The missing control is still reported; what changes is how serious the gap is judged to be. | “If I show you the downstream review and its evidence, would that change the rating?” |
| Self-identified issue | A weakness that management found, documented and started fixing before internal audit, the external auditor or a regulator found it. “Documented and in motion” is the test. | Most functions acknowledge self-identified issues in the report and treat them more favorably, but the log entry and the plan must predate the audit. | “Will this be reported as self-identified, and what do you need to see to label it that way?” |
| Recommendation | The auditors’ suggested fix, addressed to the cause. Under Standard 14.4 the report may carry auditor recommendations, management action plans or both. | You are not bound to the recommendation’s method; you are bound to address the cause. A better or cheaper fix is a legitimate response. | “Is the recommendation a requirement, or would an alternative that addresses the cause be accepted?” |
The report: from closing meeting to distribution
The reporting vocabulary comes with deadlines attached, and the deadlines are short. The closing meeting ends fieldwork; the draft follows within a week or two in most functions; the response window is typically five to ten business days; the final report goes out within about two weeks of your response. The Standards shape this stage more than any other. Standard 13.1 requires a methodology that lets both the auditors and management state their positions on the final communication, and it requires auditors to seek mutual understanding and to have a valid reason before changing results. Standard 15.1 requires the final communication to include results, conclusions and management’s action plans, to acknowledge actions management has already started or completed, and to reach the right readers. Standard 11.4 requires errors and omissions to be corrected and recommunicated. Between them, those three give you the right to correct facts, to have your view recorded, to have work already done acknowledged, and to have a mistake fixed after the report is issued.
The mechanics of using those rights are in three guides written for your side: how to review the draft report in 48 hours, fifteen management response examples running from “agree” to “risk accepted”, and writing management action plans that actually close. The closing meeting playbook is written for the auditor running the meeting, which makes it a useful preview of what will happen in the room. Risk acceptance is the term most often misunderstood at this stage: it is a legitimate response, made by someone with the authority to bear the consequence, recorded and revisited, and it is not a way of making a finding disappear; the process is in Risk Acceptance by Management. Distribution is the term most often forgotten. The final report usually goes above your executive, so write every response for the reader who will never meet you. The anatomy of an internal audit report shows what each section is for and who reads it.
| Term | Plain meaning | What it means for you | What to ask |
|---|---|---|---|
| Closing meeting (exit meeting) | The meeting at the end of fieldwork where findings, facts and preliminary ratings are discussed before the draft report is written. | Your last structured chance to correct facts and offer context before anything is written down. Come with your evidence, not your objections. | “Will the draft contain anything we have not discussed today?” |
| Draft report | The auditors’ complete report, with findings, ratings and recommendations, circulated to the audited area for factual accuracy and management responses before it is finalized. | Facts are open to correction; ratings move only when the facts change; the conclusions belong to the auditors. Under Standard 13.1 both sides can record their position. Review it inside the window, usually five to ten business days. | “What is the deadline for comments and responses, and who else has received the draft?” |
| Overall conclusion (report rating, opinion) | The one-word or one-sentence conclusion on the engagement as a whole, such as Satisfactory, Needs Improvement or Unsatisfactory, or Effective, Partially Effective or Ineffective, derived from the findings by methodology rules rather than averaged. Standard 14.5 covers engagement conclusions. | One High on a key control can set the rating alone. This word, not the finding count, is what the audit committee reads first. | “How does your methodology derive the overall conclusion from the individual findings?” |
| Management response | Management’s written reply to each finding, printed in the report under the finding in your words: agree or disagree, the action, the owner, the target date and any interim measure. | It is the only part of the report you write, and it is read by people who will never meet you. Specific, dated, owned responses read as competence. | “Will my response be printed verbatim, and is there a word limit?” |
| Action plan (management action plan) | The committed set of actions, owners and dates that will fix the cause of a finding. It becomes the item the issue log tracks and the validator later tests. | The dates you choose here are the dates you will be reported against. Build in the operating period validators need; “done” and “closed” are different states. | “How long does a fix need to operate before you will validate it, so I can set a realistic date?” |
| Risk acceptance | A documented decision, by someone with authority to bear the consequence, not to remediate a finding and to live with the exposure. If the accepted risk is beyond the organization’s appetite or tolerance, Standard 11.5 requires the CAE to escalate to senior management and, if unresolved, to the board. | It is a legitimate response, not a loophole. The finding stays on the log under a “risk accepted” status with a review date; it is neither downgraded nor closed. | “Who has authority to accept a risk at this rating, and what review date goes with it?” |
| Distribution (distribution list) | Who receives the final report: typically your executive chain, the audit committee or its chair, the CFO or CEO, and sometimes the external auditor or a regulator. Standard 15.1 requires results to reach the right readers. | Assume the report will be read above your executive, and write your response for that reader. Ask before forwarding it yourself; auditors protect the information they gather (Standard 5.2) and expect the same of you. | “Who is on the distribution list, and may I share the report inside my team?” |
After the report: follow-up and closure
Once the report is final, the vocabulary changes from findings to actions, and the actions have a longer life than the report. They sit in the issue log with your name, a rating, a date and an aging count, and the log is reported to the audit committee, often quarterly. Standard 15.2 requires internal audit to confirm that recommendations or action plans have been implemented, or that management has accepted the risk of not acting. Confirming means checking, and in practice functions do not close an issue on management’s word alone. That one requirement explains the two terms owners find most frustrating: validation, which is audit testing your fix, and sustainability, which is audit wanting to see the fix operate for a period before calling the issue closed.
The owner’s side of this stage is covered in three guides: the 90-day remediation plan, how to get a finding closed, and how to ask for an extension when a date is going to slip. The auditor’s evidence bar for closure is in Evidence Standards for Issue Closure, and the logic of sustainability testing is explained separately. The term to respect in this group is overdue, not because of the word but because of where it travels: overdue items are reported by owner, and repeated or aged ones move up the escalation ladder. The practitioner’s view, offered as judgment rather than data, is that almost every overdue item began as a target date chosen to look responsive rather than to be met.
| Term | Plain meaning | What it means for you | What to ask |
|---|---|---|---|
| Issue log (issue tracker) | Internal audit’s register of every open finding and action, with owner, rating, due date, status and aging, reported to the audit committee, often quarterly. | Your actions live here long after the report is forgotten. Status updates, extensions and evidence should go into it, not into email. | “Where can I see my open items and their status, and how often is the log reported?” |
| Target date (due date) | The date by which the action plan commits to having the fix implemented and, in most functions, operating. | Chosen by you, agreed by audit, reported by name when missed. Date it from the critical path of the fix plus the operating period, not from what sounds responsive. | “Does the target date mean implemented, or implemented and operating for a period?” |
| Extension (re-dating) | A formal change to a target date, requested before the original date passes, with the reason, the interim measure and the new date. The original date is preserved in the log. | A first extension requested early is routine in most functions; a second is reported; a third is escalated. Silence is what costs you. | “What is your process for an extension, and who approves it?” |
| Validation | Internal audit’s independent confirmation, by testing evidence, that the action was implemented and that it operates. Standard 15.2 requires the function to confirm implementation, or that management has accepted the risk of not acting. | Finishing the work is not closure. Validators test instances processed after the fix, so submit when you can show the fix operating, not when the project plan says “complete.” | “What will you test to validate this, and how many instances do you need?” |
| Closure | The decision, recorded by the validator, that a finding is remediated and can leave the open list. Outcomes can include closed, closed with a residual finding at a lower rating, or reopened. | Closure is audit’s decision, not yours. Partial closure exists; so does a failed validation, which often costs another quarter. | “What are the possible outcomes of validation, and what happens if one action passes and another does not?” |
| Sustainability (sustained operation) | Evidence that the fixed control has kept operating over a period, not just once. Many functions require a track record before they close Medium and higher findings. | Build the operating period into your target date. A control that ran once at go-live is implemented, not sustained. | “How long a track record do you need at this rating?” |
| Overdue (past due) | An action whose target date has passed without closure or an approved extension. Logs age overdue items in buckets and report them, by owner, to the audit committee. | Overdue is the state most likely to put your name in front of the committee. Repeated or long-aged overdue items trigger escalation up the management chain. | “Is this item showing as overdue, and what will the committee see about it?” |
The people and rules behind the audit: governance terms
Some words are not about your audit at all but about the structure that makes the audit possible, and they explain behavior that otherwise looks like stubbornness. Auditors will not pre-approve your fix, because of independence. They will not settle a finding privately, because the audit committee sees the results. They will ask certain questions regardless of what past audits covered, because a Topical Requirement obliges them to. And the chief audit executive, not the person in your meetings, owns the final rating. Knowing the structure tells you where decisions are really made, and therefore where to take a disagreement.
Two of these terms deserve a longer read. The Three Lines Model, which the IIA restated in a 2026 Statement of Position that replaces its 2020 position paper (the current edition as of November 2026), explains why you, as management, are the first line and own the risks and the controls, why risk and compliance functions are the second line, and why internal audit as the third line gives assurance and advice without taking on management responsibility. Independence and objectivity explains the behaviors above from the auditor’s side, and risk appetite, tolerance, capacity and limits separates four words that are often run together in risk acceptance discussions. For the limits of what internal audit can require of you, what internal audit can and cannot do reads the charter from the auditee’s perspective, and the charter itself is explained in the guide to the internal audit charter. The Standards are mapped domain by domain in the Global Internal Audit Standards guide, and the distinction between assurance and advisory work is worth knowing before you ask internal audit to look at a new process, because one produces a rating and the other does not. If you lead a division rather than a process, the executive’s week-by-week guide covers the same words at that altitude.
| Term | Plain meaning | What it means for you | What to ask |
|---|---|---|---|
| Audit committee | The board committee that oversees financial reporting, the external auditor and internal audit. Standards 7.1 (Organizational Independence) and 8.1 (Board Interaction) cover the function’s relationship with it. | The committee reads the overall conclusion, the High findings and the overdue items, usually quarterly. It is why audit findings cannot be quietly settled between you and the auditor. | “Which parts of this report will the audit committee see, and when?” |
| Three Lines Model | The IIA’s model of roles, restated in its 2026 Statement of Position: management (first line) owns and manages risks and is responsible for designing and operating processes and controls; risk, compliance and similar functions (second line) provide specialist expertise, support, monitoring and challenge; internal audit (third line) delivers independent and objective assurance and advice. The IIA notes that structures vary and that roles across the lines may overlap in practice. | You are the first line. Internal audit can advise but cannot design or run your controls for you without compromising its independence. | “Are you asking me as the control owner, or asking what the second line should be doing?” |
| Chief audit executive (CAE) | The head of internal audit, whatever the local title: chief auditor, general auditor, head of internal audit, audit director. | The CAE signs the report, approves the ratings and decides what goes to the committee. Disputes that cannot be settled with the engagement lead go here, through your executive. | “Has the CAE reviewed this rating, and what is the route if we still disagree?” |
| Independence and objectivity | Independence is the function’s freedom from conditions that threaten its ability to carry out its work without bias (Standard 7.1); objectivity is the individual auditor’s unbiased attitude, evidence over relationships (Standard 2.1). | It is why auditors will not pre-approve your fix, will not let you choose the sample, and will not soften a condition because the relationship is good. | “Is there a conflict I should know about? Has anyone on the team worked in this area?” |
| Internal audit charter | The board-approved document that sets internal audit’s mandate, authority and access (Standard 6.2). Standard 6.3 covers board and senior management support for unrestricted access to the data, records, people and property needed. | It is why auditors can request your data and interview your staff, and it is also where the limits are. It is usually available on request. | “Is the charter available, and where does it set out access and confidentiality?” |
| Global Internal Audit Standards | The IIA’s mandatory standards for the profession, effective 9 January 2025: five domains, fifteen principles and fifty-two standards. Requirements are mandatory; Considerations for Implementation are guidance. | Several Standards protect you: 13.1 lets both sides state their position; 15.1 requires acknowledgment of actions you have already taken; 11.4 requires errors to be corrected and recommunicated. | “Which Standard governs how a disagreement is recorded in the final report?” |
| Topical Requirements | Mandatory IIA minimum requirements that apply when internal audit performs an assurance engagement on a specific topic: Cybersecurity (effective 5 February 2026), Third-Party (15 September 2026), Organizational Behavior (15 December 2026) and Organizational Resilience (30 April 2027), as of November 2026. Use in advisory work is recommended, not required. | If your area is cybersecurity or vendor management, expect certain questions regardless of your organization’s past practice, because the auditors are required to cover them. | “Does a Topical Requirement apply to this engagement, and what does it add to the scope?” |
| Assurance vs advisory | Assurance is an engagement in which internal audit reaches its own independent conclusion for the board and management; advisory is advice or assistance at management’s request, without an assurance conclusion. | Advisory work produces recommendations, not ratings, and is often what to ask for before a new process goes live. Assurance is what the rating and the committee pack come from. | “Is this engagement assurance or advisory, and will it carry a rating?” |
| Risk appetite (and tolerance) | The amount and type of risk the organization is willing to take in pursuit of its objectives (appetite), and the acceptable variation around it before action is required (tolerance). The appetite is approved by the board on management’s proposal. | It is the yardstick for risk acceptance: a risk within appetite can be accepted by management at the right level; one beyond it triggers escalation under Standard 11.5. | “Is this risk within the organization’s stated appetite, and who decided that?” |
If your control is a SOX control: the extra vocabulary
If you work at a US-listed company, or a subsidiary of one, some of your controls will be “in scope for SOX”, and a second vocabulary applies to them. The reason SOX testers seem less flexible than operational auditors is that their words have regulatory definitions and the consequences land outside your department. Section 404(a) of the Sarbanes-Oxley Act requires management to assess internal control over financial reporting as of the end of the fiscal year; Section 404(b) requires the external auditor to attest to it for companies that are not exempt. The severity vocabulary (deficiency, significant deficiency, material weakness) comes from PCAOB Auditing Standard 2201, and the SEC’s 2007 guidance for management mirrors its definition of a material weakness, including the “reasonable possibility” threshold. A material weakness is disclosed publicly in the company’s filings, and under AS 2201 the external auditor must communicate material weaknesses in writing to management and the audit committee, and significant deficiencies in writing to the audit committee.
The translation for control owners, including what testers ask for in each phase of the year, is in SOX for Control Owners; the program as a whole is in SOX 404 Explained; and the path from a single exception to a disclosed material weakness, including how deficiencies are aggregated and how a compensating control is evaluated, is in Evaluating Control Deficiencies. The two control types that generate the most SOX findings for business owners, in the practitioner’s experience, are management review controls, where the problem is usually evidence of review and precision, and segregation of duties, where the problem is usually a small team and a workflow tool that allows self-approval. One timing rule is worth memorizing: under AS 2201 deficiencies are evaluated as of the date of management’s assessment, so a control fixed in January does not cure a weakness that existed on 31 December.
| Term | Plain meaning | What it means for you | What to ask |
|---|---|---|---|
| ICFR and Section 404 | Internal control over financial reporting: the process, designed by or under the supervision of the principal executive and financial officers, that provides reasonable assurance over reliable external financial reporting (AS 2201, A5). SOX Section 404(a) requires management’s annual assessment of it; 404(b) requires the external auditor’s attestation for companies that are not exempt. | Your control’s test results feed management’s year-end assessment and, where 404(b) applies, the external auditor’s opinion, so test dates and evidence requests follow the reporting calendar, not your workload. | “Is this control in SOX scope, and who tests it: internal audit, a SOX team or the external auditor?” |
| Key control | A control whose failure would leave a significant risk of material misstatement unaddressed; the controls management and the auditors rely on and test. | Key controls are tested every year, by sample, to evidence standards you cannot negotiate. Knowing which of your controls are key tells you where to spend care. | “Which of my controls are key, and which financial statement assertion does each support?” |
| Control deficiency | Under AS 2201 (A3), a deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of their work, to prevent or detect misstatements on a timely basis. In design: the control is missing, or would not meet its objective even if operated as designed. In operation: a properly designed control did not operate as designed, or was performed by someone without the authority or competence to perform it effectively. | An exception is evaluated to decide whether it is a deficiency; a deficiency is then evaluated for severity. In practice most deficiencies stay at this lowest level; the external auditor reports them to management in writing. | “Is this being evaluated as a deficiency, and if so, in design or in operation?” |
| Significant deficiency | A deficiency, or combination of deficiencies, less severe than a material weakness yet important enough to merit attention by those responsible for oversight of the company’s financial reporting (AS 2201, A11). | It is communicated in writing to the audit committee. There is no numeric threshold; the judgment is about likelihood and magnitude. | “What likelihood and magnitude assessment puts this at significant rather than deficiency?” |
| Material weakness | A deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis (AS 2201, A7; the SEC’s definition matches). “Reasonable possibility” means reasonably possible or probable, not remote. | A material weakness means ICFR is not effective as of year-end and is disclosed in the company’s filings, even if the control is fixed afterward. Indicators include fraud by senior management, a restatement to correct a material misstatement, and ineffective audit committee oversight. | “Has this been evaluated individually and in combination with other deficiencies, and what magnitude is assumed?” |
| Management review control (MRC) | A control in which a manager reviews information, such as a reconciliation, an estimate, a variance analysis or an exception report, against an expectation and a threshold, investigates outliers and resolves them. | Testers look for precision (the threshold and level of detail), the follow-up of outliers and evidence of review. A sign-off alone shows the review was claimed, not performed. | “What threshold and level of detail do you expect for this review, and what evidence of investigation do you need?” |
Worked example: one draft finding, translated
The following finding is hypothetical. Harbor Trust is an invented regional bank and the numbers are illustrative. It is written the way a competent audit team writes, which means it is dense with the vocabulary above, and it is the kind of paragraph that lands in a process owner’s inbox with a ten-business-day response deadline.
Finding 2 (High): Vendor master changes not subject to independent approval. Condition: For a sample of 25 vendor master changes selected from the population of 1,140 changes processed between 1 January and 30 September 2026, 4 exceptions were noted in which the change was approved by the same user who entered it. Evidence of review could not be provided for a further 3 items. Criteria: Procurement Policy PP-07 requires independent approval of all vendor master changes. Cause: The workflow tool allows the preparer role to self-approve, and the compensating monthly review of the vendor change report is not evidenced. Effect: Unauthorized or fraudulent vendor changes could result in misdirected payments; the control is a key control for the completeness and accuracy of accounts payable. Recommendation: Management should restrict self-approval in the workflow tool and retain evidence of the monthly review. Management response: [to be provided].
Read line by line, the finding says less, and asks for more, than it first appears to. Each phrase below is a term from the tables doing a specific job, and each has a specific thing you can do about it before the response is due.
| What the draft says | What it means | What to do before you respond |
|---|---|---|
| “a sample of 25 vendor master changes selected from the population of 1,140” | The test covered 25 of 1,140 items over nine months. A sample of 25 is a zero-deviation plan, so any exception breaks it. The population is yours; the selection was theirs. | Re-run the extract with the same parameters and confirm 1,140. Ask for the 25 item identifiers. |
| “4 exceptions were noted in which the change was approved by the same user who entered it” | Four items failed segregation of duties in operation. The condition is specific and numeric, which makes it the most contestable part of the finding. | Trace all four. Same user? Same week? An emergency path the policy permits? Each fact that changes also changes the condition. |
| “Evidence of review could not be provided for a further 3 items” | Three items are treated as unreviewed because nothing shows a review happened. It does not say the review did not happen; it says the auditors cannot see that it did. | If evidence exists (a workflow log, an approval email, an annotated report), send it before the comment deadline. It can remove three of seven exceptions. |
| “Criteria: Procurement Policy PP-07 requires independent approval of all vendor master changes” | The yardstick. The finding exists because practice differs from PP-07. | Read PP-07’s actual words. If it allows a defined exception, or has been superseded, the criteria statement changes, and possibly the finding with it. |
| “Cause: The workflow tool allows the preparer role to self-approve” | A design cause: the system permits the failure. The fix is a configuration change, not retraining. | Agree or correct the cause now. Your action plan will be judged against whatever cause the final report states. |
| “the compensating monthly review of the vendor change report is not evidenced” | The control that could have lowered the rating fails on evidence, not on existence. | If the reviewer kept notes or a marked-up report, produce them. If not, do not claim the review as a control until it leaves a trace. |
| “the control is a key control for the completeness and accuracy of accounts payable” | SOX scope. The finding will also be evaluated as a deficiency by the SOX team or the external auditor, and may be aggregated with others. | Tell your SOX contact the same day. Ask how and when the deficiency evaluation will run. |
| “Finding 2 (High)” | The rating comes from the function’s written definitions. Four SoD failures on a key control with no evidenced compensating control will usually meet a High definition. | Argue only from corrected facts applied to the written scale. “No payments were misdirected” speaks to effect that has occurred, not to exposure. |
| “Management response: [to be provided]” | Your words, printed verbatim, read by the audit committee. | Agree or disagree with each fact. State the action (restrict self-approval; evidence the monthly review), the owner, a date that includes an operating period, and the interim measure. |
Worked through that way, the owner at Harbor Trust has four moves before the deadline, in order: confirm the population, trace the seven items, produce any review evidence that exists, and read the policy. Only then write the response. Some of the seven exceptions may fall away on evidence and the rating may or may not move with them, but the response will be built on facts the auditors can check, which is the only kind they change their position for. The guide to management response examples has the wording for each outcome, including the case where the facts hold and the right response is a dated plan.
Twelve phrases you will hear, and how to read them
Beyond the formal terms, auditors have a working idiom, and some of it sounds worse than it is while some of it sounds milder than it is. The table decodes twelve phrases practitioners use constantly. The “signal” column is practitioner judgment about what the phrase usually indicates; the “what to say” column is a reply that gets you information rather than a reaction. The things that are never worth saying in reply are collected in what not to say to your internal auditor.
| What you hear | What it usually means | Signal | What to say |
|---|---|---|---|
| “Can you walk me through that?” | They want to see the step performed on a real item, at the screen, by the person who does it. | Neutral. They are learning. | “Yes. Which transaction do you want to use, and who should drive?” |
| “Is that documented?” | They need evidence that exists independently of your account of it. | Neutral, but the answer decides whether the control counts. | “It is in the system; do you want the record, the procedure, or both?” |
| “We’ll take that as a potential finding.” | It goes on the list for corroboration. It is not yet rated or written. | Medium. The next two days matter. | “What would you need to see to take it off the list?” |
| “We can’t rely on that report.” | An IPE problem: they cannot confirm the report is complete and accurate, usually because the parameters are unknown or a manual step sits in the chain. | Low to medium. Fixable with the source and the parameters. | “What about its production do you need: the query, the parameters or the system log?” |
| “We’ll need to extend the sample.” | An exception appeared and they are deciding whether it is isolated. More items will be tested. | Medium. The extended sample decides the finding. | “What did the first exception look like, and how many more will you test?” |
| “That’s a design issue.” | The control as described cannot address the risk, however well it is performed. | Medium to high. Effort will not cure it; the control must change. | “What would the control need to do differently to address the risk?” |
| “We’ll note it as an observation.” | A lesser item, often unrated, reported for improvement rather than as a finding. | Low. | “Will it carry an action and a date, or is it informational?” |
| “Let’s take that offline.” | The point is outside scope, sensitive, or an argument they do not want to have in the room. | Depends. Follow up the same day. | “Agreed. Can we put thirty minutes in tomorrow so it does not drift?” |
| “That may need to go up.” | Escalation to your executive, the CAE or the audit committee, usually over a disagreement on facts or access, or a serious issue. | High. | “Who will it go to, and can I give my side in writing before it does?” |
| “What’s the compensating control?” | They see a gap and are giving you the chance to show that something else addresses the risk. | An opening. | “Here is what catches it downstream. What evidence of it do you need?” |
| “Facts are frozen as of Friday.” | Fieldwork is closing. Anything that would change a condition must be in before then. | A deadline. | “Is anything still open on your side that I can clear before Friday?” |
| “Implemented is not the same as closed.” | They accept the work is done but have not validated it. Closure needs testing and often an operating period. | Neutral. Patience. | “What will you test and when, and how long an operating period do you need?” |
One vocabulary is deliberately absent from this guide. If a conversation turns to suspected fraud, the words change (preservation, investigation, privilege, referral) and so do the rules about who you may talk to and what you may touch; when internal audit suspects fraud in your area covers that situation on its own. This guide is general and educational; it is not legal or employment advice.
Questions readers ask
What does PBC mean in an audit?
PBC stands for “provided by client” (some functions say “prepared by client”), and the PBC list is the request list of documents, reports and data extracts the auditors need from you, each with a due date. The term is borrowed from external audit, where the audited company is the firm’s client. Expect the list to grow during fieldwork as the walkthrough and testing raise new questions.
What is the difference between an exception and a finding?
An exception is a single sampled item where the control did not operate as designed or could not be shown to have operated; it is a fact recorded during testing. A finding is the conclusion the auditors reach after investigating the exceptions: that a control is not designed or operating well enough, stated as criteria, condition, cause and effect, and rated. Not every exception becomes a finding, and the time between the two is when your explanation carries the most weight.
What is the difference between a draft audit report and a final audit report?
The draft is the auditors’ complete report, sent to the audited area for factual accuracy checks and management responses, usually with a window of five to ten business days. The final incorporates corrected facts, your responses in your words, any recorded disagreement and the acknowledgment of actions already taken, and it is approved by the chief audit executive and sent to the distribution list, which usually includes the audit committee. Facts can be corrected at the draft stage; the auditors’ conclusions remain theirs, though Standard 13.1 gives you the right to have your position recorded.
What does “risk accepted” mean on an audit finding?
It means a manager with the authority to bear the consequence has decided, in writing, not to remediate the finding and to live with the exposure. The finding is not closed or downgraded; it stays on the issue log under a risk-accepted status with a review date. If the accepted risk is beyond the organization’s appetite or tolerance, Standard 11.5 requires the chief audit executive to raise it with senior management and, if it is not resolved, with the board.
Is a “Needs Improvement” rating a failure?
No. On the common three-level scale it is the middle rating, and it means the audit found control gaps that need action but not a breakdown of the control environment; Unsatisfactory is the failing grade. Scales differ between organizations, so read your function’s written definitions rather than the word. The guide to internal audit ratings compares the common scales and explains how findings roll up to the report rating.
What is the difference between a significant deficiency and a material weakness?
Both are SOX terms defined in PCAOB AS 2201. A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis; it makes internal control over financial reporting “not effective” and is disclosed publicly. A significant deficiency is less severe than a material weakness but important enough to merit the attention of those responsible for oversight of financial reporting; it is communicated in writing to the audit committee but is not disclosed in the same way. Neither has a numeric threshold; the judgment rests on likelihood and magnitude.
What do auditors mean by “the Standards”?
The IIA’s Global Internal Audit Standards, the mandatory professional standards for internal auditors, effective 9 January 2025, organized into five domains, fifteen principles and fifty-two standards. When an auditor says “the Standards require us to”, they usually mean a specific numbered standard, and you can ask which one. The ones most relevant to you are 13.1 on engagement communication, 14.3 on evaluating findings, 15.1 on the final report and 15.2 on follow-up.
Why is my finding still open when I finished the work months ago?
Because “implemented” and “closed” are different states. Standard 15.2 requires internal audit to confirm that the action plan was implemented; in practice that means validating it with evidence, usually by testing items processed after the fix. Many functions also want to see the fixed control operate for a period before closing a Medium or higher finding. Submit a closure request when you can show the control operating, with the evidence organized the way the validator will test it; how to get an audit finding closed explains what validators look for.
Related guides
- Being Audited? hub — every guide written for the people on the receiving end of an audit, organized by stage.
- Internal Audit Jargon Explained: 120 Terms — the auditor-side glossary, with the technology, analytics and regulatory vocabulary this guide leaves out.
- What to Expect During an Internal Audit — the stages, timelines and request list the terms above belong to.
- The PBC Survival Guide — handling the request list without derailing your day job.
- What Counts as Audit Evidence — what to send, what gets rejected and the IPE questions that follow any system report.
- How to Walk an Auditor Through Your Process — preparing and running the walkthrough from the auditee’s chair.
- The 5 C’s of Audit Findings — criteria, condition, cause, effect and corrective action, from the writer’s side.
- Internal Audit Ratings Explained — the common scales, how findings roll up to the report rating and what is worth contesting.
- The Draft Audit Report Has Landed — the 48-hour review method and the five things you can still change.
- Management Responses to Audit Findings: 15 Examples — wording from “agree” to “risk accepted” that holds up in the final report.
- How to Get an Audit Finding Closed — what validators test and the evidence pack that passes first time.
- Risk Acceptance by Management — the right process, the authority ladder and the one-page record.
- The Three Lines Model Explained — why management owns the controls and internal audit can advise but not do.
- SOX for Control Owners — what testers ask for, what each phase means and how to pass testing.
Leave a Reply