Why Audit Findings Need Evidence, Criteria and Impact

“Some dispatch approvals could not be found” may be a valid observation. It is not yet a complete explanation of what the organization should decide or change.

A useful finding makes its reasoning visible. The reader should be able to distinguish what was established, what expectation applies and why the gap matters.

A fictional warehouse case

Consider an original fictional electronics distributor. High-value goods leave a secured warehouse after an authorized reviewer approves the release. For this exercise, the company's internal policy requires approval before dispatch and a retrievable record linked to the shipment. This is an assumed company rule, not a universal legal requirement.

During an internal audit, some selected dispatch records cannot initially be matched to an approval record. Management explains that approval evidence may have moved to an archive after a system change.

The team now has a question to investigate. It does not yet have a basis to conclude that every unmatched shipment was unauthorized, that goods were stolen or that a financial loss occurred.

Evidence: establish what happened

Start by checking whether the apparent gap is real. Confirm the reviewed period, the selected dispatch references, the relevant system fields and the completeness of the approval extract. Check whether the archive contains the missing linkage or an applicable delegated approval.

Corroborate explanations with records rather than treating an interview as the resolution. Distinguish approval granted before dispatch from a retrospective sign-off. A later approval may document a response, but it does not automatically demonstrate that the preventive control operated at release.

If the archive restores a valid, timely link, revise the observation. If approval cannot be established, explain exactly which evidence was unavailable and which follow-up procedures were performed. Missing documentation and proven control nonperformance are different conclusions. If access to the archive is incomplete, identify the evidence or scope limitation instead of presenting an unverified breach as confirmed.

Retain support for facts that weaken the initial concern as well as facts that strengthen it. A finding should survive a fair review of the evidence, not just a persuasive presentation.

Criteria: identify the expectation that actually applies

The benchmark in this case is the relevant version of the company's dispatch policy, including its authorization limits, timing requirement, evidence-retention expectation and legitimate exception process.

Do not apply a later policy to an earlier period without an appropriate basis. Do not assume an approval by a familiar manager satisfies the delegation in force for that shipment. An authorized exception may change the assessment; an informal explanation does not necessarily do so.

If the policy is ambiguous or does not address the process, distinguish that design concern from a failure to comply with a clear requirement. Discuss an appropriate benchmark rather than inventing a rule after seeing the result.

Impact: explain exposure without inventing loss

An unverified release-approval trail can weaken the organization's ability to demonstrate that high-value stock left under appropriate authority. It may also make investigation and accountability more difficult.

Those are potential consequences. They are not equivalent to a measured loss, theft or fraud. If no loss was established by the work performed, say so. The absence of demonstrated loss does not, by itself, make a control gap insignificant.

Assess the issue in context: the goods and permissions involved, possible ways the weakness could be exploited, how often it may arise, and whether another effective control addresses the exposure. Evaluate that control rather than assuming a management description establishes its effectiveness. Use the internal audit function's methodology to prioritize the issue; the wording alone should not determine its rating.

Make the finding decision-useful

A bounded example is: “For the dispatches identified in the workpaper, the audit could not establish a retrievable pre-release approval trail after reviewing the current system and the available archive. This differs from the policy requirement for linked approval evidence. The gap limits assurance that releases were appropriately authorized; the work did not establish a loss.”

Use that wording only when those fictional conditions are supported. In a real engagement, specify the actual period, items, procedures, applicable policy and limitations in the supporting workpaper.

Investigate cause before prescribing action. An export problem, an archive-link failure and an absent approval would require different responses. Management should help establish the facts and own the corrective action; the auditor evaluates whether the proposed response addresses the supported issue.

Before issuing a finding, ask: could a reader follow the evidence to the stated gap and understand why the proposed response matters? If not, improve the analysis before polishing the sentence.