A finding is an observation or exception identified during audit testing. Findings can include:

• Control Deviations: Controls not operating as designed
• Exceptions: Transactions or instances that don't follow policy or procedure
• Design Deficiencies: Controls that don't properly address the intended objective
• Operating Deficiencies: Controls exist but aren't working effectively
• Compliance Issues: Violations of policies, procedures, or regulatory requirements

Note: Not every observation is a finding. A finding should represent something significant enough to warrant management's attention and corrective action.

In SmartHubs, create a new finding in the audit project:

• Navigate to the Findings section of your audit project
• Click "Create Finding" or "Add Finding"
• You'll see a form with fields for finding information
• Fill in the required fields (title, category, risk level, etc.)
• SmartHubs may link the finding to the procedure automatically

Complete all sections of the finding to ensure it's comprehensive and defensible:

• Finding Title: Brief, descriptive title of the finding
• Category: Functional area or process affected (Finance, IT, Operations, etc.)
• Risk Level: Rate as Critical, High, Medium, or Low based on your organization's definitions
• Condition: What was observed (the facts of what was found)
• Criteria: What should exist (policy, procedure, standard, regulatory requirement)
• Effect/Impact: Why this matters (consequence of the condition, risk exposure)
• Cause: Why the condition exists (root cause analysis)

Best Practice: Use the embedded finding editor to write a clear, comprehensive narrative that explains the finding so anyone unfamiliar with the audit can understand it.

Link supporting evidence to the finding:

• In the finding, there's typically an "Evidence" or "Attachments" section
• Link to evidence files you uploaded to the related procedure
• If needed, upload additional evidence directly to the finding
• Include sufficient evidence to substantiate the finding—don't leave gaps
• Add annotations or descriptions explaining what each evidence file shows

Once documented, submit the finding for validation by a reviewer:

• Click "Submit for Review" or "Mark as Ready for Validation"
• The finding will be assigned to a reviewer (usually a manager or senior auditor)
• You may be able to select a specific reviewer
• The finding status will change to "Pending Review" or similar

Note: The validation process ensures finding quality and ensures findings are significant enough for the audit report.

The reviewer may provide feedback or request changes:

• Check the finding for reviewer comments or feedback
• Address any questions or concerns raised
• Clarify the condition or provide additional evidence if requested
• Update the finding documentation as needed
• Resubmit for validation if significant changes were made
• Once approved, the finding is validated and ready for the report

Ensure each finding includes these five essential elements:

• 1. Condition: What was found—specific facts, not opinions
• 2. Criteria: What should be—the standard, policy, or requirement
• 3. Cause: Why it happened—root cause analysis
• 4. Effect: Why it matters—impact and risk
• 5. Recommendation: What should be done—specific, actionable steps

• Be objective—report facts, not opinions or judgments
• Be specific—provide dates, amounts, transaction numbers, specific examples
• Be concise—avoid unnecessary details but include sufficient context
• Be constructive—frame as an opportunity to improve, not a criticism
• Quantify impact when possible—number of exceptions, financial exposure, etc.
• Distinguish between isolated exceptions and control deficiencies

Choose the appropriate risk level based on your organization's definitions:

• Critical: Could result in significant financial loss, regulatory violation, or operational failure
• High: Could result in material loss or represent a significant control breakdown
• Medium: Could result in moderate impact or represents a control deficiency requiring attention
• Low: Minor control inefficiency with minimal impact

Reviewers validate findings by checking:

• Is the finding significant enough to report?
• Is the finding properly supported by evidence?
• Is the finding clearly written and easy to understand?
• Are all five elements present and complete?
• Is the risk rating appropriate for the situation?
• Is the finding factual, not opinion-based?

If the reviewer requests revisions, common reasons include:

• Missing supporting evidence or insufficient documentation
• The condition needs clarification or is not clearly stated
• The risk rating should be adjusted higher or lower
• The finding is too similar to another finding and should be consolidated
• The finding isn't significant enough to include in the report
• Additional testing is needed to substantiate the finding

• Control Design Issues: Control doesn't adequately address the risk
• Operating Deviations: Control exists but wasn't followed consistently
• Detection Deficiencies: Errors or exceptions were not detected by controls
• Authorization Issues: Transactions not properly approved or authorized
• Documentation Deficiencies: Supporting documentation missing or incomplete
• Reconciliation Issues: Account balances not reconciled or reconciliations not reviewed
• Policy Violations: Activities not in compliance with organizational policies