MODULE 8

Documenting Issues
ACELEC 332
Introduction

One of the outcomes of operational reviews is

the identification and communication of findings.
If conditions and practices meet expectations,
the internal auditor can notify the relevant
stakeholders that performance was satisfactory

2
Using the CCCER/5C Model to Document Findings
• Internal auditors must document relevant information to support their conclusions and
the results of the work performed. So, when internal auditors find discrepancies
between what is expected, and what is occurring, they prepare what is commonly
referred to as a finding.
• A finding is the name given to the discrepancy between what is expected and what is in place,
as discovered by auditors during their work.
• In some organizations, the term “finding” has been replaced by other labels such as
“opportunities for improvement” or “observations.” In other organizations, the term is still
being used, but it is reserved for the more serious items, while medium or lower risk
observations are labeled “observations.”

3
 CCER Model for • When preparing the finding, it is very helpful
Documenting Audit to follow a systematic framework and the
Findings
CCCER/5C model is widely used. While
C – Criteria some organizations add other elements,
such as “risk” or impact rating, these are
C – Condition additions and seldom a replacement. But
C – Cause what do these letters mean and what are
their implications to the practice of
E – Effect operational audits?
R – Recommendation

4
(1) Criteria
• The criteria are the performance standards or expectations set by relevant stakeholders.
The criteria are used in making the evaluation or verification and consist of the expected
performance.

• When performing financial reviews, the criteria would consist of relevant accounting and
financial standards that dictate the recording of transactions for financial statement
purposes.

• Criteria can also be established through external expectations like those encapsulated in
government laws and regulations. Others are based on internal expectations such as those
defined in the organization’s policies and procedures that govern employee conduct, the
use of company resources, and procedures describing how control activities or operational
activities within a process should be performed.

• Lastly, the criteria can be a combination such as those reflected in contracts and SLAs.

5
(2) Condition
• The condition refers to what the auditor discovered as a result of applying auditing
procedures. It is the factual evidence that the internal auditor found during the review.
Internal audit procedures include gathering testimony, reviewing documents,
observing the work conditions and dynamics, and performing calculations of important
figures, where applicable.

• Whereas the criteria are what should be in place, the condition is what is in place. The
finding exists because there is a difference between the criteria and the condition.
What is happening is not what should be happening, so this creates a deficiency that
warrants reporting.

6
(3) Cause
• The cause is the reason the condition exists. The cause explains why there is a
difference between expected and actual conditions. Internal auditors should search for
and identify the root causes of the condition. Failing to do so will result in the auditor
working with the symptom(s) of the problem and in the end making inadequate
recommendations that provide an insufficient solution.
• Some of the tools I have found particularly suited to help auditors get to the root cause
of problems are
• 5 Whys. Ask “why?” until you get to the root cause of the issue.
• Cause and effect diagram (also known as fishbone diagram). Create a diagram to show
visually all the possible factors creating the issue to see where the problem may have started.
• Drill down. Break down the condition into smaller parts to gain a better understanding of the
larger picture. This could also involve data analytics.

7
(4) Effect
• The effect constitutes the consequence of the condition identified. It relates to the risk
or exposure the organization, program, process, or others will face because the
condition is not consistent with the criteria.

• The effect is the impact resulting from the problem itself. A helpful approach to
document the appropriate effect, and to make sure that the auditor has in fact
identified a finding worthy of being included in the report is to ask: “So what?” Why
should anyone care about this condition?

8
(5) Recommendation
• The recommendation is the action, or collection of actions, that if successfully
implemented, will neutralize the cause, stop the effect, and restore the condition to the
desirable state (i.e., criteria).

• The effectiveness of the recommendation will depend on the auditor fully capturing the
details about each of the components of the CCCER model. By elaborating sufficiently
on each of the components, the finding will be convincing and compelling so that the
reader comes to the same conclusion as the auditor who identified the deficiency.

9
Making Findings and Recommendations Persuasive
Findings and recommendations will be persuasive to the extent that they convince the
reader that there is a real problem that requires correction. This can be achieved
through several actions:
1. Quantify as much as possible
2. Make sure findings are significant
3. Consider cost/benefit involved
4. Use appropriate language

10
Continuation (from use of appropriate language):
This can be accomplished by limiting the use of excessively technical language,
including full names rather than acronyms, including footnotes and endnotes, adding a
glossary, and using terminology that is used within the business and more likely to be
familiar to the audit report readers:
a) Use a readable report format
b) Order of importance
c) Compressing findings
d) Too lengthy
e) Proper tone

11
Using Quantitative Methods to Improve the Quality
and Impact of Audit Findings
• Few things beat facts when the objective is to argue for a particular course of action.
When the internal auditor collects reliable data, performs appropriate analysis, and
formulates conclusions based on these related facts, it is difficult for others to
contradict or ignore the communication.

• The veracity of the auditors’ work is based on quantitative information anchored in

reliable data. This quantitative approach to documenting results will improve the
impact of the audit findings.

12
Using Quantitative Methods to Improve the Quality
and Impact of Audit Findings
• Internal auditors are encouraged to collect objective information to support subjective
matters.
• For example, if motivation is a concern and this is known either anecdotally by observing the
mood of workers or the diligence with which they perform their duties, internal auditors may
want to consider interviewing multiple workers, documenting the results of those meetings,
and using this information as the basis for any mention of employee morale of dissatisfaction.
A survey, conducted by internal audit, human resources or a third-party provider, can also add
quantitative elements to this topic.

13
Using Quantitative Methods to Improve the Quality
and Impact of Audit Findings
• Another situation that illustrates this dynamic is what occurs when employees explain that the
number of phone calls, e-mails, and window customers rob them of too much of their time and
that is the reason for their inability to keep up with the work volume. While this complaint may
be true, care is needed before attempting to put this as a finding or the root cause of the
condition. Creating a check sheet and asking workers to log the number and type of calls, e-
mails, customer visits, and other distractions over a reasonable amount of time would be very
helpful to document the incidence of this. The result is the conversion of workers’ opinions into
facts and figures that can support the workers’ assertion.

14
Persuasion and Diversion
• As much as internal auditors should know how to increase their ability to be
persuasive, they should also remember that sometimes audit clients want to persuade
the auditor as well. This could be done to argue a point of view, educate the auditor,
decrease the severity of the rating on a finding, to convince the auditor to review or
not review certain items, and so on. Auditors should know about some of the
techniques used to persuade, distract, and divert their attention. For example:
➢ Repetition
➢ Will of the Majority
➢ Generalization
➢ Creating Information

15
Persuasion and Diversion
• The facts and figures that the auditors will use when presenting their findings will likely
constitute the preeminent source of information to persuade auditees. All of these
items constitute evidence that should be part of the finding and the related
communication with the client. Internal auditors should remember that the evidence
should meet certain criteria:
➢ Verifiable
➢ Transparency
➢ Sufficiency
➢ Reliability
➢ Relevancy
➢ Usefulness

16
Developing Useful, Pragmatic, and Effective
Recommendations for Corrective Action
• The Standards state that “Internal auditors must communicate the results of
engagements” (Standard 2410). Reporting audit observations are a key requirement
for internal auditors, and the board and management expect internal auditors to be
their “eyes and ears” about what is happening in their organizations. They trust the
accuracy, completeness, and timeliness of the information.
• Beyond identifying and providing a laundry list of problems, however, audit clients
expect internal auditors to provide timely, useful, relevant, and feasible
recommendations. These recommendations should help the organization restore the
deficiency, so it meets the performance expectations. It can, however, help the
organization go beyond the minimum performance requirements and propel it into the
territory of leading practices. By going one step further, competitiveness is enhanced,
and the organization perceives that internal audit is adding value beyond its baseline
expectations.

17
End of Module 8