The 5 Cs of an Audit Finding

A finding that is just an opinion gets argued with; a finding with structure gets fixed. The 5 Cs are the discipline that turns 'this looks bad' into a clear, defensible, actionable statement that an auditee and leadership can accept and act on.

• Condition: what you actually found, factually and specifically. The evidence, not the judgment.
• Criteria: what *should* be true: the standard, policy, or control requirement the condition violates.
• Cause: *why* it happened (process gap, resourcing, awareness). Root cause, not blame.
• Consequence: the business risk if it's left unaddressed, in plain terms leadership cares about.
• Corrective action: your recommendation, with an owner and a realistic date.

Validate the facts with the control owner before you write the finding: no surprises in the report. Lead with consequence when you brief leadership (they care about risk, then detail). And separate a finding (a real nonconformity) from an observation/opportunity for improvement: over-stating an OFI as a finding erodes trust in the whole report.