What is an internal audit finding
A finding is the gap between the control you expected and what the test showed. It is not finished when it is written. It is finished when a different person has checked the fix.
Heads of internal audit search for this when a new team member, or management, treats every observation as a finding, or treats a typed "Closed" as the end of the work. The distinction matters because the leadership pack for management or the audit committee should show open actions, not a pile of notes.
What belongs in the finding
- The condition: what the test found.
- The criterion: the control, policy, or standard it was tested against.
- The cause, when you know it, and the effect if it is left open.
- The agreed action, one owner, and one target date.
- The evidence the owner attaches when they say it is done.
What is not a finding yet
A review note on a work paper is not a finding. An observation that was never agreed with the owner is not an action anyone can be chased for. Keep those in the file until the report is issued. After the report, each agreed action should live in one record, not in a second spreadsheet.
How it closes
The owner can confirm and attach evidence. The owner cannot verify their own work. A reviewer accepts or returns the evidence. Only an independent verifier closes the item. The old date stays on the record if a new date is approved.
That is the record the internal audit report and the leadership pack should be printed from. For the chase itself, see how to track audit findings until they are verified.