Audit Findings

The Findings tab is the register of what the audit found. It is shown for audit types with a findings register (every Universal baseline audit type has one) and, like the rest of the audit, only to the audit team. See Audit Details.

The Register

Each finding has a number (F-01, F-02 …), a title, a rating from the audit type's scale (or none, for an observation), and the five parts auditors expect:

• Condition — what was found.
• Criteria — what should be.
• Cause.
• Effect — the risk or exposure.
• Root cause — chosen from your root-cause categories.

The register shows each finding's rating, status, the criterion or control it came from, the owners of the agreed actions, the target date (the latest open action), management's agreement, and badges for repeat findings and overdue actions. Good practice, what the audit wants to recognise rather than fix, is listed separately. Use the arrows to put the findings in the order the report should print them.

Raising a Finding

• Add finding (or Add good practice) opens an empty finding.
• On the Questionnaire, a criterion answered Not met or In progress offers Raise finding, which fills the condition from your explanation and the criteria from the question.
• On the Controls tab, a control tested Not effective offers Raise finding, which fills the condition from the tester's notes.

Draft, Then Reported

Findings raised during fieldwork are drafts: you can change or delete them. When the draft report is issued they become open. Reported findings are never deleted, only withdrawn with a reason. Once the final report is issued, the condition, criteria, cause, effect and rating no longer change. The title, root cause, management's response, the recommendations and the verification stay live.

Management's Response

For each finding, record whether management agrees, partly agrees or disagrees, and its comment.

Recommendations

Add recommendation proposes an action to management, with an owner and the dates the response and the action are due. It becomes a commitment. Open it to accept it (with the owner and due date) or decline it (with reasons), then track it to done like any other commitment. Remove from this finding unlinks it; the commitment stays. See Commitments.

Evidence

Link a document connects a document on the audit's Documents tab to the finding, with a note on what it shows.

Closing a Finding

• Verify confirms the agreed actions were done and work. The finding closes as Verified.
• Accept risk closes it as Risk accepted, with your reasons. Only someone who may act as senior official sees this action.
• Withdraw closes a finding that should not have been raised.
• Reopen undoes any of these.

Closing an audit never closes its findings; see Audit Details.

Follow-up Verification

On an issued audit, Start follow-up audit creates a follow-up audit of the same subject. Its Findings tab starts with Findings carried forward for verification: every finding still open on the earlier audit, with its agreed actions. For each, record whether it was Implemented, Partly implemented, Not implemented or is No longer applicable, and the evidence.

Nothing changes on the earlier audit until you issue the follow-up. Then:

• Implemented closes the original finding as verified.
• Not implemented raises a repeat finding on the follow-up, linked to the original, which closes as superseded.
• Partly implemented and No longer applicable leave the original open for you to decide.

Reports

The Audit Findings report reads across all your audits: open findings, aging, repeats and risk accepted.

Related Pages

• Audit Details — the audit panel and the audit report.
• Audit Evidence Requests — asking for the evidence behind findings.
• Audit Types — the rating scales findings use.
• Audit Root Causes — the root-cause categories.
• Commitments — management actions.