The Big Takeaway
Not all audit findings carry the same level of risk. Understanding the type of finding helps your organization put it in perspective, prioritize its response, and decide what needs attention first.
Remember:
- A control deficiency doesn’t automatically mean money is missing or fraud occurred. It identifies a weakness that could allow an error or problem to occur.
- Finding classifications help communicate the seriousness of a control weakness. A deficiency, significant deficiency, and material weakness deserve attention—but they don’t represent the same level of risk.
- Think of it like a roof repair. A loose shingle, a leaking section, and a large hole during a storm all need fixing. The urgency and potential consequences are different.
- Compliance findings address requirements that weren’t followed, such as laws, regulations, grant requirements, or contracts.
- Questioned costs flag grant spending that needs closer review. In a single audit, certain expenses may be questioned because their allowability or supporting documentation is in doubt.
- Start with the risk behind the finding. Instead of asking, “How bad does this make us look?” ask, “What risk does this identify, and what do we need to do about it?”
Put the Finding in Perspective
The classification gives you useful context. Understanding what a finding means helps your organization focus its time and resources where they can make the greatest difference.
Up Next: How Auditors Arrive at a Finding
What are auditors looking for—and how does something they identify during testing become a finding? Keep an eye out for the next video as Ryan explains how auditors develop findings and what they look for when reviewing your organization’s processes and controls.
Have Questions About an Audit Finding? Contact us today!
