Finding
Definition
A discrete, evidence-backed statement that a specific control is absent, misconfigured, or insufficient. Each finding contains an issue statement, evidence, risk rating, impact description, and recommendation. Findings are the unit of communication between the auditor and the auditee.
- Definition
- Evidence-backed statement of an absent or insufficient control
- Contents
- Issue statement, evidence, risk rating, impact, recommendation
- Role
- Unit of communication between auditor and auditee
Common questions
Why does a finding require a risk rating rather than just a description of the gap?+
The risk rating tells management how urgently to act, since a long list of undifferentiated gaps gives no basis for prioritising remediation resources against the organisation's actual exposure.
What separates an observation from a formal finding in an audit report?+
A formal finding is backed by specific evidence tying it to a defined control failure with an assigned risk level and recommendation, whereas a looser observation may note something worth watching without meeting that evidentiary bar.
Related terms
- Executive Summary
- The opening section of an audit report written for non-technical leadership. It states the audit scope, overall posture, the most material findings...
- Management Response
- The audited organisation's formal reply to each finding, included in the report. It states whether the recommendation is accepted, rejected, or accepted...
- Nonconformity
- The ISO 27001 term for a finding that represents a failure to meet a requirement of the standard or the organisation's own...
- Observation
- A noted issue or improvement opportunity that does not constitute a formal finding because it lacks sufficient evidence or does not violate...
- Risk Rating
- A classification of a finding's severity, typically Critical, High, Medium, Low, or Informational, derived from a likelihood-by-impact matrix. The rating determines remediation...